{"id":11161,"date":"2023-08-25T00:00:00","date_gmt":"2023-08-25T00:00:00","guid":{"rendered":"https:\/\/tech-lib.eu\/tech\/understanding-how-ips-works-and-its-main-applications\/"},"modified":"2023-08-25T00:00:00","modified_gmt":"2023-08-25T00:00:00","slug":"understanding-how-ips-works-and-its-main-applications","status":"publish","type":"post","link":"https:\/\/tech-lib.eu\/tech\/understanding-how-ips-works-and-its-main-applications\/","title":{"rendered":"Understanding How IPS Works and Its Main Applications"},"content":{"rendered":"
N\u00e1stroj pro zabezpe\u010den\u00ed s\u00edt\u011b zvan\u00fd syst\u00e9m prevence naru\u0161en\u00ed (IPS) slou\u017e\u00ed k identifikaci a zastaven\u00ed nep\u0159\u00e1telsk\u00e9 aktivity v s\u00edti. Slou\u017e\u00ed jako d\u016fle\u017eit\u00e1 prvn\u00ed linie ochrany proti vniknut\u00ed, napaden\u00ed a naru\u0161en\u00ed dat. C\u00edlem t\u00e9to str\u00e1nky je poskytnout \u010dten\u00e1\u0159\u016fm d\u016fkladnou p\u0159edstavu o tom, jak IPS funguje, a tak\u00e9 o t\u0159ech kl\u00ed\u010dov\u00fdch vlastnostech a \u010dty\u0159ech r\u016fzn\u00fdch druz\u00edch IPS. <\/p>\n
<\/div>\n

Jak\u00fd je hlavn\u00ed \u00fa\u010del IPS? <\/p>\n

<\/div>\n

S\u00edt\u011b jsou obecn\u011b chr\u00e1n\u011bny syst\u00e9mem IPS p\u0159ed nebezpe\u010d\u00edm v\u010detn\u011b malwaru, vir\u016f, \u010derv\u016f a \u00fatok\u016f hacker\u016f. Je nezbytn\u00fd pro ochranu d\u016fle\u017eit\u00fdch syst\u00e9m\u016f, citliv\u00fdch dat a s\u00ed\u0165ov\u00e9 infrastruktury. Syst\u00e9m IPS dok\u00e1\u017ee sledov\u00e1n\u00edm s\u00ed\u0165ov\u00e9ho provozu odhalit podez\u0159el\u00e9 akce a reagovat na n\u011b, \u010d\u00edm\u017e nab\u00edz\u00ed okam\u017eitou obranu proti potenci\u00e1ln\u00edm hrozb\u00e1m. Jak\u00e9 jsou \u010dty\u0159i podtypy IPS? <\/p>\n

<\/div>\n

1. S\u00ed\u0165ov\u00fd IPS (NIPS): Tento typ IPS je instalov\u00e1n uvnit\u0159 vnit\u0159n\u00ed s\u00ed\u0165ov\u00e9 infrastruktury nebo na perimetru s\u00edt\u011b. Zkoum\u00e1 s\u00ed\u0165ov\u00fd provoz a p\u00e1tr\u00e1 po nezn\u00e1m\u00fdch \u0161kodliv\u00fdch signatur\u00e1ch nebo neobvykl\u00fdch vzorc\u00edch. Pomoc\u00ed NIPS lze identifikovat a zahazovat pakety souvisej\u00edc\u00ed se \u0161kodliv\u00fdmi aktivitami a zabr\u00e1nit jim, aby se dostaly k zam\u00fd\u0161len\u00fdm c\u00edl\u016fm. <\/p>\n

<\/div>\n

2. Hostitelsk\u00fd IPS (HIPS): Syst\u00e9m HIPS je nasazen na konkr\u00e9tn\u00edch hostitelsk\u00fdch po\u010d\u00edta\u010d\u00edch, jako jsou pracovn\u00ed stanice nebo servery. Sleduje s\u00ed\u0165ov\u00e1 p\u0159ipojen\u00ed, integritu soubor\u016f a syst\u00e9mov\u00e9 protokoly, aby odhalil jak\u00e9koli podivn\u00e9 chov\u00e1n\u00ed nebo pokusy o neleg\u00e1ln\u00ed p\u0159\u00edstup. Syst\u00e9m HIPS m\u016f\u017ee okam\u017eit\u011b jednat, nap\u0159\u00edklad varovat spr\u00e1vce syst\u00e9mu nebo omezit podez\u0159el\u00e9 procesy. <\/p>\n

<\/div>\n

3. Bezdr\u00e1tov\u00fd IPS (WIPS): Jak ji\u017e n\u00e1zev napov\u00edd\u00e1, syst\u00e9m WIPS je vytvo\u0159en speci\u00e1ln\u011b pro zabezpe\u010den\u00ed bezdr\u00e1tov\u00fdch s\u00edt\u00ed. Zji\u0161\u0165uje a zastavuje neopr\u00e1vn\u011bn\u00e9 vstupy, \u0161kodliv\u00e9 p\u0159\u00edstupov\u00e9 body a r\u016fzn\u00e9 bezdr\u00e1tov\u00e9 hrozby. Syst\u00e9m WIPS neust\u00e1le skenuje bezdr\u00e1tov\u00e9 prost\u0159ed\u00ed, aby se ujistil, \u017ee k s\u00edti maj\u00ed p\u0159\u00edstup pouze opr\u00e1vn\u011bn\u00ed u\u017eivatel\u00e9 a za\u0159\u00edzen\u00ed. 4. Virtu\u00e1ln\u00ed IPS (VIPS) je typ syst\u00e9mu prevence naru\u0161en\u00ed, kter\u00fd se pou\u017e\u00edv\u00e1 ve virtualizovan\u00fdch kontextech, jako je cloud computing a virtu\u00e1ln\u00ed priv\u00e1tn\u00ed s\u00edt\u011b (VPN). Integritu a d\u016fv\u011brnost dat ve virtu\u00e1ln\u00ed infrastruktu\u0159e zaji\u0161\u0165uje bezpe\u010dnostn\u00ed ochrana, kterou nab\u00edz\u00ed virtu\u00e1ln\u00edm po\u010d\u00edta\u010d\u016fm. Za \u00fa\u010delem zastaven\u00ed \u00fatok\u016f a neleg\u00e1ln\u00edho p\u0159\u00edstupu sleduje VIPS s\u00ed\u0165ov\u00fd provoz mezi virtu\u00e1ln\u00edmi po\u010d\u00edta\u010di. <\/p>\n

<\/div>\n

Jak\u00e9 t\u0159i vlastnosti odli\u0161uj\u00ed IPS? <\/p>\n

<\/div>\n

1. Detekce zalo\u017een\u00e1 na signatur\u00e1ch: Pro identifikaci \u0161kodliv\u00e9 \u010dinnosti konzultuje IPS datab\u00e1zi zn\u00e1m\u00fdch signatur hrozeb. Tyto signatury jsou vzory nebo znaky spojen\u00e9 s ur\u010dit\u00fdmi druhy \u00fatok\u016f. Pokud n\u011bkter\u00e1 z t\u011bchto signatur odpov\u00edd\u00e1 s\u00ed\u0165ov\u00e9mu provozu, m\u016f\u017ee syst\u00e9m IPS p\u0159ijmout pot\u0159ebn\u00e1 opat\u0159en\u00ed, nap\u0159\u00edklad zablokovat provoz nebo vyvolat poplach. <\/p>\n

<\/div>\n

2. Detekce na z\u00e1klad\u011b anom\u00e1li\u00ed: K zaji\u0161t\u011bn\u00ed z\u00e1kladn\u00ed \u00farovn\u011b typick\u00e9ho chov\u00e1n\u00ed s\u00edt\u011b pou\u017e\u00edv\u00e1 IPS metody strojov\u00e9ho u\u010den\u00ed. Jak\u00e1koli odchylka od t\u00e9to normy je ozna\u010dena jako odchylka a m\u016f\u017ee p\u0159edznamen\u00e1vat bl\u00ed\u017e\u00edc\u00ed se \u00fatok. Vynikaj\u00edc\u00edm zp\u016fsobem, jak naj\u00edt dosud neodhalen\u00e9 \u00fatoky nebo \u00fatoky nult\u00e9ho dne, je detekce zalo\u017een\u00e1 na anom\u00e1li\u00edch. 3. Prevence naru\u0161en\u00ed: D\u00edky okam\u017eit\u00e9mu z\u00e1sahu IPS p\u0159ekra\u010duje r\u00e1mec detekce a aktivn\u011b blokuje \u00fatoky. Dok\u00e1\u017ee zastavit podez\u0159el\u00e1 spojen\u00ed, p\u0159eru\u0161it nebo zablokovat \u0161kodlivou komunikaci a izolovat infikovan\u00e9 po\u010d\u00edta\u010de od zbytku s\u00edt\u011b. Potenci\u00e1ln\u00ed nebezpe\u010d\u00ed jsou prevenc\u00ed naru\u0161en\u00ed eliminov\u00e1na d\u0159\u00edve, ne\u017e maj\u00ed \u0161anci n\u011bkoho po\u0161kodit. Jak IPS funguje krok za krokem? <\/p>\n

<\/div>\n

1. Monitorov\u00e1n\u00ed provozu: IPS nep\u0159etr\u017eit\u011b zkoum\u00e1 pakety a jejich obsah, kdy\u017e s\u00ed\u0165ov\u00fd provoz proch\u00e1z\u00ed s\u00ed\u0165ov\u00fdm rozhran\u00edm. <\/p>\n

<\/div>\n

2. Kontrola provozu: Pomoc\u00ed detekce zalo\u017een\u00e9 na signatur\u00e1ch nebo metod detekce anom\u00e1li\u00ed je ka\u017ed\u00fd paket zkoum\u00e1n z hlediska indici\u00ed \u0161kodliv\u00e9 \u010dinnosti. 3. Detekce hrozeb: IPS kontroluje obsah paketu s datab\u00e1z\u00ed rozpoznan\u00fdch signatur \u00fatok\u016f nebo jej posuzuje ve srovn\u00e1n\u00ed s obvykl\u00fdm z\u00e1kladn\u00edm chov\u00e1n\u00edm. Pokud je zji\u0161t\u011bna shoda nebo anom\u00e1lie, je indikov\u00e1na potenci\u00e1ln\u00ed hrozba. <\/p>\n

<\/div>\n

4. Generov\u00e1n\u00ed v\u00fdstrah: IPS generuje v\u00fdstrahu, kter\u00e1 informuje spr\u00e1vce syst\u00e9mu nebo bezpe\u010dnostn\u00ed opera\u010dn\u00ed centrum (SOC) o potenci\u00e1ln\u00edm nebezpe\u010d\u00ed. Pro dal\u0161\u00ed \u0161et\u0159en\u00ed nab\u00edz\u00ed v\u00fdstraha informace o podez\u0159el\u00e9m chov\u00e1n\u00ed. <\/p>\n

<\/div>\n

5. Proveden\u00ed akce: IPS m\u016f\u017ee prov\u00e9st rychlou akci v z\u00e1vislosti na z\u00e1va\u017enosti hrozby a nastaven\u00fdch bezpe\u010dnostn\u00edch z\u00e1sad\u00e1ch. Posti\u017een\u00e9 hostitele lze izolovat od s\u00edt\u011b, ukon\u010dit spojen\u00ed nebo zablokovat provoz. <\/p>\n

<\/div>\n

Z\u00e1v\u011brem lze \u0159\u00edci, \u017ee IPS je z\u00e1kladn\u00edm bezpe\u010dnostn\u00edm n\u00e1strojem, kter\u00fd m\u00e1 z\u00e1sadn\u00ed v\u00fdznam p\u0159i obran\u011b s\u00edt\u00ed p\u0159ed r\u016fzn\u00fdmi \u00fatoky. Pou\u017eit\u00ed IPS umo\u017e\u0148uje detekci a prevenci ne\u017e\u00e1douc\u00edho p\u0159\u00edstupu, \u00fatok\u016f a naru\u0161en\u00ed dat pomoc\u00ed detek\u010dn\u00edch technik zalo\u017een\u00fdch na signatur\u00e1ch a anom\u00e1li\u00edch. IPS poskytuje ochranu v re\u00e1ln\u00e9m \u010dase t\u00edm, \u017ee nep\u0159etr\u017eit\u011b monitoruje s\u00ed\u0165ov\u00fd provoz, rozpozn\u00e1v\u00e1 hrozby a p\u0159ij\u00edm\u00e1 p\u0159\u00edslu\u0161n\u00e1 opat\u0159en\u00ed, a\u0165 u\u017e se jedn\u00e1 o s\u00ed\u0165ov\u00e9, hostitelsk\u00e9, bezdr\u00e1tov\u00e9 nebo virtu\u00e1ln\u00ed \u00fatoky.<\/p><\/div>\n

\n
FAQ<\/div>\n
\n
Jak\u00fd je rozd\u00edl mezi IP a IPS?<\/div>\n

Term\u00edn „IP“ ozna\u010duje soubor sm\u011brnic, kter\u00e9 \u0159\u00edd\u00ed zp\u016fsob p\u0159enosu a p\u0159\u00edjmu datov\u00fdch paket\u016f p\u0159es internet. V podstat\u011b se jedn\u00e1 o protokol, kter\u00fd m\u00e1 na starosti adresov\u00e1n\u00ed a sm\u011brov\u00e1n\u00ed datov\u00fdch paket\u016f mezi za\u0159\u00edzen\u00edmi. <\/p>\n

<\/div>\n

Syst\u00e9m prevence naru\u0161en\u00ed naproti tomu odpov\u00edd\u00e1 sv\u00e9mu n\u00e1zvu. IPS je bezpe\u010dnostn\u00ed syst\u00e9m, kter\u00fd m\u00e1 za \u00fakol identifikovat a zastavit potenci\u00e1ln\u00ed naru\u0161en\u00ed nebo napaden\u00ed s\u00edt\u011b, na rozd\u00edl od protokolu IP, kter\u00fd se soust\u0159ed\u00ed na sm\u011brov\u00e1n\u00ed a adresov\u00e1n\u00ed datov\u00fdch paket\u016f. Sleduje s\u00ed\u0165ov\u00fd provoz, zkoum\u00e1 jej z hlediska podez\u0159el\u00fdch aktivit nebo zn\u00e1m\u00fdch vzorc\u016f \u00fatok\u016f a pot\u00e9 p\u0159ij\u00edm\u00e1 vhodn\u00e1 opat\u0159en\u00ed k zastaven\u00ed pr\u016fniku. <\/p>\n

<\/div>\n

IPS je bezpe\u010dnostn\u00ed syst\u00e9m, kter\u00fd aktivn\u011b monitoruje a chr\u00e1n\u00ed p\u0159ed naru\u0161en\u00edm s\u00edt\u011b, zat\u00edmco IP je standard pro adresov\u00e1n\u00ed a sm\u011brov\u00e1n\u00ed datov\u00fdch paket\u016f.<\/p>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

N\u00e1stroj pro zabezpe\u010den\u00ed s\u00edt\u011b zvan\u00fd syst\u00e9m prevence naru\u0161en\u00ed (IPS) slou\u017e\u00ed k identifikaci a zastaven\u00ed nep\u0159\u00e1telsk\u00e9 aktivity v s\u00edti. Slou\u017e\u00ed jako d\u016fle\u017eit\u00e1 prvn\u00ed linie ochrany proti vniknut\u00ed, napaden\u00ed a naru\u0161en\u00ed dat. C\u00edlem t\u00e9to str\u00e1nky je poskytnout \u010dten\u00e1\u0159\u016fm d\u016fkladnou p\u0159edstavu o tom, jak IPS funguje, a tak\u00e9 o t\u0159ech kl\u00ed\u010dov\u00fdch vlastnostech a \u010dty\u0159ech r\u016fzn\u00fdch druz\u00edch IPS. Jak\u00fd … \u010c\u00edst d\u00e1l<\/a><\/p>\n","protected":false},"author":1569,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4254],"tags":[],"class_list":["post-11161","post","type-post","status-publish","format-standard","hentry","category-network-security"],"_links":{"self":[{"href":"https:\/\/tech-lib.eu\/tech\/wp-json\/wp\/v2\/posts\/11161","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tech-lib.eu\/tech\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tech-lib.eu\/tech\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tech-lib.eu\/tech\/wp-json\/wp\/v2\/users\/1569"}],"replies":[{"embeddable":true,"href":"https:\/\/tech-lib.eu\/tech\/wp-json\/wp\/v2\/comments?post=11161"}],"version-history":[{"count":0,"href":"https:\/\/tech-lib.eu\/tech\/wp-json\/wp\/v2\/posts\/11161\/revisions"}],"wp:attachment":[{"href":"https:\/\/tech-lib.eu\/tech\/wp-json\/wp\/v2\/media?parent=11161"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tech-lib.eu\/tech\/wp-json\/wp\/v2\/categories?post=11161"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tech-lib.eu\/tech\/wp-json\/wp\/v2\/tags?post=11161"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}