Device Attributes

Passive Versus Active

When we're adding security devices to our network, sometimes we can cause more problems than we actually solve. So we need to make sure we address some configurations when it comes to configuring these security devices.

When we're setting up devices, we can either set them up as being passive, like an intrusion detection system, or being active, like an intrusion prevention system. Or we could have it set up inline, or as a monitor or a tap.

Passive devices don't take any action with the exception of just notifying you. If we set them up, what happens is that we can get notified if something happens on our network. That's great, that's what we want, but it can't just stop an attack. An example of this is that intrusion detection system, where it just detects if something's going on your network and then notifies you, but doesn't take action against it.

If we turn something on to be active, it's great because it stops that attack, but we also get that performance hit, and it can also block legitimate traffic. This is not just the case for something like an intrusion prevention system -- we can set up other systems just the same way. Do we want it to actively stop something, or do we want it to be passive on our network and just notify us?

Inline Versus Monitor

When we set up some devices -- and a firewall is a good example of this -- we want it to be inline. That means that all traffic is going to hit the firewall and then come into our network if it's allowed, and there isn't any chance that it can bypass this firewall. We want to make sure everything goes through that firewall.

But there are some things, like an intrusion detection system or intrusion prevention system, where we might want to choose whether we want it to be inline or we want it to just monitor. If it's inline, it's going to be just like a firewall and it will make decisions just like a firewall. And if it goes offline, the problem is that it can bring our whole network down. So that's one of the problems if we have it inline.

The other thing we could do is set it up as a monitor. One thing that we can do is replicate certain traffic across the port, and it would get that information. Now it can analyze what's happening on the network and make a decision. Certainly if this is an intrusion detection system, this is a good way to set this up. If it's an intrusion prevention system, we can still stop traffic. We can still stop the intrusion, either by notifying the firewall and creating a rule, or perhaps we respond in a certain way and stop the traffic from happening on the local network.

So there are ways that we can configure this. But what we get is that if it's a monitor and it goes offline, it doesn't necessarily bring the whole system down like it would if it was inline.