A network security team observes severe throughput degradation and dropped legitimate traffic on an inline Network Intrusion Prevention System (NIPS) during peak hours. The NIPS performs deep packet inspection and signature matching on unencrypted perimeter traffic. Concurrently, an audit reveals that internal attackers are transmitting malicious encrypted payloads across TLS sessions that bypass the NIPS undetected. Which of the following architectural modifications best addresses the processing bottleneck while providing threat visibility into the encrypted traffic?
- Deploy Host-based Intrusion Detection Systems (HIDS) on critical endpoint servers while reconfiguring the network intrusion sensor to a passive out-of-band TAP deployment.Cevap
- BMove the NIPS from the network perimeter to Layer 2 trunk links and enforce port-based filtering for Port 443.
- CReconfigure the inline NIPS to utilize port-based signature matching rather than deep packet payload inspection.
- DReplace the signature-based NIPS engine with a passive network ARP inspection daemon connected to a switch SPAN port.
Cevap
Deploy Host-based Intrusion Detection Systems (HIDS) on critical endpoint servers while reconfiguring the network intrusion sensor to a passive out-of-band TAP deployment.
The combination of converting network sensors to an out-of-band TAP and installing Host-based Intrusion Detection Systems (HIDS) addresses both challenges effectively. Passive TAP deployments mirror traffic without sitting inline, eliminating network latency and packet drops. HIDS operates directly on endpoints where encrypted transport sessions (TLS) are decrypted, enabling full payload and behavior monitoring that network-level devices miss.
Adım Adım Çözüm
Anahtar Kavram
HIDS vs NIDS visibility and In-Band vs Out-of-Band deployment trade-offs