|
OneSource Professional Training Solutions, Inc.
presents
IPS - Implementing Cisco Intrusion Prevention System v7.0 On-Site Training
IPS - Implementing Cisco Intrusion Prevention System v7.0
Course Description/Agenda
In this Global Knowledge-enhanced course, you will gain the skills required
to deploy Cisco's network-based Intrusion Prevention System (IPS). You will get
an introduction to Cisco IPS platforms and managers, including:
- 4200 Series Sensors
- Catalyst 6000 Series Intrusion Detection Module 2 (IDSM-2)
- Advanced Inspection and Prevention Security Services Module (AIP-SSM)
- IPS Device Manager (IDM) GUI
- IPS Manager Express (IME)
Our labs take the mystery out of the sensor, allowing you to understand how
signatures are implemented and what causes them to trigger and making you
comfortable with the technology. In our labs, signatures are triggered via
realistic intrusion attempts, not just arbitrary methods, and you'll learn why
particular signatures are triggered when attack conditions are initiated,
whether through using a network attack tool or entering a suspicious request in
a web browser.
A Global Knowledge Exclusive: Bonus Lab Credits
You'll receive five extra security e-Lab credits (good for 30 days) to review
a topic after class, refine your skills, or get in extra practice-whatever lab
activities complete your training. What You'll Learn
- How Cisco IPS protects network devices from attacks
- Basic intrusion prevention terminology
- Intrusion prevention technologies and evasive techniques
- Cisco IPS Sensor platforms and their features
- Install and configure basic settings on a Cisco IPS 4200 Series Sensor
- Use the IDM to configure built-in signatures to meet the requirements of a
given security policy
- Create and implement customized intrusion prevention signatures
- Create alarm filters to reduce alarms and possible false positives
- Configure the sensor with the command line and IDM
- Configure IPS protective reactions such as TCP reset and deny attacker inline
- Configure a Cisco IPS Sensor to perform blocking on IOS routers and Adaptive
Security Appliances (ASAs) or PIX firewalls
- Perform maintenance operations such as signature updates
- Configure and monitor anomaly detection, passive OS fingerprinting, and
virtual sensors
- Initialize and install remaining Cisco IPS family of products
- Utilize global correlation to adjust sensor actions based on the reputation of
the source IP address
- Use the CLI and Cisco IDM to obtain system information
- Internal specifications of different signature engines
Who Should Attend
- Cisco customers who implement and maintain Cisco IPS solutions
- Cisco channel partners who sell, implement, and maintain Cisco IPS solutions
- Cisco systems engineers who support the sale of Cisco IPS solutions
Course Outline
1. Introduction
- Evaluating Intrusion Prevention and Intrusion Detection Systems
- Choosing Cisco IPS Software, Hardware, and Supporting Applications
- Evaluating Network IPS Traffic Analysis Methods
- Evasion Possibilities and Anti-Evasive Countermeasures
- Choosing a Network IPS and IDS Deployment Architecture
2. Installing and Maintaining Cisco IPS Sensors
- Integrating into a Network
- Performing the Initial Setup
- Managing Cisco IPS Devices
3. Applying Cisco IPS Security Policies
- Configuring Basic Traffic Analysis
- Implementing Cisco IPS Signatures and Responses
- Configuring Signature Engines and the Signature Database
- Deploying Anomaly-Based Operation
4. Adapting Traffic Analysis and Response to the Environment
- Customizing Traffic Analysis
- Managing False Positives and False Negatives
- Improving Alarm and Response Quality
5. Managing and Analyzing Events
- Installing and Integrating IME with IPS Sensors
- Managing and Investigating Events
- Reporting and Notifications
- Integrating IPS with SMN and MARS
- Using the Cisco IntelliShield Database and Services
6. Advanced Solutions
- Using Cisco IPS Virtual Sensors
- Deploying Cisco IPS for High Availability and High Performance
7. Configuring and Maintaining Specific IPS Hardware
- ASA AIP SSM and AIP SSC Modules
- ISR IPS AIM and IPS NME Modules
- IDSM-2 Module
Labs
Our IPS labs go above and beyond the standard Cisco IPS labs. Our most
significant enhancement is the focus on signatures-the heart of IPS sensor
technology. In fact, signatures are triggered in the very first lab that you
will run in our class.
Lab 1: Enhanced - Perform Cisco IPS Sensor Initial Setup
Lab 2: Enhanced - Manage a Cisco IPS Sensor
Lab 3: Enhanced - Configure and Modify Basic Cisco IPS Signatures and Responses
Lab 4: Enhanced - Configure Cisco IPS Anomaly-Based Operation
Lab 5: Enhanced - Configure Cisco IPS Custom Signatures
Lab 6: Enhanced - Manage False Positives and Negatives
Lab 7: Enhanced - Improve Alarm and Response Quality
Lab 8: Enhanced - Use the Cisco IME
Lab 9: Enhanced - Use Cisco IPS and Security Intelligence Web Resources
Lab 10: Enhanced - Configure Policy Virtualization
|
Add to favorites
Email this page
|
On-Site Training
Seminar
