Lakhasly

There are various phishing prevention systems with different functions, as mentioned in the last chapter: some for phishing detection and prevention, some for data encryption, and some for authentication strength. This section will discuss how to deploy a phishing detection and prevention platform using IPS and IDS as an example. Host-based IDS and Network-based IDS: A. Efe and İ. N. Abaci compared two kinds of IDS: host-based intrusion detection systems and network-based intrusion detection systems [32]. ¨ Host-based intrusion detection system (HIDS) HIDS operates on personal devices or terminal servers and has been in use since the early 1980s. Back then, it was primarily used to store logs of dangerous network activities. Nowadays, HIDS has become more sophisticated, and it can not only store risk logs but also detect various types of cyber-attacks and send alerts. ¨ Network-based intrusion detection system (NIDS) NIDS is normally deployed behind the firewall in the Demilitarized Zone (DMZ) to detect all traffic entering and leaving the network. It has two main components: sensors and monitors. The sensor captures and analyzes the traffic to determine its classification, while the monitor displays the analysis results and triggers alarms for further processing by the network administrator. The authors also pointed out in their research that detection systems can be classified into two types according to the detection methods: blacklist-based and anomaly-based. The blacklist based method uses a database containing known phishing or attack information to detect suspicious traffic. The anomaly-based method classifies traffic by analyzing its features to identify potential threats [32]. Nowadays, both methods are integrated to combat the evolving and frequently occurring cyber attacks more effectively. Out-of-band and inline deployment: N. Pappas analyzed the two deployment ways for IPS and IDS and compared their differences. The IPS or IDS can be deployed as out-of-band or inline [33]. In most situations, IDS adopts out-of-band deployment, while IPS uses the inline method. ¨ Out-of-band deployment The detection system’s sensor is not typically installed in the backbone network. It is usually connected to an interface on a router or switch. The traffic does not pass directly through the 25 sensor. Instead, the sensor gains a duplicate of the traffic by configuring the router or switch to mirror the traffic. The sensor can only monitor and detect malicious traffic but cannot prevent it. The entire network can continue to operate normally if the detection system meets some issues in this setup. ¨ Inline deployment The detection system’s sensor is directly installed in the backbone network. All external traffic must pass through the sensor before reaching the internal network. The sensor inspects all traffic and can not only detect abnormal traffic but also automatically block malicious activities. In this model, the entire network will not operate if the detection system experiences a failure. ¨ Hybrid deployment N. Pappas suggested using hybrid deployment for a modern company network. Deploy IDS and IPS in the same network because most IPS use anomaly-based detection and filter methods. This method may cause false positives. The IPS will lead to more false positives if the level of security is configured too high. However, if the security level is too low, it will miss many malicious traffic and phishing websites. Therefore, the author suggests to deploy the IDS and IPS at the same time [33]. The following figure shows how to deploy the IDS and IPS in the same network. Figure 7: Hybrid deployment with IDS and IPS 26 As shown in Figure 7, the firewall performs basic filtering after the traffic enters the company’s network from the Internet. Then, the IPS prevents malicious traffic from progressing further. The filtered traffic flows through the core router and switches into the internal network. The IDS continues to detect and analyze the traffic that has passed through the IPS. All network logs are sent to the SIEM for storage and display. The cybersecurity staff can monitor abnormal traffic through the IDS and SIEM to protect the network. All traffic reaching the end users has been filtered by the IPS and analyzed by the IDS, with cybersecurity staff overseeing the process through the SIEM. An anti-phishing system can be used instead of the IDS and IPS in this suggested topology.

There are various phishing prevention systems with different functions, as mentioned in the
last chapter: some for phishing detection and prevention, some for data encryption, and some
for authentication strength. This section will discuss how to deploy a phishing detection and
prevention platform using IPS and IDS as an example.
Host-based IDS and Network-based IDS:
A. Efe and İ. N. Abaci compared two kinds of IDS: host-based intrusion detection systems
and network-based intrusion detection systems [32].
¨ Host-based intrusion detection system (HIDS)
HIDS operates on personal devices or terminal servers and has been in use since the early
1980s. Back then, it was primarily used to store logs of dangerous network activities.
Nowadays, HIDS has become more sophisticated, and it can not only store risk logs but also
detect various types of cyber-attacks and send alerts.
¨ Network-based intrusion detection system (NIDS)
NIDS is normally deployed behind the firewall in the Demilitarized Zone (DMZ) to detect all
traffic entering and leaving the network. It has two main components: sensors and monitors.
The sensor captures and analyzes the traffic to determine its classification, while the monitor
displays the analysis results and triggers alarms for further processing by the network
administrator.
The authors also pointed out in their research that detection systems can be classified into two
types according to the detection methods: blacklist-based and anomaly-based. The blacklist
based method uses a database containing known phishing or attack information to detect
suspicious traffic. The anomaly-based method classifies traffic by analyzing its features to
identify potential threats [32]. Nowadays, both methods are integrated to combat the evolving
and frequently occurring cyber attacks more effectively.
Out-of-band and inline deployment:
N. Pappas analyzed the two deployment ways for IPS and IDS and compared their
differences. The IPS or IDS can be deployed as out-of-band or inline [33]. In most situations,
IDS adopts out-of-band deployment, while IPS uses the inline method.
¨ Out-of-band deployment
The detection system’s sensor is not typically installed in the backbone network. It is usually
connected to an interface on a router or switch. The traffic does not pass directly through the
25
sensor. Instead, the sensor gains a duplicate of the traffic by configuring the router or switch
to mirror the traffic. The sensor can only monitor and detect malicious traffic but cannot
prevent it. The entire network can continue to operate normally if the detection system meets
some issues in this setup.
¨ Inline deployment
The detection system’s sensor is directly installed in the backbone network. All external
traffic must pass through the sensor before reaching the internal network. The sensor inspects
all traffic and can not only detect abnormal traffic but also automatically block malicious
activities. In this model, the entire network will not operate if the detection system
experiences a failure.
¨ Hybrid deployment
N. Pappas suggested using hybrid deployment for a modern company network. Deploy IDS
and IPS in the same network because most IPS use anomaly-based detection and filter
methods. This method may cause false positives. The IPS will lead to more false positives if
the level of security is configured too high. However, if the security level is too low, it will
miss many malicious traffic and phishing websites. Therefore, the author suggests to deploy
the IDS and IPS at the same time [33]. The following figure shows how to deploy the IDS
and IPS in the same network.
Figure 7: Hybrid deployment with IDS and IPS
26
As shown in Figure 7, the firewall performs basic filtering after the traffic enters the
company’s network from the Internet. Then, the IPS prevents malicious traffic from
progressing further. The filtered traffic flows through the core router and switches into the
internal network. The IDS continues to detect and analyze the traffic that has passed through
the IPS. All network logs are sent to the SIEM for storage and display. The cybersecurity
staff can monitor abnormal traffic through the IDS and SIEM to protect the network. All
traffic reaching the end users has been filtered by the IPS and analyzed by the IDS, with
cybersecurity staff overseeing the process through the SIEM. An anti-phishing system can be
used instead of the IDS and IPS in this suggested topology.