## 5 Real Security Implementations for VPNs and VLANs
### Security Issues and Countermeasures in VLANs
#### 5.2.1 IDSs, IPSs and Intrusion Detection and Prevention Systems (IDPSs)  
IDS refers to a software component or to a hardware device with an embedded dedicated software, adapted to analyze the traffic in transit to or from the specific network in which it is installed. The purpose of having an IDS in a network (usually a LAN) is to monitor the traffic in order to detect any suspicious activity and/or malicious activity towards any host (whether client or server) in the network. Such systems are often able to generate alerts and log files based on their activities or analysis--they will have access to relational databases, while saving information about the particular network traffic that is 'interesting' from the point of view of the network administrator.  
An IPS consists, instead, of a software or hardware component disposed within a network, intended to prevent attempts to attack the network. The most common preventive actions taken by an IPS are: packet or session dropping, reset of the session and adding to a black-list the host that moved the attack.  
IDS and IPS are complementary technologies in the field of network security and able to work in synergy. Both are activated (alert or prevention) based on the matching between certain rules provided by the network and transiting packets. For these reasons, IDS and IPS are implemented together, obtaining a hybrid system called Intrusion Detection and Prevention System (IDPSs).  
There are four different types of IDPS technologies:  
1. Network-Based IDPSs (NB-IDPSs): these monitor traffic, with particular regard to the application and network layers. Typically they are installed on the edge of the network topology (before firewalls and gateways) or on the extreme limits of the DeMilitarized Zones (DMZs);
2. Wireless IDPSs: these are dedicated to monitoring only wireless traffic, with particular attention paid to the networking protocols;
3. Network Behavior Analysis IDPSs (NBA-IDPSs): these examine packets to identify threats that generate suspicious traffic uncommon for a network, such as attempted Distributed Denial of Service (DDoS). They are also often used to monitor internal traffic on the same network, or to give access to external third parties;
4. Host-Based IDPSs (HB-IDPSs): these are dedicated to monitoring everything that happens within the single host to which they belong: they are typically a server, reachable from outside the network, or a client of public access. They monitor data ranging from processes running on the machine, the file access, system logs, etc.  
The general context of using IDPSs is business: the processing of sensitive data by companies requires them to use appropriate and effective data protection systems in their internal networks, in order to prevent violations of corporate security policies. Most IDPS use different detection technologies, potentially in combination, to provide a better degree of accuracy. There are three main technologies:  
1. Signature-based: a comparison of the signatures managed by the network and the transiting packets is carried out. This technology is very effective in identifying known threats that have static attack patterns, but they are almost useless against unknown threats;
2. Statistical anomaly-based detection: this technology is based on maintaining a vision of the statistical data related to normal network flows, and providing warning situations when the given parameters deviate from their standard values. Obviously the initial statistics about \"normal activity\" require a preliminary study of the network in order to determine which are the normal values;
3. Stateful protocol analysis: in this case, network flows are analyzed, comparing them with specific profiles (e.g., a user having accesses to an FTP server, without having obtained the authentication privileges yet). This type of analysis is very sophisticated but, at the same time, it is very difficult and complex because profiles need to be created for each protocol, covering all possible use cases, with a high computational cost.