<?xml version="1.0"?>
<Module projectID="1080" moduleID="1142">
	<ModuleName>mod7</ModuleName>
	<AU>mod7</AU>
	<Title>Course Conclusion</Title>
	<Subtitle>Course Conclusion</Subtitle>
	<LinkSet>links</LinkSet>
	<CourseMapSWFPath>../mod7/assets/coursemap.swf</CourseMapSWFPath>
	<NavBtns>
		<NavBtn>
			<ID>courseMenuBtn</ID>
			<Label>Course menu</Label>
			<RMAText>Course menu. Select this button to access the course menu.</RMAText>
			<ClickEventName>MainMenuButtonClicked</ClickEventName>
		</NavBtn>
		<NavBtn>
			<ID>moduleMapBtn</ID>
			<Label>Lesson Map</Label>
			<RMAText>Lesson Map.  Select this button to access the lesson map.</RMAText>
			<ClickEventName>CourseMapButtonClicked</ClickEventName>
		</NavBtn>
		<NavBtn>
			<ID>glossaryBtn</ID>
			<Name>Glossary</Name>
			<RMAText>Glossary. Select this button open the glossary.</RMAText> 
			<ClickEventName>GlossaryButtonClicked</ClickEventName>
		</NavBtn>
		<NavBtn>
			<ID>resourcesBtn</ID>
			<Label>Resources</Label>
			<RMAText>Resources. Select this button open the resources.</RMAText>
			<ClickEventName>ResourcesButtonClicked</ClickEventName>
		</NavBtn>
		<NavBtn>
			<ID>exitBtn</ID>
			<Label>Exit</Label>
			<RMAText>Exit.  Select this button to exit the course.</RMAText>
			<ClickEventName>ExitButtonClicked</ClickEventName>
		</NavBtn>
		<NavBtn>
			<ID>replayBtn</ID>
			<Label>Replay</Label>
			<RMAText>Replay. Select this button to replay the current screen.</RMAText>
			<ClickEventName>ReplayButtonClicked</ClickEventName>
		</NavBtn>
		<NavBtn>
			<ID>pauseBtn</ID>
			<Label>Pause</Label>
			<RMAText>Pause.  Select this button to pause the course.</RMAText>
			<ClickEventName>PauseButtonClicked</ClickEventName>
		</NavBtn>
		<NavBtn>
			<ID>resumeBtn</ID>
			<Label>Resume</Label>
			<RMAText>Resume. Select this button to resume the course.</RMAText>
			<ClickEventName>ResumeButtonClicked</ClickEventName>
		</NavBtn>
		<NavBtn prevBtn="true">
			<ID>previousPgBtn</ID>
			<Name>Previous Page</Name>
			<RMAText>Previous. Select this button to go to the previous screen.</RMAText>
			<ClickEventName>PreviousButtonClicked</ClickEventName>
		</NavBtn>
		<NavBtn nextBtn="true">
			<ID>nextPgBtn</ID>
			<Name>Next Page</Name>
			<RMAText>Next. Select this button to go to the next screen.</RMAText>
			<ClickEventName>NextButtonClicked</ClickEventName>
		</NavBtn>
	</NavBtns>
	<Topics>
		<Topic>
			<Title>Summary and Conclusion</Title>
			<Subtitle/>
			<Pages>
				<Page>
					<Title>Summary</Title>
					<Subtitle/>
					<Filename>idsl7_01</Filename>
					<PageNbr>1</PageNbr>
					<ShowText>
						<Txt frameNbr="1">In this Course Conclusion, we will review what we have learned about IDSes. The IDSes and the DoD lesson presented an overview of IDSes. The Networking Fundamentals lesson discussed essential networking fundamentals, such as common models of interoperability, lower level protocols, application layer protocols and ports, and network address translation. The IDS Overview lesson presented IDS types, operations, events, Snort, and the shortcomings of IDSes. The Implementing IDSes lesson introduced demilitarized zones, various methods of sniffing, and IDS configuration issues. And finally, the Advanced Concepts lesson explained sophisticated techniques for evading IDS technologies. Select each lesson to review a summary of key points. </Txt>
						<Txt frameNbr="1"/>
					</ShowText>
					<Popups>
						<Popup>
							<Title>Summary</Title>
							<Subtitle/>
							<Filename>idsl7_01_01</Filename>
							<PageNbr>1</PageNbr>
							<ShowText>
								<Txt frameNbr="1"> </Txt>
								<Txt frameNbr="1"/>
							</ShowText>
							
						<Sec508TriggerName><![CDATA[I D S's and the D O D]]></Sec508TriggerName>
						<Sec508Data><ContentDescription frameNbr="1"><![CDATA[Popup 1 of 5. Popup title: I D S's and the D O D. Defense in Depth approach image appears. Bulleted text displays Key Points. D o D uses defense-in-depth approach to protect information and information systems. Uses preventive layers for example firewalls and antivirus protection to stop attacks. I D S's identify anomalies and suspicious traffic and generate alerts when a system has been breached or attacked. Analyst examines alerts for malicious activity. Different types of attackers threaten D o D systems. Can take systems offline or use stolen information to launch other attacks. Attack techniques can be grouped into phases: Reconnaissance. Scanning and Footprinting. Enumeration. Exploitation Post exploitation. Password attacks. Rollover text displays Intrusion detection systems, or IDSes, are tools that help you to identify when a system or network has been attacked.  Network I D S's examine network traffic to look for anomalies that can indicate that the network has been attacked or even breached. Types of attackers include black hats, hacktivists, script kiddies, insider threats, terrorists, foreign nation states, and other adversarial organizations. The reconnaissance phase is the first phase of an attack, when attackers leverage public information to better understand the target environment, systems, and personnel. Examples of reconnaissance techniques include D N S interrogation, Google hacking, Who is lookups, and reviews of the organization's presence in social networks such as Facebook and LinkedIn. The second phase of an attack involves scanning target organizations to determine which systems are live, to identify services that those systems are running, as well as detect applications that might be present. Examples of scanning phase techniques include Host Discovery, Port Scanning, and Operating System Fingerprinting. After scanning target organizations, the attacker further interrogates systems to determine what vulnerabilities might be present. Primary examples of enumeration phase techniques include Network and Web Application Vulnerability Scanning. The exploitation phase occurs when the attacker actually takes advantage of the vulnerabilities discovered on a system. Exploitation of these vulnerabilities is often used to gain shell access to a system or to run code of the attacker's choosing. The first system compromised may be an attempt to gain access through pivoting or other methods. The post exploitation phase will often lead the attacker back into the scanning phase, but from the vantage point of the compromised system. The password attacks phase is often performed in parallel with the other attack phases. Examples of techniques include password guessing, password cracking, and Pass the Hash.]]></ContentDescription></Sec508Data></Popup>
						<Popup>
							<Title>Summary</Title>
							<Subtitle/>
							<Filename>idsl7_01_02</Filename>
							<PageNbr>1</PageNbr>
							<ShowText>
								<Txt frameNbr="1"> </Txt>
								<Txt frameNbr="1"/>
							</ShowText>
						<Sec508TriggerName><![CDATA[Networking Fundamentals]]></Sec508TriggerName><Sec508Data><ContentDescription frameNbr="1"><![CDATA[Popup 2 of 5. Popup title: Networking Fundamentals. Images of a server, workstation, printer, scanner, and laptop appear. Bulleted text appears. Key Points. O S I and T C P I P are two models of interoperability that use layers of protocols to establish standards for network communications. T C P I P is composed of a suite of protocols for example, D N S, F T P and T F T P, H T T P, I MAP and POP, U D P, T C P, I P, A R P, Telnet, S S H, S M T P, R P C endpoint mapper, Net BIOSe, S M B. Two versions of I P protocol are I P v 4 most widely used today and the primary focus of this course, and I P v 6. NAT allows network devices to facilitate Internet and local network communications. PAT uses unique socket pairs to allow private I P address groups to hide behind one public I P address. Most common use of NAT is I R C global chat service typically used by millions of simultaneous clients. Commonly used by attacker to distribute malware. Patterns of basic I R C commands can distinguish between benign and malicious IRC traffic. Rollover text displays The Open Systems Interconnection O S I model is a worldwide network communications standard that was developed by the International Organization for Standardization, or I S O. O S I uses seven protocol layers including: 1 Physical. 2 Data link. 3 Networ. 4 Transport. 5 Session. 6 Presentation, and 7 Application. Transmission Control Protocol Internet Protocol T C P I P was developed by a Department of Defense, or D o D, agency called Defense Advanced Research Projects Agency, or DARPA. Developed in the 19 70's, T C P I P predates O S I. The T C P I P model is composed of four layers, including: 1 Network access. 2 Internet. 3 Transport, and 4 Application. Models of interoperability address the need for computers and networks to communicate with each other despite their different components and technologies. File Transfer Protocol or F T P and Trivial File Transfer Protocol or T F T P are used to exchange files across Transmission Control Protocol, or T C P, networks. Hypertext Transfer Protocol or H T T P is the underlying protocol of the World Wide Web or W W W. It determines how servers, clients, and browsers communicate, and it defines the format and transmission of messages. Internet Message Access Protocol or I MAP and Post Office Protocol or POP are services used by clients to retrieve e mail from servers. User Datagram Protocol or U D P) sends datagrams, or simple messages with small headers, to other I P hosts. A simpler alternative to T C P, U D P is useful for applications that need fast network transmission but can handle some packet or data loss, such as audio video streaming and query response services. Transmission Control Protocol or T C P is responsible for communications between applications. It allows for reliable data delivery over a network. Internet Protocol or I P routes and carries data across networks and underlies the global network known as the Internet. Note that I P is considered a connectionless protocol in that it does not guarantee receipt of packets. Address resolution protocol or A R P allows you to use a network device's I P address to determine its hardware address. Terminal emulation over a network or Telnet is a client server protocol that allows users to remotely log on to and access the command lines of another computer on a T C P network. Secure Shell or S S H is a network protocol that allows data to be exchanged by two computers over a secure channel. Simple Mail Transfer Protocol or S M T P is used for sending and receiving mail messages. Clients typically use S M T P to send messages to mail servers. Remote procedure calls or R P C over port 1 35 allow a program on a client to execute code on a remote server without the programmer having to write specific code for the remote communication. R P C Endpoint Mapper or E P M assigns and tracks the port numbers of all of its clients' services. Network Basic Input Output System or Net BIOSe is a Windows based application programming interface or A P I that allows applications on different machines to communicate via a local area network or LAN. Server Message Block or S M B is a protocol that allows network devices to share files, directories, and devices. Internet Protocol version 4 or I P v 4) is a 32 bit system of addresses used to identify entities on a network. In the near future, the I P v 4 address space will be exhausted and will no longer be able to provide unique identifiers for each entity connected to the Internet. Internet Protocol version 4 or I P v 6 is a 128 bit system of addresses used to identify entities on a network. To address the inevitable shortage of I p v 4 addresses, I P v 6 has been developed as the next generation Internet Protocol. Network address translation or NAT is an Internet standard that allows a device for example, a computer or a firewall, to serve as an intermediary between the Internet and a local network. Port address translation or PAT translates both the I P address and the port number. Domain Name System or D N S translates domain, or host, names, which are generally intended to be user friendly, into I P addresses, which are numerical. Internet Relay Chat or I R C is a multi user multi channel chat system that is neither client  nor network specific. I R C allows groups of people to send and receive messages in real time using the I R C servers and channels to which they are connected. Patterns of I R C Commands. To identify potentially malicious I R C traffic, look for suspicious patterns of I R C commands. For example: nick command used to assign a seemingly random nickname. join command used repeatedly. infection vectors for example injected virus into. Additional evidence of malicious content include executable downloads, unusual traffic to commonly abused ports.]]></ContentDescription></Sec508Data></Popup>
						<Popup>
							<Title>Summary</Title>
							<Subtitle/>
							<Filename>idsl7_01_03</Filename>
							<PageNbr>1</PageNbr>
							<ShowText>
								<Txt frameNbr="1"> </Txt>
								<Txt frameNbr="1"/>
							</ShowText>
						<Sec508TriggerName><![CDATA[I D S Overview]]></Sec508TriggerName><Sec508Data><ContentDescription frameNbr="1"><![CDATA[Popup 3 of 5. Popup title: I D S Overview. Image of a network of three workstations with a line connected to a masked man operating a laptop. Bulleted text appears. Key Points. Main types of I D S are HIDS and NIDS. Typical detection methods are signature based, anomaly based, protocol based, or a combination of all three. Snort is an open source NIDS that uses all three detection methods. Most widely used I D S. Many commercial I D S's are built on Snort. Types of events that apply to the I D S are true positive, true negative, false positive and false negative. I D S analysts and administrators must effectively identify important alerts because I D S's are prone to false alarms. Rollover text displays The HIDS is a software agent installed on an individual server or workstation that monitors activities related only to the machine on which the HIDS is installed. The NIDS is an appliance placed strategically on the network that monitors all network traffic destined to and from devices connected to that network. A signature based I D S is the most common method. Using static signatures, or rules, to detect malicious traffic on the network, it operates much like anti virus software. An anomaly based I D S first establishes a performance baseline for normal, or routine, network traffic, and then compares current network traffic activity against the baseline in order to detect whether or not the traffic is within baseline parameters. A protocol based I D S examines the protocol in use between a client and the system, which is usually a server, that it protects determining if the protocol is being implemented and utilized properly based on protocol design specifications. Open Source is Readily available and free. True positive is when The I D S alerts in response to a malicious event. True negative is when The I D S remains silent in response to a non-malicious event. False positive is when The I D S alerts in response to a non malicious event. False negative is when The I D S remains silent in response to a malicious event.]]></ContentDescription></Sec508Data></Popup>
						<Popup>
							<Title>Summary</Title>
							<Subtitle/>
							<Filename>idsl7_01_04</Filename>
							<PageNbr>1</PageNbr>
							<ShowText>
								<Txt frameNbr="1"/>
								<Txt frameNbr="1"/>
							</ShowText>
						<Sec508TriggerName><![CDATA[Implementing I D S's]]></Sec508TriggerName><Sec508Data><ContentDescription frameNbr="1"><![CDATA[Popup 4 of 5. Popup title: Implementing I D S's. Image appears of a masked man operating a laptop connected to a cloud image, connected to a router image, connected to a firewall image, connected to a cloud that is connected to four server images. Bulleted text appears. Key Points. Demilitarized zone or D M Z is buffer zone that prevents unauthorized unwanted inter intra network communications without interrupting services. D M Z can be classic or service leg design. Design goal is to mitigate pivot attack risks by containing and preventing the compromise from spreading to the rest of the network. Intrusion detection systems are network sniffers capable of sending alerts based on user defined rules. Promiscuous sniffing accesses all unicast traffic in any direction of the duplex system. Basic sniffing methods are through a hub, switch, or Ethernet tap. I D S should sniff on a network's trusted side, behind a firewall, or in a D M Z. I D S tuning lowers load, reduces false events, and increases system effectiveness. Trusted and untrusted networks should be configured. Server locations should be determined by passive sniffing or active scanning, for example, N map. Rollover text displays Hubs operate at the Physical Layer, act as a multi port repeater, are half duplex, and create a single collision domain. You should sniff the network through a hub only if it is in a properly engineered environment with only one device per switch and very small amounts of traffic. Otherwise it will slow down the network, and cause collisions and operational network issues. Note that a collision domain is a network segment where data packets from different devices collide with one another, the data transmission is stopped, a jam signal is sent, and the transmission is tried again at later time. Switches operate at the Data Link layer, avoid collisions through multiple collision domains, are full duplex, and mirror all traffic on the ports to a Switched Port Analyzer or SPAN or mirror port. Sniffing with a switch can work on a smaller network or in an organization with smaller amounts of traffic. Switches may sanitize traffic, drop fragmented frames, and can be overloaded. Ethernet taps operate at the Physical Layer, are passive, full duplex and are designed to limit impact on network performance. All network port traffic passes through the tap and is copied to a monitor port. A simple tap requires two monitoring ports. A tap aggregator combines the two duplex traffic sides into one, requiring only one monitoring port. A tap requires additional hardware to install and the I D S may confuse the network topology or miss traffic when combining multiple streams of traffic. The monitoring port may also become saturated when using aggregation taps to sniff, a memory buffer is recommended to minimize overloads. Note that a memory buffer temporarily holds data while it is being moved from one place to another. Memory buffers are designed for occasional, high volume traffic. They keep the monitor port from overloading. Pivot attack is an attack method in which a vulnerable public facing server is first compromised, and then the attacker rotates its attack from the compromised host to other hosts on the internal network. Classic D M Z design is a Type of demilitarized zone or D M Z design that places the exposed servers in between two firewalls. Service Leg D M Z design is a Type of demilitarized zone or D M Z design that places the exposed servers on a third branch of a single firewall. network sniffers are Tools that allow the complete capture of traffic that is traveling between networked devices and then analyze and decode protocols, presenting the captured traffic in an easily read format. Unicast traffic is Transmissions sent to a single network destination identified by a unique address. Duplex system is A communication system for the different devices to send and receive traffic from one another. Half duplex is communication between two devices in only one direction at a time. Full duplex is when communication occurs simultaneously in both directions between a sender and a receiver. N map is An active scanning tool that discovers hosts and services by sending specially designed packets to a specific host and then analyzing the responses, thus creating a map of the network. D N S is Domain Name System.]]></ContentDescription></Sec508Data></Popup>
						<Popup>
							<Title>Summary</Title>
							<Subtitle/>
							<Filename>idsl7_01_05</Filename>
							<PageNbr>1</PageNbr>
							<ShowText>
								<Txt frameNbr="1"> </Txt>
								<Txt frameNbr="1"/>
							</ShowText>
						<Sec508TriggerName><![CDATA[Advanced Concepts in Incident Detection]]></Sec508TriggerName><Sec508Data><ContentDescription frameNbr="1"><![CDATA[Popup 5 of 5. Popup title: Advanced Concepts in Incident Detection. Image shows groups of ones and zeroes moving toward a network device. Bulleted text appears. Key Points. Attackers exploit fragmentation and segmentation to evade detection. Small packets force fragmentation in an attempt to bypass the NIDS. Overlapping fragments force fragmentation to make packets look one way to the host and another way to the I D S. Small segment attacks send large numbers of small innocuous segments, so that the NIDS may miss other attacks due to the heavy load. Operating systems use either the Last Rule Linux or the First Rule Windows to reassemble fragments. I D S;s must reassemble packets using the same policy and or rule as the host to detect attacks or breaches. Snort's Frag 3 pre processor enables this. Analysts must examine small segment NIDS alerts for attack patterns. Rollover text displays Fragmentation is a normal network operation that occurs when packets are too large for a network, such as when data packets leave an Ethernet network and enter a cellular network. Segmentation is Similar to fragmentation but involves breaking T C P segments, as opposed to packets, into smaller segments. Segmentation is a layer 4 function. Last rule is a Linux based packet reassembly policy that allows the current fragment to overwrite the previous fragment. First rule is Windows based packet reassembly policy that does not overwrite previous fragments and instead gives priority to the first fragment. Snort's frag 3 Pre processor is The Snort implementation of a function that allows the network intrusion detection system to reassembled fragments in multiple ways using the first-rule, last-rule, or both.  In mixed environments that have more than one operating system, such as Linux, B S D, and or Windows, Snort's frag 3 pre processor allows the analyst administrator to customize, or tune, reassembly to the host. Nids Network intrusion detection system.]]></ContentDescription></Sec508Data></Popup>
					</Popups>
				<Sec508Data><ContentDescription frameNbr="1"><![CDATA[Screen 1 of 2 and Launch page: Please use the up and down arrows to navigate through Introduction to D O D I D S Analysis Course, Course Conclusion. For each screen you will hear a description. The description is cued by an audio tone. Complex screens are divided into several descriptions. Listen to the description, and then select the play audio narration button to continue. You can access the glossary and a list of resources at any time without losing your place in the course. Screen 1 of 2.  Topic title: Summary and Conclusion. Screen title: Summary. Five images appear with text labels representing five lessons, including I D S's and the D O D, Networking Fundamentals, I D S overview, Implementing I D S's, and Advanced Concepts in Incident Detection. Image for I D S's and the D O D represents the Defense in Depth approach appears as ten concentric circles. The top half of the circles are labeled as, starting with the inner most circle, your data, data back up; disaster recovery; anti malware; firewalls; e mail security and filtering; wireless security; web security and filtering; user education, application, updates and patching; and security policy in the outer most circle. On the bottom half of the circles, the labels are your data in the center circle; local and off site; business continuity; clients, servers and mobile devices; gateway and P C; spam, viruses, fishing and backup; P D A, smart phones and laptops; browsing and on line activities; and best security practices O S Browser Apps in the outer most circle. Networking fundamentals image shows interconnected images of a server, computer workstation, scanner, laptop, and printer. I D S Overview image shows a network of three workstations with a line connected to a masked man operating a laptop. Implementing I D S's image represents a masked man operating a laptop connected to a cloud image, connected to a router image, connected to a firewall image, connected to a cloud that is connected to four server images. Advanced Concepts in Incident Detection image shows groups of ones and zeroes moving toward a network device. The names of the lessons appear selectable as popups. Instructional text displays Select each lesson to review its key points. Text box displays text References to open source or freeware in this training product are for training purposes only, and should not be considered endorsements of these products. Please check with your command, service or agency for guidance on the use of these products.]]></ContentDescription></Sec508Data></Page>
				<Page>
					<Title>Conclusion</Title>
					<Subtitle/>
					<Filename>idsl7_02</Filename>
					<PageNbr>2</PageNbr>
					<ShowText>
						<Txt frameNbr="1">Congratulations! You have completed the Introduction to DoD Intrusion Detection System Analysis course. You should now be able to: define IDSes and their purpose and use within the DoD. You should also be able to classify characteristics of IDS alerts into threat categories and differentiate between true security incidents and false positive events. You should be able to identify the correct placement of an IDS sensor in a typical DoD network configuration, and you should be able to explain advanced concepts in detecting security incidents using IDS technologies. </Txt>
						<Txt frameNbr="1"/>
					</ShowText>
				<Sec508Data><ContentDescription frameNbr="1"><![CDATA[Screen 2 of 2.  Topic title: Summary and Conclusion. Screen title: Summary. Congratulations appears in large text. Text and bullet points display lesson objectives. Bullet points turn into checkmarks in synch with audio.]]></ContentDescription></Sec508Data></Page>
				<!--Page>
					<Title>Completion Certificate</Title>
					<Subtitle></Subtitle>
					<Filename>idsl7_03</Filename>
					<PageNbr>3</PageNbr>
					<ShowText>
						<Txt frameNbr="1">Select Print Certificate to print your certificate of course completion. </Txt>
						<Txt frameNbr="1"></Txt>
					</ShowText>
				</Page-->
			</Pages>
		</Topic>
	</Topics>
</Module>
