Course Outline

Understand Intrusion Prevention and Detection, Cisco IPS Software, and Supporting Devices

• Evaluating Intrusion Prevention and Detection Systems
• IPS Software, Hardware, and Supporting Applications of Cisco
• Assessing Network IPS Traffic Analysis Methods, Evasion Possibilities, and Anti-Evasive Countermeasures
• Selecting a Network IPS and IDS Deployment Architecture

Installing and Maintaining Cisco IPS Sensors

• Integrate Cisco IPS Sensor into a Network
• Perform Initial Setup of the Cisco IPS Sensor
• Managing the Cisco IPS Devices

Applying Cisco IPS Security Policies

• Organising Basic Traffic Analysis
• Cisco IPS Signatures and Responses
• Configuring Cisco IPS Signature Engines and Signature Database
• Installing Anomaly-Based Set-up

Adapting Traffic Analysis and Response to the Environment

• Customising Traffic Analysis
• Managing False Positives and Negatives
• Improve Alarm and Response Quality

Managing and Analysing Events

• Installing and Integrating Cisco IPS Manager Express with Cisco IPS Sensors
• Managing and Inspecting Events Using Cisco IPS Manager Express
• Using Cisco IME Reporting and Notifications
• Integrating Cisco IPS with Cisco Security Manager and Cisco Security MARS
• Using the Cisco IntelliShield Database and Services

Deploying Virtualisation, High Availability, and High-Performance Solutions

• Using Cisco IPS Virtual Sensors
• Deploying Cisco IPS for High Availability and Performance

Configuring and Maintaining Specific Cisco IPS Hardware

• Cisco ASA AIP SSM and AIP SSC
• Cisco ISR IPS AIM and IPS NME
• Cisco IDSM-2

Labs

• Lab 2-1: Performing the Cisco IPS Sensor Initial Setup
• Lab 2-2: Managing a Cisco IPS Sensor
• Lab 3-1: Configuring and Modifying Basic Cisco IPS Signatures and Responses
• Lab 3-2: Configuring Cisco IPS Anomaly-Based Operation
• Lab 4-1: Configuring Custom Cisco IPS Signatures
• Lab 4-2: Managing False Positives and Negatives
• Lab 4-3: Improving Alarm and Response Quality
• Lab 5-1: Using the Cisco IME
• Lab 5-2: Using Cisco IPS and Security Intelligence Web Resources
• Lab 6-1: Designing Policy Virtualisation