4

I have googled around for information about Web Apps or Databases running on AWS EC2 needing a IDS/IPS or not.

I will present my findings so far here, but it will be good if you guys can confirm these findings, or comment on them.

  1. Netword based IPS/IDS systems are not necessary because:

Packets are only delivered to the destination addresses and no other devices will ever see that packet. While that eliminates many traditional threat vectors, it also makes intrusion detection approaches like NIDS/NIPS basically useless in AWS. So for intrusion detection in AWS you must look to host-based approaches.

Quoted from: http://www.erpassociates.com/peoplesoft-corner-weblog/cloud-computing/securing-enterprise-data-in-aws.html

  1. People tend to use nagios for IDS purposes on AWS: https://forums.aws.amazon.com/thread.jspa?messageID=176652&#176652 How to do it.

  2. People use host-based(software) IPS/IDS in AWS EC2, like OSSEC.

What do you guys think? Also, it seems to be that nagios can be configured to achieve what OSSEC can do. Is this correct too?

Improve this question
1
  • Please ask one question at a time. – Deer Hunter Mar 28 '13 at 6:38
3

I'm not sure how you would manage a physical IDS on AWS since you are limited to what Amazon has in their system. When using a cloud provider, you largely have to trust their physical security, but you can reinforce it with your own software security to attempt to protect against any broad breach in their technology or any direct attacks against functionality you don't need or don't use in certain contexts.

Improve this answer
3
  • How about Snort? (snort.org) Is it a physical or software IDS/IPS? – Winston Chen Mar 29 '13 at 17:56
  • 1
    @WinstonChen - As I recall, Snort is software that runs on a system you place in between the networks as hardware. Functionally, I believe it would be considered hardware, but it may be able to do IDS for the host it is running on as well. I don't know Snort well enough to be certain. – AJ Henderson Mar 29 '13 at 18:05
  • From what I understand, Snort runs in promiscuous mode on a network interface. This is a problem because on AWS traffic not intended for a certain host will never be delivered to that host making promiscuous mode useless. – Martin Konecny Feb 9 '15 at 0:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.