In this chapter, we discussed the requirement to build an IDS/IPS capability in our range architecture. We discussed how to deploy a network-based IDS and the configuration of a sensor placed on each network segment. We deployed the Snort IDS and detected a number of attacks once we deployed it.

Following the network IDS, we looked at host-based protections and a product from Symantec that provides a number of methods for endpoint protection. We attempted to attack the machine using the web attack tool Nikto, and triggered the software to block the IP address once the attack was detected. We finished the section on endpoint protection by attempting to transfer a malicious file into the machine and the Symantec tool successfully detected the file and deleted it before the file was transferred to the machine.

Finally, we closed the chapter with a discussion on the topic of evasion. We explained that this is rarely asked for in a professional testing scope, but there is a chance that...