Where to put an IDS -- inside or outside of the firewall

Where to put an IDS -- inside or outside of the firewall

We are in the process of implementing an intrusion-detection system. I have heard two different things: Place the ID box outside of the firewall, and place the box inside of the firewall. Where is the best place to locate our network IDS? We don't plan on having any host IDs for now.


    Requires Free Membership to View

    Login

    SearchSecurity.com members gain immediate and unlimited access to breaking industry news, virus alerts, new hacker threats, highly focused security newsletters, and more -- all at no cost. Join me on SearchSecurity.com today!

    Michael S. Mimoso, Editorial Director

    By submitting your registration information to SearchSecurity.com you agree to receive email communications from TechTarget and TechTarget partners. We encourage you to read our Privacy Policy which contains important disclosures about how we collect and use your registration and other information. If you reside outside of the United States, by submitting this registration information you consent to having your personal data transferred to and processed in the United States. Your use of SearchSecurity.com is governed by our Terms of Use. You may contact us at webmaster@TechTarget.com.

I'll answer your question with a question: Do you want to know who is knocking on your door (computers connecting from the Internet)? Or do you only want to see those that are allowed access?

If you prefer the first than outside, otherwise inside.

I typically tell people to place the IDS outside the firewall, and see if they can manage the traffic. This is good, for it allows you to see everyone trying and allowed to connect. Intrusion is typically detected when malicious activity is detected outside and it gets a response from inside. Most time malicious activity will hit the outside, but should never receive a response from inside your protected network.

Hope that helps. Give it a try. You can always move it inside. Also, most times I will tell clients to install SNORT or some other IDS along with the primary vendor to ensure you are in fact picking up everything.

For more information on this topic, visit these other SearchSecurity.com resources:
Featured Topic: Intrusion-detection systems
Executive Security Briefing: Recommendations for deploying an intrusion-detection system
Best Web Links: Infrastructure & Network Security
Ask the Expert: The placement of security solutions on a network


This was first published in March 2002