NETWORK SECURITY TACTICS
Intrusion detection basics
Mike Chapple
08.26.2003
Rating: -3.55- (out of 5)
|
Intrusion-detection systems (IDS) are a critical component of any security infrastructure. These hardware and/or software devices monitor a network for potentially malicious activity and report it to administrators for further investigation. There are many intrusion-detection systems on the market, ranging from dedicated hardware designed to handle high-bandwidth connections (and costing thousands of dollars) all the way to the absolutely free software-based IDS Snort.
There's actually a relatively simple taxonomy used to classify most intrusion-detection systems. It's based upon two characteristics – the type of monitoring algorithm (signature or anomaly detection) and the monitored environment (network or host). Let's take a brief look at each.
An IDS's monitoring algorithm defines how the system determines whether activity is malicious or benign. The two most common algorithm types are:
Intrusion-detection
To continue reading for free, register below or login
To read more you must become a member of SearchSecurity.com
systems may be further classified by the type of environment they monitor:
It's important to note that every IDS on the market doesn't necessarily fit neatly into these classifications. There are a number of hybrid systems available that combine characteristics of the two major monitoring algorithm types and/or monitor more than one type of environment. When planning an IDS architecture, you should strive to achieve a balance of algorithms and monitored environments.
About the author
Mike Chapple, CISSP, currently serves as Chief Information Officer of the Brand Institute, a Miami-based marketing consultancy. He previously worked as an information security researcher for the U.S. National Security Agency. His publishing credits include the TICSA Training Guide from Que Publishing, the CISSP Study Guide from Sybex and the upcoming SANS GSEC Prep Guide from John Wiley. He's also the About.com Guide to Databases.
|
|
Rate this Tip
|
To rate tips, you must be a member of SearchSecurity.com.
Register now
to start rating these tips. Log in if you are already a member.
|
DISCLAIMER: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.
|
|
|
|
|
|
|
