Evaluate Weigh the pros and cons of technologies, products and projects you are considering.

Host-based IDS vs. network-based IDS: Which is better?

Host-based IDSes and network-based IDSes have several differences. Expert Kevin Beaver discusses how to find the best option for your enterprise needs.

What is the difference between a host-based intrusion detection system and a network-based IDS? In which scenarios...

would each be best deployed?

Host-based intrusion detection systems (IDSes) protect just that: the host or endpoint. This includes workstations, servers, mobile devices and the like. Host-based IDSes are one of the last layers of defense. They're also one of the best security controls because they can be fine-tuned to the specific workstation, application, user role or workflows required.

A network-based IDS often sits on the ingress or egress point(s) of the network to monitor what's coming and going. Given that a network-based IDS sits further out on the network, it may not provide enough granular protection to keep everything in check -- especially for network traffic that's protected by SSL, TLS or SSH.

IDS technology is relatively old, and the newer intrusion prevention system (IPS) is often a better enterprise fit. IPS, be it at the host or network level, can help prevent an attack rather than merely report on it.

The interesting thing I've seen regarding host-based IPSes is that they're rarely used. This is likely because of the complexity and frustration involved; they're challenging for IT and security staff to configure properly without creating bottlenecks or negatively impacting network traffic, and it can be frustrating if they're set up in a way that prevents the user from getting his or her work done. Furthermore, the last thing that users want to deal with is a bunch of annoying pop-up windows asking if it's okay to allow unknown traffic to communicate to and from the computer. This brings up another interesting caveat: Users are often in control of their local security policies, which can actually negate any perceived benefits of the host-based IPS.

In the end, it's up to the individual enterprise to determine what's best, given its technologies, culture and business needs. IPS is often the way to go; both network- and host-based IPS can provide high levels of security if designed, implemented and managed properly.

Ask the Expert!
SearchSecurity expert Kevin Beaver is ready to answer your enterprise security questions -- submit them now! (All questions are anonymous.)

Next Steps

Learn about different IDS and IPS deployment strategies

Test your IDS and IPS knowledge

This was last published in November 2014

Dig Deeper on Network intrusion detection and prevention (IDS-IPS)

Have a question for an expert?

Please add a title for your question

Get answers from a TechTarget expert on whatever's puzzling you.

You will be able to add details on the next page.

Join the conversation


Send me notifications when other members comment.

Please create a username to comment.

Does your enterprise use a host-based IDS or network-based IDS? Why?
Our enterprise uses host-based IDS for the main reason that we use our workstations and tablets often and like that we can fine tune the security controls. Being on the host-based IDS works the best for us knowing that our server is safe  bringing us peace of mind. We at times get frustrated because of configuration problems, but feel it's worth it to be in control of our own local security policies.
Agreed, CCL36744 - it's often the best to control the data where it lies most often: on the endpoints.
Kevin, great article. However I think it is important to realize that in an increasingly IoT world the endpoint can be many different things, not just end user systems. Although you make a good point with regards to host based IDS for end user systems like workstations and laptops, I think it is quite a different story when you look at enterprise infrastructure. Host based IDS in the form of file integrity monitoring and security configuration management is widely adopted as a best practice and is actually baked into pretty much all security compliance and framework initiatives from NIST 800-53, PCI DSS just to name a few. 

When it comes to network based IDS vs. host based IDS, I don't think it is an either or scenario, as you actually need both, they are really different tools and utilized in different places. The real power comes when you are able to utilize both and orchestrate them to work together through correlation, automation and security analytics. 

Although you mention that host based IDS is old, I would prefer to say it is battle hardened :-)

I think a combination of these two would be good which we call it Distributed IDS or DIDS.