Intrusion detection systems are designed to do two things: keep the enemy out and surround and destroy the enemy if it does manage to get in. Typically most people think intrusion detection refers to identifying attacks from outside the corporate firewall. However, IDS can be equally affective at identifying the misuse of corporate resources from within a company. The FBI and security professionals agree that most data misuse comes from employees, and not Internet hackers. There are two categories of IDS: host-based IDS and network-based IDS. Host-based IDS is an application or service that runs on any network server. It monitors log files, processes behavior and networks traffic to and from the IDS-equipped computer. To be universally effective, the host-based IDS would need to be installed on all network servers, and possibly every PC. In contrast, network IDS focuses on network traffic as its source data. An effective security strategy will include both host- and network-based IDS.
More...
Breakout Champion!
Linear Mode
