What are the common methods of deploying an IDS?

Vaibhav Kothia May 26, 2023 0 Comments

1. Network-Based Intrusion Detection System (NIDS): A NIDS is a type of IDS that is deployed at a strategic point in a network to monitor traffic. It is typically used to detect malicious activity such as port scans, malicious code, and denial of service attacks. Example: Snort.

2. Host-Based Intrusion Detection System (HIDS): A HIDS is a type of IDS that is installed on individual hosts or systems. It is used to monitor and detect malicious activity on that particular host or system. Example: OSSEC.

3. Wireless Intrusion Detection System (WIDS): A WIDS is a type of IDS that is used to detect malicious activity on wireless networks. It is typically used to monitor for unauthorized access to the network, rogue access points, and other malicious activity. Example: AirDefense.

4. Network Behavior Analysis (NBA): NBA is a type of IDS that monitors the traffic on a network and looks for anomalies or changes in the normal behavior. It is typically used to detect malicious activity such as data exfiltration, malicious code, and other malicious activities. Example: Lancope StealthWatch.

What are the challenges associated with implementing an IDS?

Vaibhav Kothia May 26, 2023 0 Comments

1. False positives: An IDS can generate false positives, which are alerts triggered by normal network traffic. For example, an IDS may detect a port scan when a legitimate user is simply checking email.

2. False negatives: An IDS may also fail to detect malicious activity. For example, an IDS may not detect a new type of malware or a zero-day attack.

3. High volume of alerts: IDSs generate a large number of alerts, which can be difficult to manage and investigate.

4. Resource utilization: IDSs require resources, such as processing power and storage space, to function properly.

5. Evasion techniques: Attackers can use evasion techniques to bypass IDSs. For example, an attacker may split a malicious payload into multiple packets to avoid detection.

6. Complexity: Many IDSs are complex and require extensive training to configure and manage.