1.3 Detecting Intrusions (a Hierarchy of Approaches) | Managing Security with Snort and IDS Tools

Intrusion detection is simply trying to detect the signs of a network intruder before damage is done, a service denied, or data lost. This can be done through the use of a variety of mechanisms. Properly configured systems generate system logs that keep track of services, users, and data. These logs very often show traces of suspicious (or downright nefarious) activity. The problem is that these logs often have a lot more information in them than a security administrator is interested in. It is important to consider system log review as a basic intrusion detection mechanism, though. Many times the system logs show their value in a forensic analysis after the fact.

The next layer of intrusion detection (and prevention) is automated tools, commonly referred to as host-based intrusion detection (HIDS). HIDS tools include antivirus software, personal firewalls, NIDS installed on the individual hosts, and a new breed of software (intrusion prevention systems) that protects system memory against buffer overflow attacks or enforces security policies. Many products are a hybrid mix of these solutions (a personal firewall/antivirus product, for example).

The final layer of intrusion detection is NIDS.

Table of content

Managing Security with Snort and IDS Tools

ISBN: 0596006616
EAN: 2147483647

Year: 2006
Pages: 136

Authors: Christopher Gerg, Kerry J. Cox

BUY ON AMAZON

OpenSSH: A Survival Guide for Secure Shell Handling (Version 1.0)

Competency-Based Human Resource Management

After Effects and Photoshop: Animation and Production Effects for DV and Film, Second Edition

Lean Six Sigma for Service : How to Use Lean Speed and Six Sigma Quality to Improve Services and Transactions

Programming .Net Windows Applications

Digital Character Animation 3 (No. 3)