Chapter 4: The Three Basic Principles of Intrusion Detection

---

Overview

"To secure ourselves against defeat lies in our own hands, but the opportunity of defeating the enemy is provided by the enemy himself. Thus, the good fighter is able to secure himself against defeat, but can not make certain of defeating the enemy."

Sun Tzu, "The Art of War."

For intrusion detection technology to be efficient, you must have answers to the following three questions:

• What to detect? You must know the signs of security policy violations.

• Where to detect? You must know sources of information stating where one can search for indications of security policy violations.

• How to detect? You must know methods of analysis of the information obtained from appropriate sources in order to find indications of attacks.

---