Intrusion detection systems
As the name implies, an intrusion detection system (IDS) is responsible for detecting a potential intrusion and triggering an alert. What can be done with this alert depends on the IDS policy. When creating an IDS policy you need to answer the following questions:
- Who should be monitoring the IDS?
- Who should have administrative access to the IDS?
- How will incidents be handled based on the alerts generated by the IDS?
- What's the IDS update policy?
- Where should we install the IDS?
These are just some examples of initial questions that should help in planning the IDS adoption. When searching for IDS, you can also consult a list of vendors at ICSA Labs Certified Products (www.icsalabs.com) for more vendor-specific information. Regardless of the brand, a typical IDS has the capabilities shown in the following diagram:
Figure 4: Typical IDS capabilities, visualized
While these are some core capabilities, the amount...
