IDSes and IPSes
Monitoring security events is a very important aspect of information security. Two important monitoring tools are IDS and IPS.
Intrusion detection system
IDS helps monitor a network (network-based IDS) or a single system (host-based IDS) to recognize and detect an intrusion activity.
Network-based and host-based IDS
The following table differentiates between network-based and host-based IDSes:
Table 9.2 – Difference between network-based and host-based IDSes
Components of IDS
The following table shows the various components of the IDS:
Table 9.3 – Components of IDS
Limitations of IDS
The following are some of the limitations of IDS:
- IDS operates based on the policy's definition. The weakness of the policy definition weakens how IDS functions.
- IDS cannot control application-level vulnerabilities.
- IDS cannot control the backdoor into an application...
