Summary

In this chapter, we examined the difference between IDS and IPS security solutions, as well as how each one should be set up to be used. We started by focusing on how to detect potentially malicious activity since prevention cannot occur without detection. We looked at the different angles that these security solutions approach network data and learned how they look at more than just the payload of the traffic that’s running in the network.

We also looked at how examining large quantities of data that might appear benign could provide review patterns or other visuals that might help analysts notice activity that might otherwise have slipped past the human eye. In that regard, we discussed automation, along with the benefits and risks of such automation, such as reducing labor costs, removing ambiguity from analysis, and ensuring policy – possibly legal – adherence.

Further refining our newfound knowledge, we introduced Suricata, a hugely popular IDS...