TABLE OF CONTENTS Let s look at some of the major questions that people often have when considering an IDS for their network. It s important to understand the function of an IDS within your overall security design, the differences between an IDS and your other security devices, and what an IDS can and cannot do for you in terms of enhancing the security of your network.
IDSs provide an integral audit component of a robust security design and policy. They let you know when you re being scanned and when you re being attacked. They provide more information than you could get just by checking your server and firewall logs. You can see the attacks that fail and the attacks that succeed, and get real-time notification of attempted attacks. You can watch your own network traffic and become aware of misconfigurations as well as malicious attacks earlier than you may have noticed without an IDS. They are not the be-all, end-all solution to every security woe, but they are a valuable tool in the hands of a skilled security administrator.
While some integrated appliances out there claim to be both a firewall and an IDS, and we are probably going to see more of those in the future, a firewall s function is to filter packets, not to alert on potentially malicious traffic. Firewalls are primarily designed to deny or allow traffic to access the network, not to...
