| 1.4 |  | Security Products and Solutions |
| 1.4.5 |  | Intrusion detection |

| Intrusion detection Intrusion detection is the ability to detect attacks against a network . The network can be made up of network devices such as routers, printers, firewalls, and servers. Intrusion protection should provide the following active defense mechanisms:

- Detection - Identifies malicious attacks on network and host resources.
- Prevention - Stops the detected attack from executing.
- Reaction - Immunizes the system from future attacks from a malicious source.

Host-based intrusion detection system (HIDS)
A host-based intrusion detection system (HIDS) audits host log files and host file systems and resources. An advantage of HIDS is that it can monitor operating system processes and protect critical system resources, including files that may exist only on that specific host. This means it can notify network managers when some external process tries to modify a system file in a way that may include a hidden back door program.

A simple form of host-based intrusion detection is enabling system logging on the host. This is called passive detection. However, it can require intensive manpower to recover and analyze these logs. Current host-based intrusion detection software requires agent software to be installed on each host to monitor activity performed on and against the host. The Agent software performs the intrusion detection analysis and protects the host.

Figure illustrates a typical HIDS deployment. Agents are installed on publicly accessible servers and corporate mail and application servers. The Agents report events to a central Console server located inside the corporate firewall or can e-mail an administrator. Notice that the Agent software protects the Console server.

HIDS can support both passive and active detection. Active detection can be set to shut down the network connection or to stop the impacted services. This has the benefit of being able to quickly analyze an event and take corrective action. Cisco provides HIDS using the Cisco Security Agent software. Some other vendors of HIDS include Symantec, Internet Security Systems (ISS), and Enterasys.

Network-based intrusion detection system (NIDS)
A network-based intrusion detection system (NIDS) involves the deployment of probing devices, or Sensors throughout the network, which capture and analyze the traffic as it traverses the network . The Sensors detect malicious and unauthorized activity in real time, and can take action when required. Sensors can be deployed at designated network points that enable security managers to monitor network activity while it is occurring, regardless of the location of the target of the attack. NIDS Sensors are typically tuned for intrusion detection analysis. The underlying operating system is stripped of unnecessary network services and essential services are secured.

Just like host-based IDS, a network intrusion detection system can be based on active or passive detection. Figure illustrates a typical NIDS deployment. Sensors are deployed at network entry points that protect critical network segments. The network segments have both internal and external corporate resources. The Sensors report to a central Director server located inside the corporate firewall.

Cisco Systems provides a complete product portfolio that enables a customer to implement and manage an active defense system . The IDS products include network sensors, switch sensors, router sensors, firewall sensors, host sensors, and comprehensive management. There are many vendors and products available in the host-based and network-based intrusion detection arena. Some other NIDS vendors include ISS, Enterasys, and Snort.

| Web Links http://www.snort.org/ http://www.networkintrusion.co.uk/ids.htm http://iss.net/ http://www.enterasys.com/home.html