SEC504: Hacker Tools, Techniques, and Incident Handling

Experience SANS training through course previews.
Learn MoreLet us help.
Contact usBecome a member for instant access to our free resources.
Sign UpWe're here to help.
Contact UsIDS are becoming the logical next step for many organizations after deploying firewall technology at the network perimeter. IDS can offer protection from external users and internal attackers, where traffic doesn't go past the firewall at all. However, the following points are very important to keep in mind. 1. Strong identification and authentication: An IDS uses very good signature analysis mechanisms but strong user identification and authentication mechanisms are still needed. 2. IDS are not a solution to all security concerns: IDS monitor and report intruder attempts but employee education, system testing, and development of and adherence to a good security policy are still needed to minimize the risk of intrusions. 3. An IDS is not a substitute for a good security policy: As with other security and monitoring products, an IDS functions as one element of a corporate security policy. Successful intrusion detection requires that a well-defined policy must be followed to ensure that intrusions and vulnerabilities are handled according to corporate security policy guidelines. 4. Human intervention is required: The security administrator or network manager must investigate attacks detected and reported by an IDS. Lastly, tight integration between host and network based IDS is very necessary.