Talk With an Expert

Intrusion Detection Systems: Definition, Need and Challenges

Intrusion Detection Systems: Definition, Need and Challenges (PDF, 1.62MB)Published: 03 Oct, 2001
Created by
Abhijit Sarmah

IDS are becoming the logical next step for many organizations after deploying firewall technology at the network perimeter. IDS can offer protection from external users and internal attackers, where traffic doesn't go past the firewall at all. However, the following points are very important to keep in mind. 1. Strong identification and authentication: An IDS uses very good signature analysis mechanisms but strong user identification and authentication mechanisms are still needed. 2. IDS are not a solution to all security concerns: IDS monitor and report intruder attempts but employee education, system testing, and development of and adherence to a good security policy are still needed to minimize the risk of intrusions. 3. An IDS is not a substitute for a good security policy: As with other security and monitoring products, an IDS functions as one element of a corporate security policy. Successful intrusion detection requires that a well-defined policy must be followed to ensure that intrusions and vulnerabilities are handled according to corporate security policy guidelines. 4. Human intervention is required: The security administrator or network manager must investigate attacks detected and reported by an IDS. Lastly, tight integration between host and network based IDS is very necessary.