- Alerts are sent to the monitor when a potential intrusion is detected. Alerts are based on the product‚s configuration.
- Status logging is the operation log from the sensor itself. Logging is configurable and generally reports that the sensor is operational and maintains an audit trail of alerts and modifications.
- Other information can be sent to the monitor based upon the configuration. For example, actual packets or log data that caused and alert can be duplicated and sent to the monitor for review.
Another solution for protecting this communication is to put it all on a separate network dedicated for the intrusion detection sensors and monitors. A separate network may not be assessable to potential intruders and would reduce the risk from not using encryption. The sensor traffic is not on the same network where the detection of attacks is made. Another advantage is that a separate network will be less susceptible to denial of service attacks designed to incapacitate the intrusion detection defenses. The disadvantage to this architecture is the cost of maintaining a separate network for intrusion detection.
Intrusion detection products offer different encryption capabilities. Please check with your vendor for more information on their encryption capabilities.
Phil Bandy, Michael Money & Karen Worstell