Friday, October 23, 2015 by Steve White under Safety

Threat detection is key to addressing business vulnerabilities before it’s too late. This post explains how an intrusion detection system (IDS) can provide security management, and help catch suspicious network and device activity.

1. What is an Intrusion Detection System?

An IDS is designed to monitor networks and devices to uncover malicious or harmful activity that may be detrimental to your business. It identifies areas that may be compromised, alerts administrators and reports incident details. Consider an IDS in addition to basic firewalls when the systems and data being protected carry a high value or when a compromise could affect business operations.

There are three main detection categories:

• Network Based (NIDS): Processes and flags suspicious traffic between network-connected devices.
• Host Based (HIDS): Placed on an individual network device to identify, log and alert administrators of unusual, unauthorized or illicit behavior.
• Physical (Physical IDS): Identifies physical threats. Examples include security cameras, access control systems and motion sensors.

The above should be layered together to identify problems as early and far away from critical systems as possible. For example, the NIDS identifies most broadly defined issues at the edge of a network, while the HIDS is focused on identifying system/service related issues that are not detectable by the NIDS.

2. How Does an IDS Enhance Security Management?

Proper IDS implementation paired with a vigilant IT team (whether in-house or through a partner) increases your ability to uncover harmful activity, such as:

• Configuration errors.
• Infections or viruses.
• Information leaks.
• Security policy violations.
• Unauthorized network or device access.

To prevent impacting system performance, though, it is important to plan and deploy these systems properly. Your IDS vendor must work in concert with the network vendor and IT department to ensure proper testing and configuration.

3. How Does an IDS Prevent Suspicious Activity?

An IDS will detect and gather event data that shows your systems and/or network is at risk, but it is designed just to listen and report. It will not automatically take steps to block or stop the activity, like an intrusion prevention system (IPS) would.

For the best monitoring, conduct regular reviews of alerts to uncover whether any changes to network filters, policies, etc. are warranted to reduce exposure.

If an exploit is detected, meet with your security vendor to discuss options to protect vulnerable assets and remedy detected risks. In doing so, you can be proactive to prevent future threats.

- See more at: https://www.vectorsecurity.com/bizblog/3-key-intrusion-detection-system-questions-unveiled#sthash.moLROzK9.dpuf