Contents
Where should network sensors be placed?
Ideally you want to have an IDS network sensor on your DMZ with all your public servers, on the LAN just inside the firewall and on your extranet if you have one, in that order. After that it depends on your environment. Consider your choke points, possible avenues of attack and your risk.
Where is intrusion detection system installed?
They can be either network- or host-based. A host-based intrusion detection system is installed on the client computer, while a network-based intrusion detection system resides on the network.
What are the drawbacks of host-based IDS?
Although monitoring the host is logical, it has three significant drawbacks: Visibility is limited to a single host; the IDS process consumes resources, possibly impacting performance on the host; and attacks will not be seen until they have already reached the host.
Where is the best place to put my IDs sensor?
If you want to see what threats are being aimed at your from the internet. You can put the IDS outside the firewall (assuming you’ve hardened it appropriately) and behind the router.
Where is the IDS located on the network?
Position the IPS where it will see the bare minimum of traffic it needs to, in order to keep performance issues under tight control. The IDS is a passive system that scans internal network traffic and reports back about potential threats. The most obvious location is at the network perimeter, just inside the firewall.
What to look for in an intrusion detection system?
Look for a system that encrypts communications between host agents and the central monitor. Network-based intrusion detection, also known as a network intrusion detection system or network IDS, examines the traffic on your network. As such, a typical NIDS has to include a packet sniffer to gather network traffic for analysis.
Where is the IDS located in a Cisco firewall?
The IDS is a passive system that scans internal network traffic and reports back about potential threats. The most obvious location is at the network perimeter, just inside the firewall. #CiscoChat Live – Evolve your career with CyberOps Associate…