Question

Explain how an IPS can be crippling to an organization, including how intrusion detection logs can overwhelm an unprepared IT staff. Support your rationale. PLease provide an original answer.

Answer 1

Intrusion prevention system is nothing but an infrastructure which monitors the sytem continuously and identifies possible intrusion activities and logs them.
For every intrusion prevention system, we need to detect intrusions first. Once that is done then only we can work on preventing it.
Intrusion detection system continuously monitors the network and check for any anomalies. This continuous monitoring leads to logging of a lot of information in log files. There are different types of IDS like Signature based Detection,Anomaly based detection and Stateful protocol analysis.
The problem with these IDS systems is sheer size of the log files which tracks every bit of the network activities. Deciphering these log files need manpower which can understand these log files. A lot of entries in these log files arise due to normal monitoring of network activities, very few enteries in these log files are worthy enough to perform any action. Thus extracting meaningful text out of these logs require quite a bit of an experience in IDS log monitoring. A lot of these systems also generate a lot of False positives which means they alert the system without the presence of any big threat, monitoring these systems for quite some time can help staff understand about these false positives.
The log files also require continuous monitoring from the IT staff but its kind of impossible for any human being to continuously monitor the IDS logs. Thus study based on the nature of network and pattern identification can help IT staff to create an optimal schedule to review the networks.