Question

Explain how it would give a potential intruder an additional advantage if he can spend a week stealthily watching the behaviors of the users on a computer he plans to attack. (Hint: consider what such information is worth if the network had an Intrusion Detection System)

Answer 1

1.They Can Be Tuned to Specific Content in Network Packets

Firewalls may be able to show you the ports and IP addresses that are used between two hosts, but in addition a NIDS can be tuned to show you the specific content within the packets. This can be used to for uncovering intrusions such as exploitation attacks or compromised endpoint devices that are part of a botnet.

2.They Can Look at Data in the Context of the Protocol

When an NIDS performs protocol analysis, it looks at the TCP and UDP payloads. The sensors can detect suspicious activity because they know how the protocols should be functioning.

3.They Can Qualify and Quantify Attacks

An IDS analyzes the amount and types of attacks. This information can be used to change your security systems or implement new controls that are more effective. It can also be analyzed to identify bugs or network device configuration problems. The metrics can then be used for future risk assessments.

4.They Make It Easier to Keep Up With Regulation

Because an IDS gives you greater visibility across your network, they make it easier to meet security regulations. You can also use your IDS logs as part of the documentation to meet certain requirements.

5.They Can Boost Efficiency

Because IDS sensors can detect network devices and hosts, they can inspect the data within the network packets and identify the services or operating systems that are being utilized. This saves a lot of time when compared to doing it manually. An IDS can also automate hardware inventories, further reducing labor. These improved efficiencies can help to reduce an organization’s staff costs and offset the cost of implementing the IDS.