Exercise 12.3: Designing for a secure framework

Question 3.
What can you find out about network and host-based intrusion detection systems?

A Network Intrusion Detection System or NIDS is an intrusion detection system that tries to detect malicious activity such as denial of service attacks, port scans or attempts to crack into computers by monitoring network traffic. The system does this by reading all the incoming packets and looking for suspicious patterns. A NIDS is not limited to inspecting incoming network traffic as often valuable information about an ongoing intrusion can be learned from outgoing or local traffic as well. Some attacks might even be staged from the inside of the monitored network or network segment, and are therefore not regarded as incoming traffic at all. A NIDS can interact with other systems as well, for example they could update a firewall blacklist with the IP addresses of computers used by (suspected) crackers.
There are many open source and commercial NIDS available for use.

Host-based Intrusion Detection System or HIDS is an intrusion detection system that monitors and analyses the internals of a computing system rather than on it's external interfaces (as a network-based intrusion detection system does). A HIDS monitors all or parts of the dynamic behaviour and the state of a computer system. It can detect which program accesses what resources and looks at the state of a system, it's stored information, whether in RAM, in the file system, log files or elsewhere and checks that the contents of these appear as expected.

References
Network Intrusion Detection System (n.d.). Retrieved on July 7, 2009, from http://en.wikipedia.org/wiki/Network_intrusion_detection_system