ble to catch everything.
Myth 7: When an organization implements IDS or IPS, it should need fewer security professionals.
There is some truth to this myth in that automating intrusion detection can reduce the number of individuals needed to detect security breaches in systems and networks. At the same time, however, one of the big issues with IDS and IPS is that they do a good job at finding attacks, but there needs to be a trained professional on the other end who can interpret and react to the information. While this may seem like additional overhead, the attacks would be there whether or not you detected them.
Myth 8: You need real-time detection in order to get any real value from an IDS. Real time is a bit of a misnomer, as the response and identification will always come after the attack has entered the network or host. A better approach is to ask whether the alert or response is accurate and is in time for the necessary response. While faster can be better, it also has disadvantages, such as cost and more difficult data handling—data that are received in real time needs to be handled in real time.
This chapter was an introduction to the basic concepts of intrusion detection. We looked at origins of intrusion detection and prevention and how it has developed over the years. We were able to examine the importance of intrusion detection in meeting many regulatory and legal needs as well as being a part of a defense in depth program. We examined the types of analysis schemes that can be used and how they are applied. We also discussed some of the various myths and realities of intrusion detection and prevention.
Part I - Intrusion Detection: Primer
Part II - Architecture
Part III - Implementation and Deployment
Part IV - Security and IDS Management