Intrusion detection systems
As the name implies, an intrusion detection system (IDS) is responsible for detecting a potential intrusion and triggering an alert. What can be done with this alert depends on the IDS policy. When creating an IDS policy, you need to answer the following questions:
- Who should be monitoring the IDS?
- Who should have administrative access to the IDS?
- How will incidents be handled based on the alerts generated by the IDS?
- What’s the IDS update policy?
- Where should we install the IDS?
These are just some examples of initial questions that should help in planning the IDS adoption. When searching for an IDS, you can also consult a list of vendors at ICSA Labs Certified Products (www.icsalabs.com) for more vendor-specific information. Regardless of the brand, a typical IDS has the capabilities shown in the following diagram:
Figure 12.5: Typical IDS capabilities, visualized
