Q20Information Security Systems

A Firewall is a dumb security door; it blindly blocks or allows traffic based on rigid port rules. If port 80 is open, it lets all web traffic through. An Intrusion Detection System (IDS) is the intelligent, aggressive security camera. It mathematically analyzes the actual payloads flowing through the open ports, violently tearing packets apart to hunt for malicious signatures (like SQL injection strings) or catastrophic behavioral anomalies that bypass the firewall.

• Signature-Based Detection: The IDS maintains a massive database of known malware bit-patterns (signatures). It aggressively compares every incoming packet against this database. Fast, but mathematically blind to Zero-Day (unknown) attacks.
• Anomaly-Based Detection: The IDS utilizes complex Machine Learning algorithms to establish a mathematical baseline of "normal" network traffic. If traffic violently deviates from this baseline (e.g., a server suddenly attempting to upload 10GB of data at 3 AM), the IDS triggers a massive alarm, successfully detecting Zero-Day threats.

1. Network-Based IDS (NIDS)

Deployed as a dedicated hardware appliance physically attached to a central network switch (via a SPAN/Mirror port).

• Mechanism: It operates in "Promiscuous Mode," violently copying and analyzing every single packet traversing the entire corporate network.
• Merits: Global visibility. A single NIDS can protect thousands of computers. It is mathematically invisible to hackers since it sits off the main traffic line.
• Demerits: Catastrophic failure against Encryption. If a hacker attacks a server using HTTPS, the NIDS only sees unbreakable AES ciphertext; it cannot analyze the payload. It also struggles to process traffic on massive 100 Gbps fiber links.

2. Host-Based IDS (HIDS)

Deployed as an aggressive software agent physically installed directly onto the operating system of a critical server (e.g., the master database).

• Mechanism: It ignores network packets. Instead, it violently hooks into the OS Kernel. It mathematically analyzes system calls, file integrity, CPU spikes, and Windows Registry modifications.
• Merits: Absolute precision. HIDS operates after the server has decrypted the HTTPS traffic, allowing it to easily see the raw malicious SQL injection. It can detect if a hacker mathematically modified a critical system binary (/bin/login).
• Demerits: Horrific administrative overhead; you must install and update the software on every single server. Furthermore, if the OS is violently compromised (Rootkit), the hacker can simply turn the HIDS software off.