Q16Information System Security
Question
4 marks
What is an Intrusion Detection System (IDS)? Explain its types.
Answer
An architectural breakdown of Intrusion Detection Systems (IDS). Details the mathematical anomaly detection engines and contrasts the global surveillance of Network-based IDS against the kernel-level precision of Host-based IDS.
A Firewall is a dumb architectural wall; it blindly blocks port 22 and allows port 80. An Intrusion Detection System (IDS) is the highly intelligent security camera. It mathematically analyzes the raw packets that the firewall allowed through, violently searching for malicious signatures or behavioral anomalies that indicate a hacker has breached the perimeter.
1. Network-Based IDS (NIDS)
- Architecture: A dedicated hardware appliance physically attached to a core network switch using a SPAN or Mirror port.
- Mechanism: It operates in promiscuous mode, silently and violently copying every single packet crossing the entire corporate network.
- Merits & Demerits: It provides massive global visibility across thousands of computers. However, if the hacker uses HTTPS, the NIDS mathematically fails because it cannot decrypt the AES ciphertext to see the payload.
2. Host-Based IDS (HIDS)
- Architecture: Aggressive software agents physically installed directly onto the Operating System of critical servers.
- Mechanism: It ignores network packets. It mathematically analyzes OS Kernel system calls, monitors CPU spikes, and violently checks the cryptographic hashes of critical system binaries (like
login.exe) to detect unauthorized modifications. - Merits & Demerits: Absolute precision. It can see the data after it has been decrypted by the server. However, it causes horrific administrative overhead to deploy across 10,000 servers.