Cybersecurity: Intrusion Detection Systems (IDS)

Cybersecurity Tools

Intrusion Detection Systems (IDS) Overview

• IDS is an application that monitors network traffic, seeking known threats and suspicious activities.
• Alerts are sent to IT and security teams upon detection of security risks.
• Most IDS solutions monitor and report suspicious traffic, with some capable of blocking malicious activity.
• IDS tools are software applications running on organizations' hardware or as a network security solution; cloud-based options are also available.

Intrusion Detection System Methods

• Signature-Based Intrusion Detection Systems (SIDS) identify patterns and match them with known intrusion signs.
• Anomaly-Based Intrusion Detection spots unusual activity.
• A hybrid solution combines both approaches.
• Network-Based Intrusion Detection System (NIDS) monitors network traffic for suspicious activity, with sensors placed at strategic checkpoints, such as the DMZ or behind a firewall.

Intrusion in Cybersecurity

• Intrusion typically involves an attacker gaining unauthorized access to a device, network, or system.
• Cybercriminals use increasingly sophisticated techniques to infiltrate organizations.

Common Intrusion Techniques

• Address spoofing hides the source of an attack using spoofed or misconfigured proxy servers.
• Fragmentation enables attackers to bypass detection systems by fragmenting packets.
• Pattern evasion involves hackers adjusting attack architectures to avoid detection patterns.
• Coordinated attacks allocate numerous hosts or ports to different attackers, complicating the IDS's analysis.

Types of Intrusion Detection Systems (IDS)

• NIDS (Network intrusion detection system) monitors incoming and outgoing traffic at strategic points in a network to detect malicious activity.
• HIDS (Host intrusion detection system) is installed on individual devices to detect packets from inside the business and malicious threats.
• SIDS (Signature-based intrusion detection system) monitors network packets, comparing them against a database of known threats.
• AIDS (Anomaly-based intrusion detection system) monitors traffic and identifies anomalous activity based on a predefined "normal" baseline, using machine-learning techniques.
• PIDS (Perimeter intrusion detection system) is placed on a network to detect intrusion attempts on the perimeter of critical infrastructures.
• VMIDS (Virtual machine-based intrusion detection system) detects intrusions by monitoring virtual machines.
• SBIDS (Stack-based intrusion detection system) integrates into an organization's TCP/IP to watch packets as they move through the network.

Benefits of Intrusion Detection Systems

• Improves understanding of security risks.
• Aids in shaping security strategy.
• Facilitates regulatory compliance.
• Reduces response times to incidents.

Intrusion Detection System Challenges

• False alarms (false positives) can leave IDS solutions vulnerable to identifying potential threats that are not a true risk to the organization.
• False negatives are when the IDS solution mistakes an actual security threat for legitimate traffic.

IDS vs. Firewalls

• Firewalls and IDS are cybersecurity tools safeguarding networks, but their objectives differ.
• IDS are passive monitoring tools detecting possible threats and sending notifications to analysts in security operations centers (SOCs).
• Firewalls analyze metadata in network packets, deciding whether to allow or prohibit traffic based on pre-established rules.
• IDS focus on detection and alerts, while firewalls primarily inspect inbound and outbound traffic.