MD1 Intrusion detection systems

Question 1

Intrusion detection system (IDS)

Answer 1

An intrusion detection system is an application that monitors system and network activity, and produces alerts on possible intrusions. Like the home intrusion sensor, IDS collects and analyzes system information for abnormal activities. If something unusual is detected, the IDS sends out an alert to appropriate channels and personnel.

Question 2

intrusion prevention system (IPS)

Answer 2

This is what an intrusion prevention system does. Intrusion prevention systems, or IPS, have all the same capabilities as an IDS, but they can do more. They monitor system activity for intrusions and take action to stop it.

Many tools have the ability to perform the function of both IDS and IPS. Some popular tools are Snort, Zeek, Kismet, Sagan, and Suricata. We will be exploring Suricata in upcoming lessons.