Services: Intrusion Detection Systems (IDS)

The only thing worse than no security is a false sense of security. Attackers know how to get in and out of systems without leaving a trace, but in the digital world there are always ways to find them - if you know what you're looking for. Having a system in place to monitor your systems and traffic for suspicious activity will allow you to know which systems you can trust, can identify rogue services, and reduce down-time in the event of an attack. If you can't figure out what an attacker did while in your network, how to you know what systems and information you can trust?

Simply installing a commercial or freeware IDS system does not usually provide much return on investment. Improperly tuned, an IDS system can generate logs that are too comprehensive to be quickly and accurately interpreted by IT staff. Furthermore, without proper planning your IT staff may not know what to do even if they do detect an attack in progress.

Intrusion detection encompasses much more than placing network and host sensors around your network. Your IDS architecture should include monitoring of logs from network devices, ensuring that intrusions can be detected after the fact through proper log archiving, and a complete set of policies and procedures. Poorly tuned log analysis procedures and lack of procedures can result in missing attacks or the destruction of evidence after an attack.

Risk Assessment

Design and Implementation

Privacy of Personal Information

Awareness and Education

[Back to Top]