Chapter 2 - Cisco Intrusion Detection

Abstract

Cisco Intrusion Detection is a complete security approach that provides a wide range of intrusion detection capabilities to help administrators secure and monitor their network environments against threats and security breaches. Cisco focuses on two primary types of intrusion detection systems (IDSs)—Host IDSs, and Network IDSs. Within each of these systems, Cisco develops products that promote an “active defense” to secure the network environment. Cisco Active Defense focuses on three points, which are, detection, prevention, and reaction. Cisco delivers each of these concepts through flexible Network IDS hardware, host-based IDS software, Cisco IDS sensor software, and scalable Cisco IDS management software. At the heart of the Cisco Intrusion Detection System is the Cisco Network and Host IDS software that provides accurate threat detection, intelligent threat investigation and mitigation, and simplified management. The software imparts comprehensive threat detection, delivering a hybrid system that uses methods including pattern recognition, protocol analysis, traffic anomaly detection, and protocol anomaly detection. Accurate detection leads to threat investigation and mitigation. When an attack is detected, Cisco's Threat Response technology works with Cisco IDSs to eliminate false alarms and escalate authentic attacks.