Chapter 26 - Intrusion Prevention and Detection Systems

Abstract

With the increasing importance of information systems in today’s complex and global economy, it has become mission and business critical to defend those information systems from attack and compromise by any number of adversaries. Intrusion prevention and detection systems are critical components in the defender’s arsenal and take on a number of different forms. Formally, intrusion detection systems (IDS) can be defined as “software or hardware systems that automate the process of monitoring the events occurring in a computer system or network, analyzing them for signs of security problems” [1]. Intrusion prevention systems (IPS) are those that attempt to actually stop an active attack or security problem. While there are many IDS and IPS products on the market today, often sold as self-contained, network attached computer appliances, truly effective intrusion detection and prevention is achieved when viewed as a process coupled with layers of appropriate technologies and products. In this chapter, we will discuss the nature of computer system intrusions, those who commit these attacks, and the various technologies that can be utilized to detect and prevent them.