Chapter 72 - Intrusion Prevention and Detection Systems

Abstract

With the increasing importance of information systems in today's complex and global economy, it has become mission and business critical to defend those information systems from attack and compromise by any number of adversaries. Intrusion prevention systems (IPSs) and intrusion detection systems (IDSs) are critical components in the defender's arsenal and take on a number of different forms. Formally, IDSs can be defined as “software or hardware systems that automate the process of monitoring the events occurring in a computer system or network, analyzing them for signs of security problems”. IPSs are those that actually attempt to stop an active attack or security problem. Although there are many IDS and IPS products on the market that are often sold as self-contained, network-attached computer appliances, truly effective intrusion detection and prevention is achieved it is when viewed as a process coupled with layers of appropriate technologies and products. In this chapter, we will discuss the nature of computer system intrusions, those who commit these attacks, and the various technologies that can be used to detect and prevent them.