Operational tips for improving intrusion detection system performance

Abstract

The installation of a new intrusion detection system (IDS) is, of course, expected to improve site security. However, depending upon the way the system is used, it can, over time, actually degrade security. Proper use, control, and maintenance of the IDS is critical if site security is to be maintained. This paper discusses several operational issues that should be addressed in order to use an IDS effectively. Several anecdotes from the author's experience are given to illustrate proper and improper use of an IDS. Improper operational use of an IDS can render it ineffective. Applying these tips can help keep the IDS operating at peak performance