Flashcards for:
Introduction to Intrusion Detection Systems (IDS)

Blumira is a Security Information and Event Management (SIEM) platform that monitors IT infrastructure for suspicious activity and enables responses to in-progress attacks.

Signature-Based Intrusion Detection compares network traffic and log data against known attack patterns, which allows it to detect recognized threats with high accuracy.

Continuous monitoring and updating are essential for the effectiveness of an IDS because they enable it to adapt to evolving threats and vulnerabilities, ensuring it remains capable of detecting and responding to new attack methods.

An IDS detects and sends alerts about potential threats but does not take action to block them, whereas an IPS both detects and actively prevents or blocks threats.

A Network-Based IDS (NIDS) uses sensors placed at key network points, such as the DMZ or network perimeter, to monitor inbound and outbound traffic. Multiple instances may be necessary depending on network architecture.

Masqueraders are outsiders without authorized access to a network. They use various methods such as Distributed Denial of Service (DDoS) attacks and injection attacks to breach security.

SolarWinds Security Event Manager integrates log data for both network-based and host-based IDS, detects malicious attacks using customizable rules, and employs both signature-based and anomaly-based detection methods.

Anomaly-Based Intrusion Detection uses machine learning to create baselines of trustworthy activity. It detects deviations from these baselines but is prone to false alarms from legitimate yet unusual network traffic.

An Intrusion Detection System (IDS) is an application or device that monitors network traffic for unusual or suspicious activity. It analyzes changes and patterns in activity and sends alerts to administrators or security teams for further investigation.

An IDS uses a Switched Port Analyzer or Test Access Port to capture network traffic for analysis without introducing latency, thus avoiding a slowdown in network performance.

A Cloud-Based IDS is optimized for cloud environments and leverages cloud service provider APIs to gain visibility and monitor cloud-based activities.

A Host-Based IDS (HIDS) consists of agents running on individual servers, endpoints, and devices. It monitors OS-specific activities such as file system changes and registry modifications, detecting anomalies from within the organization.

Misfeasors are insiders who have authorized access to a network. They misuse their permissions for unethical activities such as corporate espionage or aiding outside attackers.

McAfee LiveSafe provides real-time threat awareness, uses emulation techniques for malware detection, and correlates threat activity with application usage.

Hybrid Intrusion Detection combines Signature-Based and Anomaly-Based methods to provide comprehensive threat coverage, aiming to detect both known and unknown attacks.