Reference no: EM132173435

Review this article with 2 APA format references.

In this day and age technology continues to advance at an alarming pace and with it an increase in the amount of cyber security vulnerabilities. A software or hardware intrusion detection system attempts to monitor and provide early detection of suspicious or malicious activity on weak and vulnerable hosts.

This line of defense is a necessity for any corporation to protect its assets and personnel. Intrusions detection systems (IDS) can be broken down into two distinct groups: network based and host based. To be most effective, a network based IDS (NIDS) must be tactically positioned within a network to be able to identify attacks that happen on hosts of that particular network.

Capturing the data normally requires placing sensors, or "taps", at the entrance and exit points of the network as it traverses to and from the wild dirty Internet (Mamun, 2012). There are several advantages to utilizing a NIDS. NIDS are relatively easy to deploy as they are not dependent upon a specific infrastructure or operating system. Having no requirement for software at the host level also reduces the overall cost of the system once it''s installed on the network.

NIDS are able to detect malicious activity in real time, respond accordingly, and retain the data for forensic analysis. Some disadvantages of the NIDS include: frequent amount of false positives highly susceptible to protocol based attacks continual updates to signature library to remain relevant Host based intrusion detection systems (HIDS) run on software that has been installed on individual hosts that monitor traffic coming in and going out from that specific host (Rouse, 2008).

HIDS also monitor the file structure of the host it''s installed on looking for changes to the audit and event logs. It compares any changes to known attack signatures and alerts the management console if a match is identified which makes it very useful in identifying if an actual attack took place. Because HIDS are software based, they do not require any supplementary hardware. One of the biggest disadvantages of utilizing a HIDS is that they are vulnerable to any attacks against the host operating system.

If the host operating system is compromised then the HIDS is as well. HIDS also takes up sizable amounts of hard disk space and can negatively affect system performance overhead due to amount of resources it consumes while running (Stallings, 2007).

References Mamun, S. (2012). Host based IDS vs Network based IDS.

Host-based and Network-based Intrusion detection systems.

Introduction to network-based intrusion detection systems.