An intrusion detection system (IDS) is a device or software application that monitors network or system activities for malicious activities or policy violations and produces reports to a Management Station. Some systems may attempt to stop an intrusion attempt but this is neither required nor expected of a monitoring system. Intrusion detection and prevention systems (IDPS) are primarily focused on identifying possible incidents, logging information about them, and reporting attempts. In addition, organizations use IDPSes for other purposes, such as identifying problems with security policies, documenting existing threats and deterring individuals from violating security policies. IDPSes have become a necessary addition to the security infrastructure of nearly every organization.
IDPSes typically record information related to observed events, notify security administrators of important observed events, and produce reports. Many IDPSes can also respond to a detected threat by attempting to prevent it from succeeding. They use several response techniques, which involve the IDPS stopping the attack itself, changing the security environment (e.g. reconfiguring a firewall), or changing the attack's content.
Read more about Intrusion Detection System: Terminology, Passive And/or Reactive Systems, Comparison With Firewalls, Limitations, Evasion Techniques, Development
Famous quotes containing the word system:
“The system was breaking down. The one who had wandered alone past so many happenings and events began to feel, backing up along the primal vein that led to his center, the beginning of hiccup that would, if left to gather, explode the center to the extremities of life, the suburbs through which one makes one’s way to where the country is.”
—John Ashbery (b. 1927)