Intrusion Detection, Intrusion Prevention

Intrusion detection is the process of monitoring the events occurring in a computer system or network and analyzing them for signs of possible incidents, which are violations or imminent threats of violation of computer security policies, acceptable use policies, or standard security practices. Intrusion prevention is the process of performing intrusion detection and attempting to stop detected possible incidents.

Intrusion detection and prevention systems (IDPS) are primarily focused on identifying possible incidents, logging information about them, attempting to stop them, and reporting them to security administrators. In addition, organizations use IDPSs for other purposes, such as identifying problems with security policies, documenting existing threats, and deterring individuals from violating security policies.

IDPSs have become a necessary addition to the security infrastructure of nearly every organization. IDPSs typically record information related to observed events, notify security administrators of important observed events, and produce reports. Many IDPSs can also respond to a detected threat by attempting to prevent it from succeeding. They use several response techniques, which involve the IDPS stopping the attack itself, changing the security environment (e.g., reconfiguring a firewall), or changing the attack’s content.” - NIST Special Publication 800-94.

In May 2011, The Obama Administration outlined a national cybersecurity legislative proposal aimed building a public/private partnership in securing critical infrastructure while protecting civil liberties and privacy. The proposal seeks to provide the government with better tools to detect and prevent cyber attacks on federal networks, power grids, water systems, and other critical "wired" systems. Under the proposal, the Department of Homeland Security (DHS) will implement intrusion detection and prevention systems to address such attacks.

Aquion offers adaptive intrusion prevention solution from SourceFire. Their award winning products integrate with Rapid7 NeXpose to enable efficient prioritisation of alerts and assessment of malicious intent, giving customers a more effective threat impact analysis, covering a wider range of vulnerabilities across applications.

• SourceFire