As part of a serious and involved computer security plan, network intrusion detection (IDS) software provides additional protection compared to antivirus and firewall programs. Software IDS capabilities are so involved that they can actually detect whether or not a business’ traffic is a request from the Internet or a file transfer over an instant messaging program. Network intrusion detection software can stop attacks from a buffer overflow or an SQL injection.

The depths of these network based IDS can be complicated to understand and master at first, which makes the options surrounding network intrusion detection (IDS) software education and training important to many businesses. To become more well-versed in IDS software, you should:

1. Try to find free intrusion detection software options or trial versions of network intrusion detection (IDS) software.

2. Be aware of the available related tutorials designed to help with users and owners of intrusion detection software.

3. Keep an eye out for intrusion detection software seminars and expositions which would discuss the major advancements in this field of technology.

Action Steps
The best contacts and resources to help you get it done

Utilize free intrusion detection software offers and demonstrations of the programs

Nothing helps some people learn better than by doing. For these individuals, it is particularly important to consider the option of free trials and demos of IDS software. While these programs may not offer permanent support and assistance, they will offer the individual an idea of what they can expect from the individual software programs prior to a monetary investment.

I recommend: For free IDS software, try AuditMyPC.com. Demos of network based intrusion detection system programs may be found at Lancope.com. For a trial version, consider Sax2's intrusion detection system.

Educate yourself with IDS network tutorials

Tutorials enable individuals to better learn how to use a product. IDS software tutorials are beneficial because of the potential complexity of the programs themselves. They are often set up so that the information is easy to absorb and understand, somewhat diminishing the frustrations of learning to utilize intrusion detection system software.

I recommend: There are a number of different IDS network tutorial options available on the Internet. Some of the most effective options include those at SWIK.net which offers introductory and more advanced tutorials on different IDS network software programs. IDSTutorial.com offers a lot of IDS information, including why this type of software is beneficial and a tutorial on network based detection systems.

Enroll in seminars or workshops covering the intricacies and value of intrusion detection software

Seminars and workshops related to intrusion detection system software bring experts in the field to the same environment as those who utilize and enjoy the product. In situations such as these, individuals can learn how to use their programs more effectively, inquire about new products and capabilities, understand industry advancements and benefits and more.

I recommend: Sourcefire.com offers a listing of not just industry related seminars, but also current and archived web-based seminars. Techtarget.com discusses available sessions at intrusion detection software seminars. For archived workshop information on the first UseNIX workshop discussing intrusion detection and network monitoring, visit the UseNix Events page.

Tips & Tactics

Helpful advice for making the most of this Guide

• •  Many security industry magazines offer articles discussing the latest network intrusion detection software advancements, capabilities, products and companies. However, a subscription to these magazines is not always necessary. Most magazine articles are also made available on the magazines' websites and can be accessed easily by searching the specific sites for articles related to network intrusion detection system options.
• •  For additional assistance with intrusion detection system software, consider signing up for a computer security forum or discussion board. It is in environments such as these that individuals can collaborate and share their knowledge, answering questions and concerns from ids computer software users and discussing the latest advancements and progressions of the industry.

A business relies on its network intrusion detection (IDS) software to protect its information resources. From proprietary research data to email to financial concerns, businesses must be confident that their data is safe from external threats. Making certain that your IT security department chooses the right type of intrusion detection is a key component of keeping your company's data secure.

Network-based intrusion detection systems fall into three main categories. Each of these categories is as important as the other, and failure to secure your network in one area will make the other areas vulnerable. The categories of network IDS systems are:

1. Network intrusion detection software keeps your servers and network equipment free of external threats.

2. IDS software for individual computers keeps PCs and other workstations safe from intrusion.

3. Physical security systems complete your intrusion prevention efforts and safeguard your network, computers and your information assets.

Action Steps
The best contacts and resources to help you get it done

Secure your network equipment with a reliable network intrusion detection system

Your servers are the internal organs of your company's information. When a server is hacked, you can lose proprietary information, important records and significant communications. Lock down your servers to avoid lost data, lost productivity and lost assets.

I recommend: IDS network solutions such as Symantec Endpoint Security secures your servers from external threats. Total Protection for Endpoint from McAfee serves the same function, and is better suited to an environment that already uses McAfee products.

Protects user workstations from threats with software IDS

After your servers are secure, you need to think about how to secure your users' workstations. Software IDS is the logical choice for workstation security. Depending on the size of your company, there are a variety of options available to meet your needs.

I recommend: Intrusion detection system software such as LANDesk Host Intrusion Prevention is ideal for a large organization with many workstations. IT professionals can install and update LANDesk Host Intrusion Prevention remotely and on a large scale. For smaller organizations, Spyware Doctor from PC Tools Software may be more appropriate.

Implement strong physical security to enhance your network-based intrusion detection system

Setting up network based IDS does little good if unauthorized users can walk up to a computer or server and just begin using it. Your physical security must be at least as strong as your network security. Security of laptops when users travel is an especially important component of physical security.

I recommend: Consider laptop security packages from SecurityKit.com to lock your users' laptops when they're not in use. For physical access to server and data centers, consider card-based physical security solutions from CoreStreet.

Tips & Tactics

Helpful advice for making the most of this Guide

• •  There is a variety of free IDS software available for download. If you choose this route, however, make sure the vendor is reliable and that the product receives frequent updates.

Using network-intrusion detection software is one of the best ways to protect a computer network. While corporations use this software to identify malware and viruses, they rely on it more to detect more complicated attacks, such as data- driven attacks on applications and unauthorized logins. Network-intrusion detection software can be proactive or passive. If it’s proactive, it can reboot a server or change the device’s configurations so as to prevent an intruder from invading the network.

Action Steps
The best contacts and resources to help you get it done

Network-intrusion detection software

Network-intrusion detection software closely tracks and investigates traffic on a network. It monitors for malicious activity, such as malicious SQL (structured query language) injections or DoS (denial of service) attacks.

I recommend: TechExams has good information on network-intrusion detection software.

Passive-response system

Network-intrusion detection software can be considered a passive response. A passive response system identifies the suspicious activity, logs the data and notifies the system administrator. It is then up to the administrator to take the next step to stop the attacks from occurring.

I recommend: TechTarget gives a definition of a passive-response system.

Active-response system

Network intrusion-detection software can also be proactive. This is known as action response, or reactive. An active-response system takes action against suspicious activity. After it detects an attack, an active-response system can change the network device's settings, such as firewalls or routers, reboot the server or close ports and connections.

I recommend: Go to Security Focus to read about active-response systems.

Network based

Network-based, intrusion-detection software examines all network traffic. It also keeps track of multiple hosts. Network-based, intrusion-detection software is attached to a network device, such as a network switch or hub. This is how it can access and monitor network traffic.

I recommend: Go to SANS to learn how to implement network-based, intrusion-detection software in switched environments.

Host based

Host-based, network-intrusion detection software monitors suspicious activity on a host, which is a local system. The host-based, intrusion-detection software identifies intrusions by analyzing application logs or system log files.

I recommend: ZDNET explains how host-based, intrusion-detection software works.

Firewalls

Firewalls block intruders from accessing the network. They work closely with routers, analyzing network packets and deciding if they should forward the data to the destination. Firewalls can be either software or hardware. Firewalls are not known for being as proactive as network-intrusion detection software.

I recommend: Read about how CA incorporates firewall and intrusion-detection software into one product.