TryHackMe — IDS Fundamentals | Cyber Security 101 (THM)

What Is an IDS

While firewalls protect network boundaries by controlling incoming and outgoing connections, they don’t track activities after a connection is established. An Intrusion Detection System (IDS) is deployed within the network to detect malicious activities that have bypassed the firewall. If an attacker sneaks past the firewall and engages in harmful actions, an IDS can monitor and detect these actions through signature or anomaly-based detections and alert security administrators. However, IDS only monitors and alerts; it doesn’t take direct action to prevent threats.

Questions and Answers

1. Can an intrusion detection system (IDS) prevent the threat after it detects it?

• Nay

Types of IDS

IDSs are categorized by deployment and detection modes:

• Deployment Modes:
• Host Intrusion Detection System (HIDS): Installed on individual hosts, focusing on threats specific to each host. Effective for host-specific monitoring but challenging to manage across large networks.
• Network Intrusion Detection System (NIDS): Monitors network-wide traffic across all hosts to detect suspicious activities. Provides a centralized overview of detections within the network.
• Detection Modes:
• Signature-Based IDS: Detects threats by matching patterns or signatures of known attacks…