Security

Ask something
Discussion Locked

IDS Implementation

0 helpful
7 replies

by ninho2000

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

hi all,

my infrastrucuture area is implementing a IDS in our network.
i had a conception that an IDS had to be installed after the firewall in order to catch all intrusion tentatives.
However, the engineers are saying to me that the IDS has to be installed before the firewall.

I?m concerned that in case of intruder bypass my IDS, how could I know that he is trying to enter into my network? Would I be secure with this solution?

Could you explain this better to me.

Thanks in advance.
Neft Jr.

7 replies

by thedirman

For an IDS to be effective, it must be installed between the firewall and the devices you are protecting. The firewall's purpose is to protect your network by stopping as many attacks as possible.

An IDS system compliments the firewall by analyzing traffic that has reached your protected devices for suspicious behavior and alerting you and your systems to the possible intrusion.

If the IDS were to be placed before the firewall, it would detect every attack attempt - even those successfully blocked by the firewall - The result being far too many false positives which reduces you efficiency in detecting and thwarting attacks.

If you are only installing a single sensor, it must be on your protected network to be effective.

Hope this helps.

Greg

by some guy in seattle

Yeah, it's pointless to put outside of the firewall. That just generates a lot of garbage that is of no interest to anyone except those that are designing new signatures for the IDS to detect and those that are trying to come up with methods to defeat them.

Stick it on the inside of the firewall to take care of all the attacks that your firewall may not be able to defend against. It's also a good way to catch your evil internal user traffic before it gets a chance to get on the internet (but none of us have evil users, do we? :-) ).

Hope that helps -

by poltrup

Tagging along behind the two previous answers...

There is the question of how your firewall is configured.

If you are using a default policy of allow all/deny by exception, you're better off placing the IDS outside the firewall. Most IDS's (and all of the good ones) can be configured to limit the false-positives in their rule-sets. Therefore, you will only see the attacks as they happen.

If you are running in the far better deny all/allow by exception configuration, you can get by with placing the IDS inside the firewall to detect those that slip by... However...

Overall though, it's been my experience as a firewall/boundary guy that placing the IDS outside reaps far greater results. The attack that will get you every time is the one you can see... and placing the IDS behind the wall effectively blinds the IDS to any new attack methodology. Suppose my intent isn't to get at your resources, but to merely deny you the ability to get out of your network?? All I'd have to do is flood your firewall... An internal IDS would never see this attack, whereas an external one would.

This discussion is closed to new replies.