It is very surprising that the Energy Company does have no Intrusion Detection system yet. It is very important for a company whos providing exchanging valuable information with consumers. Here I’ll talk about Intrusion Detection system, their categories, their advantages & disadvantages and my recommendations.

Intrusion Detection system (IDS):

Intrusion detection system can be referred as management system for both computers and networks. It is combination of architected devices and software applications with the purpose of detecting malicious activities and violation of policies and produce report on that.

Intrusion detection system can monitor a network for any kind of abusive, abnormal or malicious activity.

It keeps to log of every single malicious or abusive activity. These logs are very important for security professionals to take any steps or to set any rules against these activities.

The logs kept by IDS can be used against an abuser as an evidence to take any legal step.

Disadvantages of Intrusion Detection system (IDS):

Often intrusion detection systems often produce false report of malicious activity. Sometimes this makes the real malicious activity ignored.

One of the key features of most intrusion detection system is they operate upon packets which are encrypted. These encrypted packets are complicated for analysis.

Type of Intrusion Detection system (IDS):

We can categorize intrusion detection system primarily into three basic categories. They are

network intrusion detection system (NIDS)

host intrusion detection system (HIDS)

honeypots

Network intrusion detection system (NIDS)

Network intrusion detection systems are built based on packet sniffer technology by adding login in it. NIDS job is to read the all incoming data packet and detect suspicious patterns by crosschecking stored examples of malicious network traffic.

Recommendation for Network intrusion detection system (NIDS):

My recommendation for network intrusion detection system is Snort®.

Advantages of using Snort®:

Snort® is an open source network intrusion prevention and detection system.

Because of its being open source so it’s highly customizable as pet company’s requirement.

It’s free. Because it’s an open source software. But if we need any corporate customization then it going to take some charges which is negotiable.

Advantages of using Snort®:

One of key feature of Snort® is it build up a new signature to trace vulnerabilities.

It keeps records of data packets in show then in a human-readable form from its IP address

We can use Snort® as a passive trap to record unwanted presence of traffic that should not suppose to be found on a network.

It can be used to supervise and monitor both home DSL connection and a corporate website.

Snort® can identify buffer overflows, CGI attacks, overflows, stealth port scans, NetBIOS queries and SMB probes, well known backdoors and system vulnerabilities, NMAP and other port scanners and DDOS clients. It alerts the users about those attack and malicious functions

Host intrusion detection system (HIDS)

Host intrusion detection system (HIDS) in a form of intrusion detection system which’s task is to monitor and analyze activities happening on a production system of a computer system.

Recommendation for Host intrusion detection system (HIDS):

My recommendation for host intrusion detection system is OSSEC.

Advantages of using OSSEC:

OSSEC is an open source host intrusion prevention and detection system.

OSSEC is highly customizable, because it is open source.

It’s free. Because it’s an open source software. But if we need any corporate customization then it going to take some charges which is negotiable.

OSSEC can be operated through multiplatform like windows, UNIX, Linux, Solaris etc.

Features of OSSEC:

File Integrity checking: One common attack in any network or computer is that they change the target system in some manner. The purpose of file integrity checking is to track down those changes and generates notification when they occur.

Rootkit spotting: Abusers mostly known as hackers try to hide their malicious activity. Rootkit spotting generates notification notifies if any attempt occur.

Monitoring log: OSSEC monitors, collect, analyze and compare all those log which are generated by operating system, devices and application in a network. The purpose of it is to let the management and security officials know if there is something going wrong.

Active response feature: It can take real-time, immediate and automatic action without waiting for admin to respond.

Honeypots

Honeypots is a jargon used in computer terminology which refers a set of trap which’s task is to mask a computer system’s identity and invite malicious and abusive activity to gather information about attackers.

Based on their manner of deployment and intensity of involvement Honeypots can be categorized. In basis of deployment Honeypots can be classified as

Production Honeypots

Research Honeypots

Recommendation for Honeypots:

Here we will use production type honeypots. Because these kinds of honeypots are suitable for usage in companies and corporations for their easy to use, capturing limited information features. My recommended honeypot is Argos.

Advantages of using Argos:

Argos built based on an open source emulator which employs dynamic translation to conceive pretty good emulation speed.

Its base on an open source emulator. So its highly customizable.

Recommendation for NIDS sensor:

My recommend for NIDS sensor is Cisco intrusion detection system 4235 sensor.

Price: $ 1,425

Advantages:

Cisco products are reliable.

Fully purpose built.

High performance

Quick response