Để nhận được nhiều nhất của một IDS, rất nhiều kế hoạch phải được thực hiện trước. Ngay cả trước khi một chính sách thích hợp có thể được tạo ra, thông tin phải được tập hợp, hệ thống mạng phải được phân tích, và quản lý điều hành phải tham gia. Như với hầu hết các hệ thống phức tạp, các chính sách phải được tạo ra, xác nhận, và được thử nghiệm trước khi triển khai. | 266 Network Security A Beginner s Guide monitor traffic to a large number of systems an H-IDS may be more appropriate for organizations that are more concerned about legitimate users than about external hackers. Another way to say this is that the choice of which type of IDS to use depends upon the primary threats to the organization. SETTING UP AN IDS In order to get the most out of an IDS a lot of planning must be done beforehand. Even before an appropriate policy can be created information must be gathered the network must be analyzed and executive management must be involved. As with most complex systems the policy must be created validated and tested prior to deployment. The specific steps in creating an IDS policy are 1. Define the goals of the IDS. 2. Choose what to monitor. 3. Choose the response. 4. Set thresholds. 5. Implement the policy. Defining the Goals of the IDS The goals of the IDS provide the requirements for the IDS policy. Potential goals include Detection of attacks Prevention of attacks Detection of policy violations Enforcement of use policies Enforcement of connection policies Collection of evidence Keep in mind that goals can be combined and that the actual goals for any IDS depend on the organization that is deploying it. This is by no means a comprehensive list. The IDS can allow an organization to detect when an attack starts and may allow for the collection of evidence or the prevention of additional damage by terminating the incident. Of course that is not the only purpose that an IDS can serve. Since the IDS will gather detailed information on many events taking place on the network and computer systems of an organization it can also identify actions that violate policy and the real usage of network resources. 267 Chapter 14 Intrusion Detection Attack Recognition Attack recognition is the most common use of an IDS. The IDS is programmed to look for certain types of events that may indicate an attack is taking place. A simple example .
