Intrusion Detection with Snort

A Warning Concerning Intrusion Prevention

Intrusion prevention seems like a great idea on paper. The organization simply deploys intrusion prevention sensors at critical points throughout network infrastructure. When an attack is perpetrated, the application detects the unauthorized activity and prevents it from occurring at the speed of light. No human interaction is required, no one has to wake up in the middle of the night, and most importantly, the business owners can sleep peacefully at night knowing attacks are automatically prevented.

Unfortunately, in the real world, this is not the case. The key is that the technology that determines whether activity is unauthorized is the same for an IDS and an intrusion prevention application. This ...