Published By: SecurityFocus Posted By: Adam Chalemian 11/6/2002
Intrusion detection systems (IDS) are one of the fastest growing technologies within the security space. Unfortunately, many companies find it hard to justify acquiring IDS systems due to their perceived high cost of ownership. However, not all IDS systems are prohibitively expensive. This two-part article will provide a set of detailed directions to build an affordable intrusion detection architecture from hardware and freely available software. This discussion will avoid the classic "build or buy" debate and instead focus on building the system at a minimum cost.
Building often provides a definite cost advantage, especially for companies that are unsure about the long-term necessity of the IDS. Building it cheaply allows one to evaluate the technology with very little investment and without necessarily possessing sophisticated network security skills. That said, it is reasonable to expect that maintaining and tuning the IDS will require relatively advanced security knowledge.
Also, while the goal of this discussion is to help readers to build a low-cost IDS, they should be aware of the expenses that are involved with operating, maintaining and adequately monitoring the system. In fact, it has been claimed that running a self-built IDS is more expensive than running a commercial system due to the lack of support provided by IDS vendors. This statement may be or not be true, but free support sources such as mailing lists and user forums can often be more thorough and timely than the official support channels.
News: Intrusion Detection
