Intrusion Detection & Prevention

Welcome to the final lesson on server security! We've covered firewalls and audits, which are crucial for prevention. But what if a determined attacker tries to bypass those defenses?

This lesson introduces Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS). These tools provide an extra layer of active defense, helping you spot and stop malicious activity on your server.

An Intrusion Detection System (IDS) is like a security guard that constantly watches for suspicious activity. It monitors your server's network traffic or system logs for patterns that indicate an attack.

• Passive Monitoring: An IDS detects and alerts you about threats.
• No Blocking: It doesn't actively block or prevent the intrusion. Its job is purely to notify.
• Examples: Tools like Snort or Suricata can act as network-based IDS, analyzing incoming and outgoing data.