CertiGuide to Security+  9  Chapter 3:  Infrastructure Security (Domain 3.0; 20%)       9  3.4  Intrusion Detection

3.4.1.2  Passive Detection 1 2 3.4.2.1  Active Detection

HIDS Considerations, Pros and Cons

While host-based IDS typically do not address the variety of attacks that can be detected by NIDS, there are some benefits to host-based technology, such as:

• Ability to detect attacks which occur within a system, without traffic traveling across the network, such as someone sitting down at a serial-wired “dumb terminal” and replacing a key system file.
  
  
• Fewer false positives (reporting something as a threat, which isn’t really a threat), since host-based IDS technology usually looks at logs of what has already happened as opposed to what it looks like someone might be trying to do.
  
  
• Not affected by switched environments or network-based encryption, because the system must decrypt the network traffic destined for it in order to respond to it. For example, the actual contents of an SSL transaction are known on the web server to which it is sent, so a host-based IDS on the web server may be able to detect anomalies in that transaction which could not be detected by a NIDS.

3.4.1.2  Passive Detection 1 2 3.4.2.1  Active Detection