An intrusion detection system IDS is primarily designed to perform what function?

Answers to Review Questions 1. B. Accountability is maintained by monitoring the activities of subject and objects as well as of core system functions that maintain the operating environment and the security mechanisms.

2. D. In most cases, when sufficient logging and auditing is enabled to monitor a system, so much

data is collected that the important details get lost in the bulk. For automation and real-time analysis of events, an intrusion detection system IDS is required.

3. A. An IDS automates the inspection of audit logs and real-time system events to detect abnormal

activity. IDSs are generally used to detect intrusion attempts, but they can also be employed to detect system failures or rate overall performance. 4. A, B, C. IDSs watch for violations of confidentiality, integrity, and availability. Attacks recog- nized by IDSs can come from external connections such as the Internet or partner networks, viruses, malicious code, trusted internal subjects attempting to perform unauthorized activities, and unauthorized access attempts from trusted locations.

5. B. A host-based IDS watches for questionable activity on a single computer system. A network-

based IDS watches for questionable activity being performed over the network medium, can be made invisible to users, and is ineffective on switched networks.

6. C. A knowledge-based IDS is effective only against known attack methods, which is its primary

drawback.

7. D. A behavior-based IDS can be labeled an expert system or a pseudo artificial intelligence sys-

tem because it can learn and make assumptions about events. In other words, the IDS can act like a human expert by evaluating current events against known events.

8. B. Honey pots are individual computers or entire networks created to serve as a snare for intrud-

ers. They look and act like legitimate networks, but they are 100 percent fake. Honey pots tempt intruders with unpatched and unprotected security vulnerabilities as well as attractive and tan- talizing but faux data.

9. C. When an intruder is detected by an IDS, they are transferred to a padded cell. The transfer

of the intruder into a padded cell is performed automatically, without informing the intruder that the change has occurred. The padded cell is unknown to the intruder before the attack, so it cannot serve as an enticement or entrapment. Padded cells are used to detain intruders, not to detect vulnerabilities.

10. C. Vulnerability scanners are used to test a system for known security vulnerabilities and weak-

nesses. They are not active detection tools for intrusion, they offer no form of enticement, and they do not configure system security. In addition to testing a system for security weak- nesses, they produce evaluation reports and make recommendations.

11. B. Penetration testing should be performed only with the knowledge and consent of the man-

agement staff. Unapproved security testing could result in productivity loss or trigger emergency response teams. It could even cost you your job.