- Intrusion detection system (IDS) - keeps track of all activity. Can't detect attacks within encrypted traffic
a. Network-based (NIDS) - separate device via machine
b. Host-based (HIDS) - typically implemented on servers
When your IDS detects an intrusion, it will respond to it either passively or actively. Passive responses are the easiest to configure and include the following:
Logging- All activity from the intrusion is logged. The information gathered can be used to foil future attacks of the same type. Intrusions should always be logged.
Notification- When an attack occurs, an IDS can send an alert to one or more administrators.
Shunning- Shunning is when you choose to just ignore an attack because it is possible it will not affect your network. For instance, if someone launches an attack designed to cripple a Microsoft Exchange email server at a network that outsources its email service to a cloud-based email provider then your network is safe and you do not need to spend time mitigating the attack. However you should log the event for your records.