04 Goan lo

In defending network resources any number of technologies might be applied. Firewalls, encryption technology, authentication devices, vulnerability checking tools, and other products can all offer improved security. But even when a computer system is equipped with stringent authentication procedures and firewalls, it is still susceptible to hackers who take advantage of system flaws and social engineering tricks (for example, impersonating a system administrator on the phone to acquire user passwords). Computer systems with no connection to public networks remain vulnerable to disgruntled employees or other insiders who misuse their privileges. Given these enduring threats, it is only sensible to establish a second line of defense in the form of an intrusion detection system. The field of intrusion detection began close to 20 years ago. The majority of early systems were designed to detect attacks upon a single host. More recent systems consider the role of networks and look for evidence of intrusions by passively monitoring LAN traffic. Yet another set of intrusion detection systems is designed to collect and aggregate evidence from mulThere is little question that the ever-growing volume and diversity of