1. IDS

2. Intrusion detection systems

Starthere

3. What is intrusion?

M-w link

4. Mostly used IDSes

And gohere

5. Main types

Two strategies

Signature based

6. Anomaly based 7. A comparison

Two locations

Network

8. HostHost IDS is mostly md5 sums on files and log file analysis 9. Software Linux software

Aide

10. Tripwire 11. Snort Windows software

12. Your firewall might doubles as IDS (and IPS) 13. Exercise

Discuss where to put a signature based network IDS in your network topology.

14. (make a drawing) 15. Discuss where to put other IDS's.