INTRUSION DETECTION AND PREVENTION SYSTEM

Catalog description

This course explores the use of network and host-based intrusion detection and intrusion prevention systems (IDS/IPS) as part of an organization’s overall security environment. A variety of systems, deployment architectures, and identification algorithms are discussed. These are presented with a focus on the practical concerns of deploying these systems in an enterprise environment. The progress in this discipline towards a robust and complete network security monitoring (NSM) program is discussed, along with the integration of network-based and host-based security systems. A critical facet of the course is the methods and techniques used to identify and mitigate false positives and false negatives while ensuring high-precision true positive and true negative detection of events. The trade-offs of the performance vs. precision of these systems complete the course. (3 credits)