The limitation of firewall and the characteristics of intrusion detection system

The firewall has two main limitations:

1, the firewall is Access control equipment (ACL), mainly based on the source IP address to real access control, to achieve the security of the network layer, but can not detect or intercept the injection in ordinary traffic malicious attack code, such as the Web service injection attacks.

2. The firewall is unable to detect or intercept attacks that occur in the internal network.

Firewall is the first line of defense to achieve network security, intrusion detection system is a useful complement to the firewall, is the second line of defense, you can carry out deep-seated, multi-level analysis and detection of internal attacks, external attacks, misoperation, such as real-time monitoring, dynamic protection greatly improve the security of the network. There are 3 main features of intrusion detection system:

1 beforehand warning: can detect the attack behavior before the malicious attack to the network system to cause the harm, carries on the alarm. 2, the matter of defense: when the intrusion attack behavior occurs, can be linked to the firewall, or TCP killer and other defense.

3, after the evidence: after the attack can provide attack information for forensic analysis.

On the firewall and intrusion detection system comparison, there is an appropriate analogy: the firewall equivalent to the doorman, the entry of each person to test, intrusion detection system equivalent to closed-circuit monitoring system, monitoring key locations such as warehouses, financial room, such as the security situation, only the doorman can not find internal personnel illegal, and closed-circuit monitoring system can monitor the internal real-time, found abnormal situation timely issued a warning, the combination of both to ensure security.

This article is from the "11241653" blog, please be sure to keep this source http://11251653.blog.51cto.com/11241653/1761420

The limitation of firewall and the characteristics of intrusion detection system