IDS Deployment Overview

The decision regarding control strategies, decisions about where to locate elements of intrusion detection systems is an art in itself. Planners should select deployment strategy based on careful analysis of organization’s information security needs but, at the same time, causes minimal impact. NIDS and HIDS can be used in tandem to cover both the individual systems which connect to an organization’s networks and networks themselves.

Deploying Network Based IDSs

NIST recommends 4 locations for NIDS sensors

- Location 1: behind each external firewall, in network DMZ
- Location 2: outside the external firewall
- Location 3: On the major network backbones
- Location 4: On the critical subnets

                                         This Figure given below illustrates the Network IDS sensor Locations.