Intrusion Detection Tools: Open Source and Commercial Solutions

This report examines various intrusion detection tools, differentiating between open-source, freeware, and commercial solutions. It highlights the benefits of using open-source options like Snort, Fail2Ban, AIDE, and Security Onion, emphasizing potential cost savings compared to commercial alternatives such as IntruShield and AppScan Audit. The report also explores the additional expenses associated with implementing intrusion detection systems, including installation and maintenance, training, and hardware costs. The analysis underscores the importance of considering these factors when choosing an intrusion detection system, providing valuable insights for organizations seeking to enhance their network security while managing costs effectively. The report further discusses the advantages of open-source solutions, especially when customization and deep network analysis are not primary requirements.

Intrusion Detection
Tools
Open source and freeware intrusion detection tools
An IDS can be included in any part of the network. The detection occurs at real time. IDS
have various strengths. It monitors the actions of the system and identifies the user’s actions. The
configuration of the system and its security is tested by the IDS. The administrator defines a
baseline and the IDS track the modifications. IDS manage the functions of operating system, its
mechanism. It alerts the administrator whenever a threat is identified. It provides the relevant
security policy to the network.
The following are some of the open source and freeware intrusion detection tools identified by
Cooper (2018).
(i) Snort - Snort is the combination of protocol inspection and signature based
inspection. Real-time analysis of the network and its operations is possible using
Snort. In an IP network, the packet flow and logging can be monitored with the help
of Snort.
(ii) Fail2Ban
(iii) Advanced Intrusion Detection Environment (AIDE)
(iv) Security Onion
(v) Sagan
Commercial intrusion detection tools
The following are commercially available intrusion detection tools
(i) IntruShield
(ii) AppScan Audit
(iii) StormTrack
What would the estimated cost savings be for an organization to use the open source or
freeware versions?

Intrusion detection systems can be costly, over the top expensive. Luckily, there are many free
options accessible out there.
Source: https://www.alienvault.com/pricing
The above pricing for AlienValt speaks volumes about the amounts in question if one was to
purchase an IDS. Since there are alternative freeware or open source, it is advisable to use them
especially in cases where customization, deep network analysis or security auditing is not
needed.
What other expenses would the organization need to incur to implement the solution?
Even after acquiring the IDS for free, there are still other costs that need to be taken care of:
(i) Installation and maintenance costs – if you do not have trained expert, you will need
to hire one.
(ii) Training cost – If you hire an external expert for installation, then you will need to
train a few of your employees on how to use the IDS.
(iii) Hardware costs – After acquiring the software, you will need to purchase compatible
hardware.

References
Cooper, S. (2018, February 22). 10 top network intrusion detection tools for 2018. Retrieved
February 24, 2019, from https://www.comparitech.com/net-admin/network-intrusion-
detection-tools/