Report on IT Security Management: IDS and its Applications

This report provides a comprehensive overview of Intrusion Detection Systems (IDS) within the context of IT security management. It begins by establishing the necessity of IT security in modern organizations, emphasizing the increasing sophistication of cyber threats and the need to protect digital assets. The report then delves into the core concepts of IDS, including its classifications based on analyzed activity (Network-based and Host-based) and detection methods (Signature-based and Anomaly-based). It explains the mechanisms of each type, highlighting their respective strengths and weaknesses. Furthermore, the report explores the future applications of IDS, including the potential integration of IoT and the combination of IDS with Intrusion Prevention Systems (IPS) to enhance overall security. The conclusion summarizes the importance of IDS in safeguarding organizational information and suggests further advancements in the field of cyber security. This report, contributed by a student, is available on Desklib, a platform offering AI-based study tools.

Running head: REPORT ON INFORMATION TECHNOLOGY SECURITY MANAGEMENT
REPORT
ON
INFORMATION TECHNOLOGY SECURITY MANAGEMENT
Name of the Student
Name of the University
Author Note:

1IT Security Manegement
Introduction:
Purpose of this report is to discuss about the application of intrusion detection system
into any information technology organization as it has been significantly proven that there is
huge necessity of IT security into any IT enabled organization. Followed by the above aspect
it has been also noticed that considering the current security threats in IT organizations, it has
been detected that information technology security provides effective protection to the IT
devices which will restrict the unauthorized access as well as the possibilities of getting
attacked by the other cyber security threats (Bada, Sasse & Nurse 2019). Hence, considering
this above aspects this report will consist a detail elaboration on why IDS has been
introduced in the cyber security field. Along with this it will also discuss about the
classification of the Intrusion Detection System as well as the IDS mechanism. Lastly, it will
conclude by stating the future application of IDS which may have the ability to enhance the
security procedure of an IT enabled organization.
Background:
Followed by the aspect of providing protection to the IT enabled organizations, it can
be stated that data security or the aspect of IT security can be obtained by providing effective
protection to the information or the information technologies of the an organization where
there is significant possibilities of getting attacked by external threats due to which the
information related to the organization as well as the stakeholders (Amini et al., 2015).
Considering the aspect of information loss it has been noticed that it is now highly essential
to address the IT security threats with effective IT security applications as while investigating
the essentiality of IT security it has been noticed that the hackers are getting more dangerous
which holds a major impact of the protecting the digital assets as well as it protects the
information network devices. Hence, with the purpose to protect the digital data and other IT
assets present in an IT enabled organization the application of intrusion detection system has

2IT Security Manegement
been introduced which has offered several impactful features that has the ability to reduce the
possibilities of getting attacked by external threats (Ben-Asher & Gonzalez 2015). Intrusion
Detection System is such system, which is effective for the IT enabled organization with the
purpose to monitor the network traffics, followed by which IDS will aware the organization
about the determined suspicious or unusual activities in order to take possible action to
reduce the chances of getting hacked. Followed by the above mentioned application it also
analyses the outbound network as well with the purpose to identify and indicate the unusual
activities present in that selected organization (Cherdantseva et al., 2016).
Classification of Intrusion Detection System:
While analyzing the application of Intrusion Detection System it has been noticed
that, IDS has four classifications based on its analyzed activity and detection method. A detail
elaboration on those identified classifications are described below-
Analyzed Activity-
Followed by the application as well as the offered feature of Intrusion detection
system into the IT enabled organization, the IDS has been classified into two which includes
the Network Based Intrusion Detection (NIDS) and the Host Based Intrusion Detection
System (HIDS) (Fielder et al., 2016). A detail elaboration of above mentioned IDS types are
mentioned below:-
Host Based Intrusion Detection System (H-IDS)-
After analyzing the application of Intrusion Detection System into the organizational
network as well as in the IT infrastructure it can be stated that the only aim of an Intrusion
Detection System is to identify, gather and alert the organization about the unauthorized
access that has taken place onto the IT infrastructure and into the network servers as well.
Considering the above feature of IDS a Host Based IDS works by executing an effective

3IT Security Manegement
HIDS on the host server of the organization with the purpose to monitor the activities of the
organization. Followed by this objective it has been observed that initiates it work by keeping
the snapshot of the network activities within it and continuously compare it with the previous
one, followed by which it identifies the unusual activities that has occurred in the host server.
After analyzing and identifying the organizational unauthorized access HIDS will then alert
the system administrator about the suspicious activity (Liao et al., 2013). Unlike the
application of the Intrusion Prevention System, IDS does not protect the server from unusual
activities, however it helps to detect the unusual activity which might help to enhance the
mitigation approaches.
Pros of HIDS-
 HIDS holds the ability to quantify and qualify the threats.
 Effective threat detection approach.
 Effective Boosting ability.
Cons of HIDS-
 Cannot prevent from the threats by itself.
 Chances of fake IP packets.
 False Alert.
 Less effective on processing encrypted data.
Network Based Intrusion Detection System (D-IDS)-
Network based intrusion detection system are the types of intrusion detection system
which monitors the IT network of the nominated organization with the purpose to detect the
unauthorized access and activities that is happening in the network server and alert the
administration system about the identified activities. It works by comparing the packets of
that are passing through the network server with the previous packets and identifies whether

4IT Security Manegement
it is matching or not. And after the IDS detects the unauthorized activity on the organizations
network server it alerts the system administrator (Kang & Kang 2016).
Followed by the above mentioned features the list of Pros and Cons of NIDS are
provided below:-
Pros of NIDS-
 Highly effective on detecting suspicious activities on the IT networks.
 While performing the detection process it does not hampers the working process of
any organization.
 Security regulations become more efficient and easy to install.
Cons of NIDS-
 Cannot prevent from the external threats.
 Significant problem in processing encrypted data packets.
Detection Method-
Along with the classifications of IDS based on the analyzed activities, there are also
two classification based on the Detection method of IDS which includes the signature base
detection and Anomaly based detection. A detail elaboration on these identified IDS types
based on its detection methods are listed below:-
Signature Based IDS-
These types of detection methods, detects the suspicious activities by comparing the
network activities and server activities by comparing it with some specific patterns. Followed
by this it analyses whether there is any suspicious activity is taking place or not. While
investigating the application of the signature based IDS it has been noticed that these types of
IDS’s are highly effective for known attacks. However, these are not effective in case of new

5IT Security Manegement
threats. The signature based IDS works by updating the signature key while installing into the
IT infrastructure.
Anomaly Based IDS-
Whereas the signature base IDS’s were more effective to the known threats, the
Anomaly based IDS’s are basically introduced for the unknown threats. It also compares the
inbuilt pattern with the current services activities, however these systems are based on the
concept of machine learning thus it holds the ability to learn by itself only (Ashfaq et al.,
2017). Followed by the identification of this feature it has been noticed that as compared to
the effectiveness of the Signature based IDS, Anomaly IDS’s are more effective in every
context (Aljawarneh et al., 2018).
IDS mechanism:
Followed by the above mentioned classification of the Intrusion Detection System, it
is also identified that due to effective detection methodologies IDS are able to identify the
threat full activities on the IT enabled organizations. As discussed earlier that the intrusion
detection systems are basically classified into two types which includes the signature based
detection and Anomaly based detection. Followed by this aspect while investigating the
mechanism of signature based detection method it has been noticed that the signature based
detection is an anti-malware action by an intrusion detection system with the purpose to the
detect unauthorized activities present in an organizational network or server. Hence, it has
been noticed that this malware detection process initiates by analyzing and comparing
specific pre-defined patterns with current patterns. The pre-defined patterns are mostly about
the known threats, thus it can be stated that these types of detections methods are highly
recommended for the known attacks as by considering the current growth of the cyber

6IT Security Manegement
security threats, it has been observed that the hackers are getting smarter day by day due to
which they are introducing new threats for attacking (Pan, Morris & Adhikari 2015).
Followed by the problem to identify the unknown threats in IT enabled organizations,
the anomaly based detection has been introduced with the purpose to monitor the IT network
with in more effective way. Considering this aspect, after a detail elaboration on the features
and mechanism of the Anomaly based detection it has been noticed that this is based on the
concept of machine learning. Thus, it holds the ability to learn from the current working
procedure. Followed by this step the IDS will then compare the current activities with the
normal activities of eth IT network and when any suspicious activity will be accounted by
IDS, it will the send alert to the system administrator about the activities. Considering this
feature it can be sated that anomaly based detection systems are one of the most effective
detection methods as it holds the ability to detect unknown as well as known suspicious
activities in order to provide better security to the IT enabled organization.
Future Application of IDS:
While discussing about the aspect of cyber security and its future with intrusion
detection system, it has been determined that there are significant scope for intrusion
detection system in future. Since, it is described above that two of the most effective
detection methods are the signature based detection system process and anomaly detection
method, there is also a significant possibilities of the application of Internet of things into the
mechanism of intrusion detection system (Javaid et al., 2016). As it has been noticed that
currently there is a major growth of cyber threats which holds a significant impact on the
information security in an IT enabled organization, the application of internet of things (IoT)
will be able to reduce the chance of those security threats by effectively monitoring the
network activities by automatic devices (Hodo et al., 2016). Followed by the above

7IT Security Manegement
recommendation it is also noticed that apart from the incorporation of the effective automatic
devices into the IDS, there is a huge application of more effective instruction prevention
system rather than only detecting the threats. Hence, considering the current growth of cyber
threats it is recommended to integrate the intrusion detection system with the intrusion
prevention system which will then consist ability to identify and mitigate the threat by just
installing one system. Along with integrating the IDS and IPS mechanism it must integrate
the HIDS and NIDS as well, as it will enhance the overall working efficiency of the IDDS
system followed by which the installed system can effectively monitor, detect and protect the
network server and the host server as well.
Hence, it is suggested to incorporate the features of IoT into Intrusion detection
system as well as to integrate the intrusion detection system and the intrusion prevention
system with the purpose to enhance the aspect of cyber security which holds a significant
impact on the future scope of information security.
Conclusion:
Followed by the above discussion it can be stated that the application of intrusion
detection system into the field of cyber security holds a significant impact on protecting the
information present in an IT enabled organization. In order to support the above discussion
this paper consist a detail elaboration on how IDS has been introduced into the field of cyber
security. Along with the above discussion it has also discussed about the features and the
application of the Network Intrusion Detection System and the Host Intrusion Detection
System, followed by which it has also elaborated about the working mechanism as well as the
future application of IDS.

8IT Security Manegement
Reference:
Aljawarneh, S., Aldwairi, M., & Yassein, M. B. (2018). Anomaly-based intrusion detection
system through feature selection analysis and building hybrid efficient model. Journal
of Computational Science, 25, 152-160.
Amini, L., Christodorescu, M., Cohen, M. A., Parthasarathy, S., Rao, J., Sailer, R., ... &
Verscheure, O. (2015). U.S. Patent No. 9,032,521. Washington, DC: U.S. Patent and
Trademark Office.
Ashfaq, R. A. R., Wang, X. Z., Huang, J. Z., Abbas, H., & He, Y. L. (2017). Fuzziness based
semi-supervised learning approach for intrusion detection system. Information
Sciences, 378, 484-497.
Bada, M., Sasse, A. M., & Nurse, J. R. (2019). Cyber security awareness campaigns: Why do
they fail to change behaviour?. arXiv preprint arXiv:1901.02672.
Ben-Asher, N., & Gonzalez, C. (2015). Effects of cyber security knowledge on attack
detection. Computers in Human Behavior, 48, 51-61.
Cherdantseva, Y., Burnap, P., Blyth, A., Eden, P., Jones, K., Soulsby, H., & Stoddart, K.
(2016). A review of cyber security risk assessment methods for SCADA
systems. Computers & security, 56, 1-27.
Fielder, A., Panaousis, E., Malacaria, P., Hankin, C., & Smeraldi, F. (2016). Decision support
approaches for cyber security investment. Decision Support Systems, 86, 13-23.
Hodo, E., Bellekens, X., Hamilton, A., Dubouilh, P. L., Iorkyase, E., Tachtatzis, C., &
Atkinson, R. (2016, May). Threat analysis of IoT networks using artificial neural

9IT Security Manegement
network intrusion detection system. In 2016 International Symposium on Networks,
Computers and Communications (ISNCC) (pp. 1-6). IEEE.
Javaid, A., Niyaz, Q., Sun, W., & Alam, M. (2016, May). A deep learning approach for
network intrusion detection system. In Proceedings of the 9th EAI International
Conference on Bio-inspired Information and Communications Technologies
(formerly BIONETICS) (pp. 21-26). ICST (Institute for Computer Sciences, Social-
Informatics and Telecommunications Engineering).
Kang, M. J., & Kang, J. W. (2016). Intrusion detection system using deep neural network for
in-vehicle network security. PloS one, 11(6), e0155781.
Liao, H. J., Lin, C. H. R., Lin, Y. C., & Tung, K. Y. (2013). Intrusion detection system: A
comprehensive review. Journal of Network and Computer Applications, 36(1), 16-24.
Pan, S., Morris, T., & Adhikari, U. (2015). Developing a hybrid intrusion detection system
using data mining for power systems. IEEE Transactions on Smart Grid, 6(6), 3104-
3113.