Principles of Computer Security Key Terms 2 of 2

What is an Intrusion Prevention System (IPS)?

A system that identifies suspicious, malicious, or undesirable activity indicating a breach in security and responds automatically without human interaction.

What does the Misuse detection model in IDS do?

It looks for suspicious activities that violate specific policies and reacts as programmed, which can include alarms, emails, or other responses.

What is a Network Tap?

A connection to a network that allows sampling, duplication, and collection of traffic.

What is Network-based IDS (NIDS)?

A system for examining network traffic to identify suspicious, malicious, or undesirable behavior.

What is the concept of Perimeter Security?

A technique where organizations secure and control access at the perimeter to minimize the worry about activities inside.

What is Port Mirroring?

A technique where a mirrored port sees all traffic passing through a switch, allowing support for protocol analyzers.

What is a Protocol Analyzer used for?

It identifies packets and header information during network transit, primarily for troubleshooting communication issues.

What is a Signature Database?

A collection of activity patterns that indicate suspicious or malicious activity.

What is Snort?

The de facto standard IDS engine since 1998, known for its large user base and flexible rule sets for alerting.

What is Suricata?

An open-source IDS that supports multithreading and is maintained by the Open Source Security Foundation.

What is Switched Port Analyzer (SPAN)?

A technology that duplicates individual channels crossing a switch to another circuit.

What does a Traffic Collector do in an IDS?

Collects activity/events for the IDS to examine, functioning as a sensor, typically copying traffic off the network link.