S+ NIDS or HIDS question

paulgswanson

I was reading Darrils section about NIDS and HIDS and it occured to me. Since a firewall can be either Software or a physical device is there an assumption we should be making?
example:

Bobert installed a new firewall on your network and needs to install a IDS. What is the best solution?
A. NIDS
B. HIDS
C. Summon Liam Neeson

Has anyone come across this? My first instinct would be to look at A and B and then Id stroke out and guess (problably B).

Seriously thought whats the best answer here, other than the obvious giggle for C

Sorry If thats a silly question, I don't know that much above whats the best yet, hence the studying, so uhm sorry.

ptilsen

Might need DG himself to weigh in on this one. The premise of the question as I see it is unclear. Whether a firewall was installed (I assume it's a hardware firewall, since it's "on the network") doesn't, from my perspective, have anything to do with whether HIDS, NIDS, or both are still needed solutions.

Edit: The answer to your more general question is that a "firewall" software or hardware, is a HIPS or NIPS, respectively. It is not necessarily a HIDS or NIDS, since features to detect intrusions may not be included.

sec_wiz

I know what you're getting at but that question is far too vague to be brought up in a test situation.

However if it stated 'local' IDS then it would obviously be HIDS.

afcyung

To me the answer is in spelling out the acronyms. NIDS is a Network Intrusion Detection System. HIDS is a Host Intrusion Detection System. The question stated that he installed a firewall on the Network. So to me the answer is NIDS.


EDIT: To answer your question about firewalls. Typically if a firewall is installed on a network its a physical box being installed. A Cisco ASA as one example. Software firewalls are typically used on PCs and servers as added protection for each box, a good example is the Windows firewall. Now does that matter in the context of the question you presented? To me no. The question is basically asking if you know what NIDS and HIDS stand for. The question gave the context clue of the firewall being installed on the network, which should have pointed you at NIDS.

paulgswanson

Thanks for the answers and sorry for the vague wording of the question. I'll keep an eye out for the context of the question come test day. I'll get this one right come test day!