This post was originally published on October 23, 2015 and has been updated for accuracy and comprehensiveness.

Did you know that 43 percent of hackers target small businesses? Of those businesses hacked, 69 percent come from outsiders, making prevention even more difficult since attacks can come from anywhere.

Threat detection is key to addressing business vulnerabilities before hackers steal valuable data. In this post, we explain how an intrusion detection system (IDS) can provide security management by recording suspicious network and device activity.

1. What is an Intrusion Detection System?

An IDS is designed to monitor networks and devices to uncover malicious or harmful activity that may be detrimental to your business. It identifies areas that may be compromised, alerts administrators and reports incident details. Consider an IDS in addition to basic firewalls, especially when your company’s data carries a high value or if a compromise could affect business operations.

There are three main detection categories:

  • Network Based (NIDS): Processes and flags suspicious traffic between network-connected devices.
  • Host Based (HIDS): Placed on an individual network device to identify, log and alert administrators of unusual, unauthorized or illicit behavior.
  • Physical (Physical IDS): Identifies physical threats. Examples include security cameras, access control systems and motion sensors.

Combined, these three categories can identify problems as early and far away from critical systems as possible. For example, the NIDS can identify the most broadly defined issues at the edge of a network, while the HIDS focuses more on identifying system or service-related issues that are not detectable by the NIDS.

2. How Does an IDS Enhance Security Management?

When you pair proper IDS implementation with a vigilant IT team (whether in-house or through a partner) you increase your ability to uncover harmful activity. Combined, the two can identify risks, such as:

  • Configuration errors.
  • Infections or viruses.
  • Information leaks.
  • Security policy violations.
  • Unauthorized network or device access.

To optimize performance, it’s essential you plan and deploy these systems properly.

Work with your IDS vendor, security provider, network vendor and IT department to properly test and configure the system.

3. How Does an IDS Prevent Suspicious Activity?

While an IDS will detect and gather event data that shows your systems and/or network risks, it’s only designed to listen and report. An IDS can’t automatically take steps to block or stop the activity—but an intrusion prevention system (IPS) can.  

For the best monitoring, routinely check your alerts to uncover changes in network filters and policies to reduce exposure.

Additionally, conduct regular reviews of alerts to uncover whether any changes to network filters, policies, etc. are warranted to reduce exposure.

If you notice suspicious activity, meet with your security vendor to discuss options to protect vulnerable assets and remedy detected risks. This allows you to prevent future threats.

To learn more on how to protect your business from data breaches, download our free whitepaper, “LP Meets IT for Complete Managed Business Infrastructure, Security and Intelligence.”