Do we need both host-based and network-based intrusion detection?
Ideally yes, because each sees what the other misses, but a small company can add them one at a time. Host-based detection (HIDS, or today usually EDREDR: endpoint detection and response. Security software installed on each computer that watches what happens on that machine.) runs on a computer and sees files, processes and logins on that machine. Network-based detection (NIDS, or NDRNDR: network detection and response. Security monitoring that watches the traffic between devices and raises an alert when one behaves like an attacker.) watches traffic and sees how devices talk to each other, including devices where no software can be installed. A host tool cannot see a printer calling out; a network tool cannot see a malicious file being opened. Start with protection on every computer, because that is the more basic need, then add network detection when you have a local network with devices beyond laptops. NetSenX is the network side; it does not replace endpoint protection.
Read next
Related questions
Terms used here
- EDR (endpoint detection and response)
- Security software installed on each computer that watches what happens on that machine.
- NDR (network detection and response)
- Security monitoring that watches the traffic between devices and raises an alert when one behaves like an attacker.