Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Assume this scenario:

Someone trying to hack a website. Simply put: www.site.com/example.php?=<script>alert(1)</script>

A HIDS would see this attempt in Apache's access log, a NIDS would see this attempt in packet's HTTP section and the WAF in the URL.

If all of them are detecting the attack, why are needed all of them on an infrastructure?

share|improve this question

1 Answer 1

up vote 8 down vote accepted

You are correct to think that these three technologies are complementary and will often detect the same issues. However, that in itself is no reason not to use them in layers. One may catch things the other may not. Look at virus scanners - here's an example where only 14% of the 37 scanners attempted found the virus! And that's with the same exact type of protection!

The products you've listed have more variation than comparing virus scanners, and in fact have significant architectural differences. A HIDS will often see things that sailed right past the NIDS because of SSL encryption. A WAF will often have specific signatures for a web application that the NIDS and HIDS won't have. The NIDS will detect network layer attacks that the WAF and HIDS would never notice.

In short, complementary does not mean equal.

share|improve this answer
1  
3 systems detecting the same attack reduce the false positive threshold aswell –  CtrlDot Mar 17 at 15:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.