1

Can an Intrusion Detection System or Intrusion Prevention System (IDS / IPS) increase the security of home users using Linux?

Or is an IDS / IPS even less useful than antivirus for Linux?

Is an IDS / IPS more useful in company networks and so forth?

1

I don't think the average home user affords a large known IPS, but generally speaking, an IPS is good for Linux-based infrastructures too because:

  • It uses a wide range of techniques to detect attacks like signature - or anomaly-based detection, network flow or behavior analysis, denial-of-service detection, and deep-packet inspection.

  • At file level, there are Linux viruses just as they are for Windows. It can certainly protect against those.

  • Can detect zero-day attacks and other attacks that have never been seen

  • Can detect attacks within application communications

  • Newest ones can use simulation and/or emulation capabilities to identify malware

1

Yes, configured and used correctly, an IDS or IPS will increase security for any user.

But also antivirus will increase security for users on any operating system, so your assumption is incorrect there.

The amount it will increase security depends on a huge number of factors, though, so we can't tell you how much it will help you. It will help company networks more, because they have a broader risk profile than you will at home, but you will need to run your own risk assessment.

  • I will add that IDS are pretty useless if you don't do any analysis of the alerts. – Whysmerhill Nov 2 '17 at 10:57
  • Any tool is useless if not used correctly, yes – Rory Alsop Nov 2 '17 at 11:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.