Intrusion Detection System (IDS / IPS) useful for Linux home users?

Question

Can an Intrusion Detection System or Intrusion Prevention System (IDS / IPS) increase the security of home users using Linux?

Or is an IDS / IPS even less useful than antivirus for Linux?

Is an IDS / IPS more useful in company networks and so forth?

Answer 1

I don't think the average home user affords a large known IPS, but generally speaking, an IPS is good for Linux-based infrastructures too because:

• It uses a wide range of techniques to detect attacks like signature - or anomaly-based detection, network flow or behavior analysis, denial-of-service detection, and deep-packet inspection.

• At file level, there are Linux viruses just as they are for Windows. It can certainly protect against those.

• Can detect zero-day attacks and other attacks that have never been seen

• Can detect attacks within application communications

• Newest ones can use simulation and/or emulation capabilities to identify malware

Answer 2

Yes, configured and used correctly, an IDS or IPS will increase security for any user.

But also antivirus will increase security for users on any operating system, so your assumption is incorrect there.

The amount it will increase security depends on a huge number of factors, though, so we can't tell you how much it will help you. It will help company networks more, because they have a broader risk profile than you will at home, but you will need to run your own risk assessment.