Does Web Apps and Databases running on AWS EC2 need a IDS/IPS?

Question

I have googled around for information about Web Apps or Databases running on AWS EC2 needing a IDS/IPS or not.

I will present my findings so far here, but it will be good if you guys can confirm these findings, or comment on them.

1. Netword based IPS/IDS systems are not necessary because:

Packets are only delivered to the destination addresses and no other devices will ever see that packet. While that eliminates many traditional threat vectors, it also makes intrusion detection approaches like NIDS/NIPS basically useless in AWS. So for intrusion detection in AWS you must look to host-based approaches.

Quoted from: http://www.erpassociates.com/peoplesoft-corner-weblog/cloud-computing/securing-enterprise-data-in-aws.html

1. People tend to use nagios for IDS purposes on AWS: https://forums.aws.amazon.com/thread.jspa?messageID=176652&#176652 How to do it.

2. People use host-based(software) IPS/IDS in AWS EC2, like OSSEC.

What do you guys think? Also, it seems to be that nagios can be configured to achieve what OSSEC can do. Is this correct too?

Answer 1

I'm not sure how you would manage a physical IDS on AWS since you are limited to what Amazon has in their system. When using a cloud provider, you largely have to trust their physical security, but you can reinforce it with your own software security to attempt to protect against any broad breach in their technology or any direct attacks against functionality you don't need or don't use in certain contexts.