I have googled around for information about Web Apps or Databases running on AWS EC2 needing a IDS/IPS or not.
I will present my findings so far here, but it will be good if you guys can confirm these findings, or comment on them.
- Netword based IPS/IDS systems are not necessary because:
Packets are only delivered to the destination addresses and no other devices will ever see that packet. While that eliminates many traditional threat vectors, it also makes intrusion detection approaches like NIDS/NIPS basically useless in AWS. So for intrusion detection in AWS you must look to host-based approaches.
People tend to use nagios for IDS purposes on AWS: https://forums.aws.amazon.com/thread.jspa?messageID=176652𫈌 How to do it.
People use host-based(software) IPS/IDS in AWS EC2, like OSSEC.
What do you guys think? Also, it seems to be that nagios can be configured to achieve what OSSEC can do. Is this correct too?