Assume this scenario:

Someone trying to hack a website. Simply put: www.site.com/example.php?=<script>alert(1)</script>

A HIDS would see this attempt in Apache's access log, a NIDS would see this attempt in packet's HTTP section and the WAF in the URL.

If all of them are detecting the attack, why are needed all of them on an infrastructure?


You are correct to think that these three technologies are complementary and will often detect the same issues. However, that in itself is no reason not to use them in layers. One may catch things the other may not. Look at virus scanners - here's an example where only 14% of the 37 scanners attempted found the virus! And that's with the same exact type of protection!

The products you've listed have more variation than comparing virus scanners, and in fact have significant architectural differences. A HIDS will often see things that sailed right past the NIDS because of SSL encryption. A WAF will often have specific signatures for a web application that the NIDS and HIDS won't have. The NIDS will detect network layer attacks that the WAF and HIDS would never notice.

In short, complementary does not mean equal.

  • 1
    3 systems detecting the same attack reduce the false positive threshold aswell – CtrlDot Mar 17 '14 at 15:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.