Intrusion Detection

Definition

Intrusion detection is the extent to which a business enterprise, application, component, or center detects and records attempted access or modification by unauthorized individuals or programs.

Measurement

Intrusion detection is typically measured in terms of:

• The minimum percentage of the time that attempted intrusions will be detected and that security will be notified.

Requirements

See intrusion detection requirements.

Mechanisms

Typical mechanisms for implementing support for intrusion detection include:

• Alarms.
• Event Reporting.
• Use of a specific commercial-off-the-shelf (COTS):
  • Intrusion Detection System (IDS).
  • Intrusion Prevention System (IPS).

Guidelines

The following guidelines have been found to be useful when producing intrusion detection requirements:

• Intrusion detection requirements depend on identification, authentication, and authorization requirements.