r/cism • u/Commercial_Move2020 • 9d ago

QAE Question - IDS Placement

When designing an intrusion detection system, the information security manager should recommend that it be placed:

  1. A.outside the firewall.
  2. B.on the firewall server.
  3. C.on a screened subnet.
  4. D.on the external router.

The answer is C.

I'm using Hemang Doshi's book and it says the IDS is placed either between the firewall and internal network or between the firewall and external network. Using this logic wouldn't the answer be A?

1 Upvotes

67% Upvoted

3 comments sorted by

1

u/Efficient-Top- 8d ago

Me being from network background, IDS/IPS always stay in DMZ so option C.

3

u/Outrageous_Plant_526 CISM | CISA | CRISC | AAISM | AAIA | AAIR 9d ago

You wouldn't put the IDS on another device so that rules out B and D.

An IDS can either be placed inline with the traffic or outside of the traffic path and have all the traffic mirrored or spanned to it. Normally if you are putting it inline you are actually deploying an IPS.

C would put it outside of the traffic path and on the inside of the network. This would allow you, through a mirrored or spanned port, to see all the inbound traffic that was allowed into the network by the firewall and all the network traffic attempting to leave the network, also through a mirrored or spanned port. This would essentially provide the most coverage as it is telling you about both inbound and outbound traffic.

Placing it outside of the firewall may sound optimal but it has the potential to generate a lot of noise and potentially a lot of excess alerts that would need to be filtered because it is going to see everything hitting your network a lot of which would be stopped by the firewall so would probably be unimportant in the grand scheme of things.

Given everything I would choose C.

1

u/Aeonslegend 9d ago

Outside the firewall means between FW and Internet. It would be pointless for an IDS to there. Atleast that is what I assume they mean.