A standard protection method that most businesses (both large
and small) utilize to protect their establishment from theft is
a common burglar alarm. Given this fact, it is amazing how many
of these same businesses install little if any protection to
guard their networks from attack and theft of valuable company
information. An intrusion detection system (IDS) is essentially
a burglar alarm system for your network. It enables you to
monitor your network for intrusive activity. When intrusive
activity occurs, your IDS generates an alarm to let you know
that your network is possibly under attack. Like regular burglar
alarms, however, your IDS can generate "false positives" or
"false alarms". A false positive occurs when your IDS generates
an alarm from normal user activity. If your IDS generates too
many false positives, then you will lose confidence in the
capability of your IDS to protect your network. If you have a
burglar alarm that continually goes off incorrectly, the police
will become conditioned to the