Network Intrusion Detection Systems (NIDS) #2: The ten biggest misconceptions about NIDS (that businesses should be aware of)

1. “A NIDS solution only alerts me to critical threats.”

Reality: Initially, a NIDS solution will typically generate thousands of alerts, most of which are innocuous or merely informational, because the NIDS solution is not yet tuned to the specifics of the network and applies generic policies and rules. This means that harmless activities such as scanning a file share will also trigger alerts. A NIDS solution must be gradually and continuously adapted to a network in order to reliably detect unusual activities as well as potential threats and risks.

2. “Optimizing a NIDS solution is easy and only requires a few clicks.”

Reality: NIDS optimization is a complex process that requires both in-depth knowledge of the network, including which components within the network typically communicate with each other and how, as well as an understanding of network protocols such as SMB, Modbus, or DNP3 along with a risk-based assessment of the alerts generated by the NIDS solution. And even after a first round of optimization, new devices connected to the network or changes to the network itself may require re-optimization – for a NIDS solution to function reliably, it must be continuously tested and regularly adapted.

3. “A NIDS solution can optimize itself using automatic learning capabilities.”

Reality: While most modern NIDS solutions do have automatic learning capabilities, these merely log the patterns of monitored data traffic within the network. They are not designed to determine whether monitored network activities are legitimate or a potential threat, nor are they capable of understanding the broader business context in which the monitored traffic occurs. This means that businesses must manually review the patterns and behaviors learned by their NIDS solutions to ensure that the solution is capable of detecting actual threats, including threats that mimic normal network activity.

4. “An experienced cybersecurity expert can optimize NIDS alerts immediately.”

Reality: Even experienced cybersecurity experts require several weeks before they can reliably optimize a NIDS solution, because even with many years of experience, not all network traffic can be predicted beforehand. Instead, they must manually review each individual case to ensure that no actual threats go undetected by the NIDS solution. Therefore, most NIDS projects should include a baseline phase of approximately 30 to 60 days to accurately analyze and understand all relevant network activities.

5. “A NIDS solution automatically blocks attacks.”

Reality: The D in NIDS stands for “detection”, not “prevention”, because the purpose of a NIDS solution is to alert the user of suspicious network activities, provide logs for further investigation of incidents and therefore provide a greater degree of network transparency. A NIDS solution does not block potentially harmful network traffic on its own, unless it is integrated with firewalls and other active network security measures. Microsoft Defender for IoT, for example, can be integrated with a Palo Alto firewall to automatically block threats, but this requires a configuration that goes beyond a typical NIDS solution.

6. “Once implemented, a NIDS solution does not need any further updates.”

Reality: Without regular updates, a NIDS solution is unable to detect new types of threats and attack vectors, identify network vulnerabilities based on CVEs (Common Vulnerabilities and Exposures), and may even mistakenly identify legitimate applications that have recently been updated as threats. Just like an antivirus solution, a NIDS solution should therefore be updated regularly to receive the latest signature and behavior library updates.

7. “All NIDS solutions offer the same level of network transparency.”

Reality: Different NIDS solutions are specialized for different network environments and application scenarios. Some, such as Microsoft Defender for Endpoint or Snort are better suited for traditional IT networks, while others, such as Microsoft Defender for IoT, Nozomi Networks, or Dragos, are best suited for OT environments. A NIDS solution that is not suitable for a specific environment may not be able to apply certain protocols, reliably monitor certain network traffic or correctly prioritize potential threats and risks. Thus, businesses should take care to choose the right NIDS solution for their application scenario and, ideally, ask their NIDS provider directly which environment the solution is best suited for.

8. “With an optimized NIDS solution, network segmentation is no longer necessary.”

Reality: Network segmentation and NIDS optimization should be used in tandem to reduce a business’s attack surface and prevent potential threats – and to simplify the NIDS optimization process as a whole, because without a certain degree of network segmentation, a single NIDS solution may have to monitor too much irrelevant network traffic, resulting in too many false positives and actual threats being overlooked.

9. “A NIDS solution can detect zero-day attacks immediately.”

Reality: Based on behavior analysis, a NIDS solution can detect known threats based on signatures and anomalies in the network. However, zero-day attacks often use novel attack vectors, previously unidentified vulnerabilities or exploits, or network traffic that appears legitimate. A good NIDS solution may be able to detect network anomalies indirectly related to a zero-day attack, but not in a guaranteed or reliable manner. Therefore, organizations should always use a NIDS solution together with endpoint protection, behavioral analysis and threat intelligence solutions to ensure a more thorough level of protection.

10. “Once implemented, no specialized personnel is need to maintain a NIDS solution.”

Reality: To function reliably, a NIDS solution requires continuous management, regular updates to policies and rules, incident reviews and responses as well as ongoing training of the experts responsible for the solution. Without the latter, even the best NIDS solution becomes a confusing and unhelpful patchwork. Businesses that do not have the necessary expertise to do so in inhouse, should consider outsourcing NIDS management to a managed security services provider.

Takeaway

A NIDS solution can significantly improve a business’s level of cybersecurity, if the business takes the necessary steps to understand it and its requirements. A NIDS solution is not purchase-and-forget product, but an asset that needs to be continuously developed and improved. When it is implemented and managed correctly however, a NIDS solution becomes an effective early warning system that improves a business’s cybersecurity and detects threat before they can become an actual risk.

‍

This was the second article in our three-part NIDS series. Stay tuned for the third and final article, coming soon.