Problems
False Negatives
- All IDS systems suffer from false negatives, whether from very few or very many. Each time this happens, it means the system has failed
Monitoring Points
- Monitoring traffic between major networks is one problem, but when this problem is extended to workgroup levels, and in a switched network environment (or ATM, etc..), it becomes very difficult to simply see the data, much less analyze it for problems.
Auto-Response Products
- Wonderful for denial of service attacks.