Although an IDS will not replace your firewalls — or other security devices for that matter — it serves a very complementary role and addresses certain risks that firewalls cannot. The primary function of the firewall is to control access to services and hosts based on your site security policy. If a service or connection to a specific host is permitted, firewalls typically permit all such traffic, and they do not inspect the content of the permitted traffic.
Let’s look at an example where you have a Web server on a DMZ behind your firewall. Your firewall will probably be configured to let HTTP traffic through to the Web server and block everything else inbound. The firewall will dutifully enforce the policy and bock all traffic to the Web server except for HTTP. Since HTTP traffic is permitted, any attacks that you can embed in HTTP traffic will also be permitted by the firewall. Examples of vulnerabilities that can be exploited this way include the Microsoft IIS unicode bug (see:
http://www.securityfocus.com/frames/?content=/vdb/bottom.html%3Fvid%3D1806 )
and the RedHat Piranha password vulnerability (see:
http://www.securityfocus.com/frames/?content=/vdb/%3Fid%3D1367 )
Note that the firewall is not misconfigured or malfunctioning.
Although most firewalls will not protect against data/content-driven attacks (like the example above), IDSs will because they inspect the content of the traffic (in addition to other things). Furthermore, firewalls typically will not protect you against attacks originating from inside your network or entering your environment from other ingress points not protected by firewalls (for example, remote access servers). IDSs can be strategically deployed to monitor activity from internal sources and other network ingress points without impacting your network. Deploying an IDS to complement your firewall(s)will significantly enhanceyour security posture.
