You are the project manager of your enterprise. You have introduced an intrusion detection
system for the control. You have identified a warning of violation of security policies of your
enterprise. What type of control is an intrusion detection system (IDS)?
A.
Detective
B.
Corrective
C.
Preventative
D.
Recovery
Explanation:
An intrusion detection system (IDS) is a device or software application that monitors network
and/or system activities for malicious activities or policy violations and produces reports to a
Management Station. Some systems may attempt to stop an intrusion attempt but this is neither
required nor expected of a monitoring system. Intrusion detection and prevention systems (IDPS)
are primarily focused on identifying possible incidents, logging information about them, and
reporting attempts. In addition, organizations use IDPS for other purposes,such as identifying
problems with security policies, documenting existing threats, and deterring individuals from
violating security policies.
As IDS detects and gives warning when the violation of security policies of the enterprise occurs, it
is a detective control.
Answer C is incorrect. As IDS only detects the problem when it occurs and not prior of its
occurrence, it is not preventive control.
Answer B is incorrect. These controls make effort to reduce the impact of a threat from problems
discovered by detective controls.
As IDS only detects but nt reduce the impact, hence it is not a corrective control.
Answer D is incorrect. : These controls make efforts to overcome the impact of the incident on the
business, hence IDS is not a recovery control.