Question

One of the most obvious places to put an IDS sensor is near the firewall. Where exactly in relation to the firewall is the most productive placement?

(a) Inside the firewall

(b) Outside the firewall

(c) Both inside and outside the firewall

(d) Neither inside the firewall nor outside the firewall.

I had been asked this question in an online interview.

Origin of the question is Intrusion Detection Systems in chapter Point to Point Protocol & Error Detection of Computer Network

Answer 1

Correct option is (a) Inside the firewall

For explanation I would say: There are legitimate political, budgetary and research reasons to want to see all the “attacks” against your connection, but given the care and feeding any IDS requires, do yourself a favor and keep your NIDS sensors on the inside of the firewall.