7

Assume this scenario:

Someone trying to hack a website. Simply put: www.site.com/example.php?=<script>alert(1)</script>

A HIDS would see this attempt in Apache's access log, a NIDS would see this attempt in packet's HTTP section and the WAF in the URL.

If all of them are detecting the attack, why are needed all of them on an infrastructure?

John Deters
  • 33,650
  • 3
  • 57
  • 110
The Illusive Man
  • 10,487
  • 16
  • 56
  • 88

1 Answers1

9

You are correct to think that these three technologies are complementary and will often detect the same issues. However, that in itself is no reason not to use them in layers. One may catch things the other may not. Look at virus scanners - here's an example where only 14% of the 37 scanners attempted found the virus! And that's with the same exact type of protection!

The products you've listed have more variation than comparing virus scanners, and in fact have significant architectural differences. A HIDS will often see things that sailed right past the NIDS because of SSL encryption. A WAF will often have specific signatures for a web application that the NIDS and HIDS won't have. The NIDS will detect network layer attacks that the WAF and HIDS would never notice.

In short, complementary does not mean equal.

gowenfawr
  • 71,975
  • 17
  • 161
  • 198