2 cissp ® Official Study Guide Eighth Edition

Active Response
Active responses can modify the environment using several different 
methods. Typical responses include modifying ACLs to block traffi c based on ports, proto-
cols, and source addresses, and even disabling all communications over specifi c cable seg-
ments. For example, if an IDS detects a SYN fl ood attack from a single IP address, the IDS 
can change the ACL to block all traffi c from this IP address. Similarly, if the IDS detects a 
ping fl ood attack from multiple IP addresses, it can change the ACL to block all ICMP traf-
fi c. An IDS can also block access to resources for suspicious or ill-behaved users. Security 
administrators confi gure these active responses in advance and can tweak them based on 
changing needs in the environment. 
An IDS that uses an active response is sometimes referred to as an IPS 
(intrusion prevention system). This is accurate in some situations. However, 
an IPS (described later in this section) is placed in line with the traffic. If an 
active IDS is placed in line with the traffic, it is an IPS. If it is not placed in line 
with the traffic, it isn’t a true IPS because it can only respond to the attack 
after it has detected an attack in progress. NIST SP 800-94 recommends 
placing all active IDSs in line with the traffic so that they function as IPSs.

---

760
Chapter 17 
■
Preventing and Responding to Incidents
Host- and Network-Based IDSs
IDS types are commonly classified as host based and network based. A 
host-based IDS 
(HIDS)
monitors a single computer or host. A 
network-based IDS (NIDS)
monitors a
network by observing network traffic patterns.
A less-used classification is an application-based IDS, which is a specific type of net-
work-based IDS. It monitors specific application traffic between two or more servers. For 
example, an application-based IDS can monitor traffic between a web server and a data-
base server looking for suspicious activity.