This module covers what applications should be there for ensuring security on end point and nework devices for different objectives.
This mudule covers:
- HIDS/HIPS
- Personal Firewall
- Antivirus
- Antispam
- Antispyware
HIDS/HIPS vs NIDS/NIPS
Intrusion detection system IDS
IDS analyze copy of data from network and allow operations to complete as well. IDS is non blocking.
Intrusion prevention system.
IPS is blocking, and is installed inline. Throughput is decreased.
IIDS Characteristics
Software installed on hosts, and audit log files, file system, resources for anomalous behavior.
Personal firewall: is used to block/allow specific programs, services, ports. it is also used to block/allow access to configured IP Addresses, subnets. Examples of Personal firewall are zone alarm, windows firewall.
Antivirus is software used to scan system for viruses.
Antispam, this is normally feature of email server and email client software to check for spam emails.
Antispyware, this is software installed over system to detect spyware.
Zeeshan Sahi's blog 