IV. Intrusions and Incident Response............................................................................................. 87

10. Intrusion Detection............................................................................................................ 89

10.1. Defining Intrusion Detection Systems ............................................................... 89

10.2. Host based IDS .................................................................................................. 89

10.3. Network based IDS............................................................................................ 91

11. Incident Response ............................................................................................................. 95

11.1. Defining Incident Response ............................................................................... 95

11.2. Creating an Incident Response Plan .................................................................. 95

11.3. Implementing the Incident Response Plan......................................................... 96

11.4. Investigating the Incident................................................................................... 97

11.5. Restoring and Recovering Resources ................................................................ 99

11.6. Reporting the Incident........................................................................................ 99

V. Appendixes.................................................................................................................................. 101

A. Common Exploits and Attacks ........................................................................................ 103

Index................................................................................................................................................. 107

Colophon.......................................................................................................................................... 111