Question

An IS auditor is reviewing an organization's network intrusion detection system (IDS). Management is concerned that a recent breach exploited a previously unknown vulnerability that the IDS failed to flag. The IDS currently operates using only a database of known attack patterns. Which of the following recommendations would BEST address management's concern about detecting future novel attacks?

Accepted Answer

Implement anomaly-based (behavioral) detection to identify deviations from normal traffic baselines

Answer

Increase the frequency of signature database updates from the vendor

Answer

Deploy additional signature-based sensors at each network segment boundary

Answer

Tune the existing signatures to reduce the false-positive rate