And since firewalls must keep pace with advances in network attack methods, they require frequent updates. In addition, filters are not foolproof. Hackers can trick them using techniques such as IP spoofing, where one host claims the IP address of another. There are solutions available that can improve a firewall s ability to distinguish suspicious activity from legitimate network usage. But the reality is that even the best firewalls cannot, by themselves, stop all questionable traffic or always tell the difference between an innocent e-mail message and a plot to bring down the network.
Additional security is needed.
Often used in conjunction with a firewall, an IDS monitors network traffic for patterns of activity that could mean trouble, and issues alerts when that activity varies from the norm. The IDS usually works by comparing the data that pass through it to a database of predefined attack signatures corresponding to different ways hackers might launch an attack or even attempt to disguise one. But hackers are always inventing new ways to break in and to avoid attention. Network traffic is both voluminous and unpredictable, even when it is legitimate. The combination results in several false alarms each day from a typical IDS and is the reason close supervision by experienced network managers is needed.