Detect and report additions, deletions or changes to the system outside specified boundaries. Identify affected systems and altered files to focus recovery efforts where they are needed, without shutting down the entire network. Good IDS software uses algorithms to scan the contents of files on a system, and can detect changes to sabotaged files, even if hackers cover their tracks. Create a post-attack database for affected systems after an intrusion and before system recovery, which can be used as evidence in court. Monitor workstations across the enterprise as part of a well-designed security policy, ensuring that neither malicious software, individual computers or uninformed users subject the system to intrusions.
Attackers often change system configurations to mask viruses.
Scan copied or downloaded files to ensure no changes occurred during transfer, and monitor software installations to verify that a program has been configured correctly.