Speakers at a recent conference on networking and ID in Santa Clara did not waste time either praising or bashing vendors. They focused instead on coming to grips with failings of ID systems, and examining possible solutions. While ID systems should be an important part of any large organization's security framework, they are no more foolproof than the firewalls that they often augment. Let's examine how ID systems can fail. Some systems are host-based, and monitor system event logs watching for evidence of misuse.
Network based systems sniff network segments also watching for misuse.
What both systems have in common is that they can only detect misuse that appears in the products' databases of attack signatures. New attacks, as well as minor variations on attacks in the signature databases, will not be detected or reported. In this way, most ID systems are like virus scanning software, only as current as the most recent update. Most attacks are variations on past attacks. For example, the Teardrop denial of service attack was quickly followed by more than seven different variations, all different enough to foil IDS recognition, yet all potent enough to crash systems.