But the reality is that even the best firewalls cannot, by themselves, stop all questionable traffic or always tell the difference between an innocent e-mail message and a plot to bring down the network. Additional security is needed. Often used in conjunction with a firewall, an IDS monitors network traffic for patterns of activity that could mean trouble, and issues alerts when that activity varies from the norm. The IDS usually works by comparing the data that pass through it to a database of predefined attack signatures corresponding to different ways hackers might launch an attack or even attempt to disguise one. But hackers are always inventing new ways to break in and to avoid attention.
Network traffic is both voluminous and unpredictable, even when it is legitimate.
The combination results in several false alarms each day from a typical IDS and is the reason close supervision by experienced network managers is needed. Its role is to monitor, to alert, and to continue monitoring. It means alerts sometimes are received or interpreted after the fact, sometimes after damage is done. Before the Internet age, organizations wanting to connect with cross-town campuses or affiliated centers would lease dedicated lines to carry broadband traffic between LANs. But making a VPN as secure as a private line takes considerable insight and expertise.