Configuration of the interaction between information security technologies:The case of firewalls and intrusion detection systems

摘要

To study configuration of and interaction between a firewall and intrusion detection systems.In this paper the authors study the configuration of and interaction between a firewall and intrusion detection systems (IDS). It is shown that deploying a technology, whether it is a firewall or IDS, could hurt the firm if the configuration is not optimized for the firm's environment. A serious consequence of deploying the two technologies with suboptimal configurations is that even if the firm could benefit when each is deployed alone, the firm could be hurt by deploying both. Configuring the firewall and the IDS optimally eliminates the conflict between them, ensuring that if the firm benefits from deploying each of these technologies when deployed alone, it will always benefit from deploying both. It is found that while the optimal configuration of an IDS does not change whether it is deployed alone or together with a firewall, the optimal configuration of a firewall has a lower detection rate when it is deployed with an IDS than when deployed alone. Results highlight the complex interactions between firewall and IDS technologies when they are used together in a security architecture, and, hence, the need for proper configuration to benefit from these technologies.