Discussion 1

Intrusion detection methods depend on the following assumption: that the behavior of an intruder differs measurably from the behavior of a legitimate user. The two methods you learned about for detecting intrusions, statistical anomaly detection and rule-based detection, differ fundamentally in their approach to distinguishing between intruders and legitimate users.

For this Discussion, create and describe a scenario of a set of computer systems and how they are used within a particular organization. Explain how successful each of the detection methods above would be in detecting an intrusion in that scenario. Do you think either one would be able to detect an intrusion in time to prevent the intruder from doing anything malicious? Why or why not?

Discussion 2

Networking monitoring tools allow system administrators the ability to analyze network performance, pinpoints failed network components, send notifications of system outages, and monitors for security issues. There are a large variety of network monitoring tools available commercially and free.

For this discussion read the article “The Top 20 Free Network Monitoring and Analysis Tools for Sys Admins”. Also search Walden University library and the internet for network monitoring tools. Pick two of the network monitoring tools and write a comparison of the features offered in those tools. Specify which tool you feel has the best features.