Guide to Intrusion Detection and Prevention Systems (IDPS)

Scarfone, Karen; Mell, Peter

doi:https://doi.org/10.6028/NIST.SP.800-94

SP 800-94

Guide to Intrusion Detection and Prevention Systems (IDPS)

Documentation Topics

Date Published: February 2007

Supersedes: SP 800-31 (11/01/2001)

Planning Note (7/15/2022):

In 2012, NIST released Draft SP 800-94 Revision 1 for public comment. That draft never became a final publication and has been retired.

The inputs and comments on the retired draft were no longer applicable to the relevant technologies or threat models. NIST will announce when it initiates work to provide new guidance for IDS/IPS. You can subscribe to NIST's GovDelivery email alerts to be notified when NIST publications are published as final or posted as drafts for public comment.

Author(s)

Karen Scarfone (NIST), Peter Mell (NIST)

Abstract

The National Institute of Standards and Technology (NIST) developed this document in furtherance of its statutory responsibilities under the Federal Information Security Management Act (FISMA) of 2002, Public Law 107-347. This publication seeks to assist organizations in understanding intrusion detection system (IDS) and intrusion prevention system (IPS) technologies and in designing, implementing, configuring, securing, monitoring, and maintaining intrusion detection and prevention systems (IDPS). It provides practical, real-world guidance for each of four classes of IDPS: network-based, wireless, network behavior analysis software, and host-based. The publication also provides an overview of complementary technologies that can detect intrusions, such as security information and event management software. It focuses on enterprise IDPS, but most of the information in the publication is also applicable to standalone and small-scale IDPS deployments.

Keywords

FISMA; intrusion detection; intrusion detection and prevention; intrusion prevention

Control Families

Audit and Accountability; Incident Response; Planning

Documentation

Publication:
SP 800-94 (DOI)
Local Download

Supplemental Material:
None available

Document History:
02/20/07: SP 800-94 (Final)

Topics

Security and Privacy
audit & accountability; incident response; intrusion detection & prevention; planning

Applications
forensics

Laws and Regulations
E-Government Act; Federal Information Security Modernization Act; Homeland Security Presidential Directive 12; Homeland Security Presidential Directive 7; OMB Circular A-130