3. Implement intrusion detection and prevention systems

To detect abnormal activity, an IDS (Intrusion Detection System) can be used to record suspicious activity, as well as successful and unsuccessful intrusion attempts.

Two main systems exist, detecting either network intrusions or host computer intrusions. They are used to detect anomalies. A host computer is any computer connected to a computer network, and intrusions occur either on networks or on computers.

To take preventive measures and limit the impact of attacks, an active IDS is used. This is known as HIPS (Host-based Intrusion Prevention System), which monitors workstations, processes, drivers or the server.

Network Intrusion Prevention Systems (NIPS) are used to monitor network intrusions. KIPS (Kernel Intrusion Prevention System) also exist, but are less widely used.

Unfortunately,...