Key concepts
The guide covers detection principles, the four technology types, combining them with tools such as security information and event management, and product selection.
How it is organized
- Intrusion detection and prevention principles
- Network-based
- Wireless
- Network behavior analysis
- Host-based
- Using multiple technologies together
- Product selection
What a school district should take from it
- Detection tools only help if alerts reach someone who acts on them.
- Many districts get detection through endpoint protection or a managed service rather than separate appliances.
How to use it in your district
- Decide who receives and triages alerts after hours, in-house or contracted.
- Prefer coverage of endpoints and cloud identity before adding network sensors.
- Test that an alert actually reaches the on-call person.
Common misconceptions
- Buying an IDS means the network is monitored.
- Monitoring is the people and process that respond to what the tool reports.
Rubric categories and K12 Cyber Forward tools
Cybersecurity Rubric 2.0 categories
- DE.CMContinuous Monitoring
- DE.AEAdverse Event Analysis
Tools in the program portal
- Incident respondersLine up outside response help before you need it
- P3 Partner NetworkFind vetted help matched to your gaps
Related publications
- SP 800-92Log management
- SP 1800-26Ransomware: detect and respond
Citation and source
SP 800-94, Guide to Intrusion Detection and Prevention Systems (IDPS). National Institute of Standards and Technology. 2007. https://doi.org/10.6028/NIST.SP.800-94.
Topics: Logging and detection, Network security. This summary was written by the K12 Cyber Forward program team in its own words. NIST is not affiliated with the program and has not reviewed it. The official publication on csrc.nist.gov controls.