- [Instructor] The term false positive is a broad term
that describes a situation
in which a security device triggers an alarm,
but there's actually no malicious activity
or an actual attack taking place.
So in other words,
actually false positive are basically just false alarms.
And they're also called benign triggers, right?
Now, false positives are very problematic
and this is because by triggering unjustified alerts,
you can actually diminish the value and urgency
of real alerts, right?
So if you have too many false positives to investigate,
it becomes an operational nightmare
and you most definitely will overlook real security events.
There are also false negatives
and a false negative is a term used to describe
a network intrusion
and a device inability to detect true security events
under certain circumstances, in other words,
a malicious activity that is actually not being detected
by a security device, right,
or a security solution or software.
A true positive is a successful identification
of a security attack or a malicious event.
So there's false positives, false negatives,
true positives, and also true negatives
and a true negative is whenever
the intrusion detection device or the security device
identifies an activity as acceptable behavior
and the activity is actually acceptable, right?
So that's actually a true negative.
Now, traditional IDS and traditional IPS devices
need to be tuned
to avoid a lot of false positives and false negatives.
Right?
One of the beauties of next-generation IPS
is actually that they do not need the same level of tuning
as traditional IPS
and you can obtain much deeper reports and functionality,
including things like advanced malware protection
and retrospective analysis
to see what actually happens after an attack took place.
And we cover some of these in previous lessons, right?
Now, traditional IDS and IPS devices
also suffer from many evasion attacks, right?
Here are some of the most common evasion techniques
against traditional IDS and IPS devices.
That includes things like fragmentation,
using low-bandwidth attacks, address spoofing and proxying,
pattern change evasions, and also encryption, right?
Encryption can be problematic, both for evasion
and secondly, of course, to be able to actually analyze
the data within your organization.