Tactical Operations and Strategic Intelligence: Sensor Purpose and Placement
Todd Heberlein · 2002
This paper is motivated by discussions with a number of people over where to place network-based intrusion detection sensors. The answer depended what you wanted to do with the sensor information. This lead to an examination of three types of activities that use intrusion detection sensors: (1) tactical operations, (2) aggregated tactical operations, and (3) strategic intelligence. We examine several steps that a site can take to optimize a sensor’s use in tactical operations. We briefly look at the outsourcing of tactical operations; although, we limit the amount of discussion because we believe the value of such activities is limited. Finally, we look at using sensor grids to develop strategic intelligence. As this role is perhaps the least understood of all the uses of intrusion detection sensors, we spend considerable time fleshing out some of the concepts.