Question:
Passive and Active Intrusion Detection
What is the difference between passive and active intrusion detection? I know that the passive intrusion detection will detect and record intrusion attempts, but it does not take action. The active intrusion detection will detect the attacks and send an alert to the network administrator or take action to block the attack. With that said, why would anyone waste their money on even getting the passive intrusion detection if it only records the attacks and takes no action. I really don't understand. What are the pros and cons of passive and active intrusion detection? What are decoys and how are they used in a network?