Intrusion Detection System

The Colt Managed Hosted Intrusion Detection service goes beyond the capabilities of a firewall, offering you the security of watching network traffic and generating alerts when suspicious traffic behaviour is detected.

An Intrusion Detection System (IDS) monitors network traffic, matching traffic to known signatures of bad behaviour and alarms, rather than sitting in-line with the traffic and blocking, which is what a firewall does. The key difference between the two is that an IDS can span multiple packets, spotting suspicious trends in traffic, which a firewall with its more simplistic rules may not pick up.

Managed Hosted Intrusion Detection is provided as an additional service when you take other Managed Services in Colt Data Centres. The service comprises installation, operation and maintenance of dedicated intrusion detection sensor hardware, software and policies, and round-the-clock management and monitoring by the Colt Security Operations Centre (SOC).

The key benefits of Colt Managed Hosted Intrusion Detection include the following:

• Provides best-of-breed solutions that continually evolve with advances in technology to combat increasingly sophisticated threats
• Deliver reduced total cost of ownership of your security solution and provide you with the security expertise and professional processes you may lack in house
• Full lifecycle management ensures high customer service at every stage
• Offers service level agreements (SLAs) that match our customers’ business requirements

The Colt service is based on the ISS Proventia platform. ISS is recognised as a world leader in intrusion detection and is our key partner for delivery of these services.

Each IDS sensor is connected to your network, typically through a network port on a switch that has traffic mirrored to it. Each time a suspicious event, or series of events, is identified, an alarm is created and sent to Colt’s event correlation tool, to be matched against events we are seeing from other devices in your environment and in other customers' environments. This provides us with a very powerful tool that enables suspicious events such as port scans (attempts to search a network host for open ports) to be identified, even when they occur across several customers' environments.

During provisioning of the IDS sensors, tuning of the signatures will be carried out to improve the effectiveness of the alarms and reduce the number of false positives that are generated.

The specific deployment and configuration of IDS systems within your solution will be established during the pre-sales phase with guidance from Colt Professional Services.

Colt offers the Managed Hosted Intrusion Detection service as a dedicated platform for each customer instance. We use a dedicated, secure network for operational management of our customers' intrusion detection solutions in each of our Data Centres.

Any requests you make for intrusion detection rule changes will be vetted by the SOC for viability in relation to your existing rule set and to the environment hosted by Colt. If our experts consider that an additional or unwarranted risk is being taken with the requested change, we will contact you to check the request with you.