In order to protect information, organizations need to change the way they think. Administrators need to stop thinking that the firewall, IPS, IDS, and antivirus suites will be able to protect their system from all types of cyber threats. Most traditional security detection models are old and outdated and even they cannot differentiate between malware and regular network traffic. An organization's data security programs can ideally stop a majority of known threats. However, there are many unknown, evil threats that an organization aims to detect and has not encountered before. This can be a result of brand new methods and technologies.
Network intrusion detection systems themselves are not perfect, and are always bombarded with both false positive and false negative notifications and warnings. Consequently, any threat detection system needs both a human element and a technical element. The human element may come in with security analysts who analyze...