Detection

• Firewalls

  • Sees most/all traffic

  • Ingress filtering – blocks inbound attacks

  • Egress filtering – helps contain damage

  • Limited attack detection

  • Limited logging