The only factor that should be considered when selecting an Intrusion Detection System is the criticality of the asset.

• A. True
• B. False
• C. It depends on asset value
• D. Only cost matters

Answer: (B)

Multiple factors influence IDS selection, with asset criticality being important but not sole determinant. You must consider where sensors will be placed (network-based versus host-based), the expected traffic volume and resulting performance impact, and the types of threats you need to detect (signatures, anomalies, or protocol abuse). Also weigh how many false positives you can tolerate, how alerts will be integrated into incident response and your SIEM, and compatibility with existing infrastructure. Practical concerns like maintenance, updates, scalability, licensing, and total cost matter as well. If you focus only on asset value, you risk choosing an IDS that can’t handle the network load, produces overwhelming or missing alerts, or won’t fit into your response workflow.