> If an attacker gets through your walls (network access), why do you think you'd stop them at the keep?
This whole analogy is bad, but to work in the context of it, each of the castles defenses is impenetrable (Wolverine went back in time and taught them to make adamantium). The only way to get through is to discover and exploit flaws in the design of the defenses.
If they breach the walls, they still have to find an exploit a flaw in the keep, _before_ you notice they made it through the first wall, rebuild the first wall without the defect and then send your wolverine-knight automatons to clean up the survivors. In this scenario, IDS/IPS systems are your scouts watching for invaders that breach the first wall.
Importantly, the designs of these walls change all the time, so the attackers need a window during which both the keep and the walls have a design flaw. And unless the flaw is in something common to both the keep and walls, it is unlikely to be common to both (OpenSSL is an example of that).
> small attacks aren't worth attention, big attacks are SLOW AND VISIBLE
This is not true of castles nor infosec. A huge enemy force against a well-defended castle meant they likely mean to lay siege and starve them out of the castle. Not a significant concern so long as you have food and water; especially so if your resources would outlast their supply lines.
Small forces on the other hand are exceptionally dangerous, because it's probably a sapper party that's going to try to tunnel under your wall and detonate explosives (or just collapse the tunnel if this is pre-explosives). Sappers are almost infinitely more dangerous. You can see the same pattern repeat in World War I. Trenches with machine guns are nearly impenetrable to attackers, thus No Man's Land. So we went back in time and re-created sappers to dig tunnels under their trenches. Having the other side come over their trenches at you is far less concerning than hearing sappers digging under you.
Infosec is the same way. Port scans and attempted DDoS attacks are common, easily noticed, and unlikely to lead to anything threatening. Your real risk is being targeted. Someone interested in you specifically because of the data you have, or money, or whatever. People that will poke around your stuff in ways that are hard to notice, like analyzing your auth flow for vulnerabilities. Those are your digital sappers. Large DDoS attacks are bad, because they can knock you offline, but it's like a seige. All you have to do is outlast them, at the end of the day you lost some productivity but the castle is still intact. If the sappers get in, you go offline _and_ they'll steal your data.
This whole analogy is bad, but to work in the context of it, each of the castles defenses is impenetrable (Wolverine went back in time and taught them to make adamantium). The only way to get through is to discover and exploit flaws in the design of the defenses.
If they breach the walls, they still have to find an exploit a flaw in the keep, _before_ you notice they made it through the first wall, rebuild the first wall without the defect and then send your wolverine-knight automatons to clean up the survivors. In this scenario, IDS/IPS systems are your scouts watching for invaders that breach the first wall.
Importantly, the designs of these walls change all the time, so the attackers need a window during which both the keep and the walls have a design flaw. And unless the flaw is in something common to both the keep and walls, it is unlikely to be common to both (OpenSSL is an example of that).
> small attacks aren't worth attention, big attacks are SLOW AND VISIBLE
This is not true of castles nor infosec. A huge enemy force against a well-defended castle meant they likely mean to lay siege and starve them out of the castle. Not a significant concern so long as you have food and water; especially so if your resources would outlast their supply lines.
Small forces on the other hand are exceptionally dangerous, because it's probably a sapper party that's going to try to tunnel under your wall and detonate explosives (or just collapse the tunnel if this is pre-explosives). Sappers are almost infinitely more dangerous. You can see the same pattern repeat in World War I. Trenches with machine guns are nearly impenetrable to attackers, thus No Man's Land. So we went back in time and re-created sappers to dig tunnels under their trenches. Having the other side come over their trenches at you is far less concerning than hearing sappers digging under you.
Infosec is the same way. Port scans and attempted DDoS attacks are common, easily noticed, and unlikely to lead to anything threatening. Your real risk is being targeted. Someone interested in you specifically because of the data you have, or money, or whatever. People that will poke around your stuff in ways that are hard to notice, like analyzing your auth flow for vulnerabilities. Those are your digital sappers. Large DDoS attacks are bad, because they can knock you offline, but it's like a seige. All you have to do is outlast them, at the end of the day you lost some productivity but the castle is still intact. If the sappers get in, you go offline _and_ they'll steal your data.