IDS/IPS
IDS/IPS are systems that monitor network traffic (or host activity) for patterns indicating an attack. An IDS (Intrusion Detection System) only reports suspicious activity; an IPS (Intrusion Prevention System) sits inline and can block it immediately.
Term
description · examples · notesIDS/IPS are systems that monitor network traffic (or host activity) for patterns indicating an attack. An IDS (Intrusion Detection System) only reports suspicious activity; an IPS (Intrusion Prevention System) sits inline and can block it immediately.
Description
Detection relies on two approaches: signatures of known attacks (fast and reliable for what has been seen before) and anomaly analysis of deviations from normal behavior (catches novel activity but with more false positives). Serious deployments combine both.
IDS/IPS is worth exactly as much as the attention paid to what it reports. A system generating alerts no one reads is noise, not defense; signatures must be maintained and rules tuned to the specific network.
What people often say
- The IPS is on, so attacks are blocked.
- IDS/IPS replaces the firewall (or vice versa).
Covers / does not cover
Covers
- Detecting known attack patterns in network traffic
- Real-time blocking of attacks (IPS, inline)
- Recognizing deviations from normal network behavior
- Visibility into traffic that already passed the perimeter
Does not cover
- Encrypted traffic without inspection (an increasing share of all traffic)
- Attacks that look like legitimate activity (e.g. abuse of valid accounts)
- Activity confined to the endpoint with no network trace (that is EDR's domain)
Mentioned in the news
Threats
reduces 8Threats it reduces. Select one to open its page.
Techniques
neutralizes 7Techniques it neutralizes. Select one to open its page.