What is an Intrusion Prevention System (IPS)? – SearchSecurity

An intrusion prevention system (IPS) is a network security and threat prevention tool. The idea behind intrusion prevention is to create a preemptive approach to network security so potential threats can be identified and responded to swiftly. Intrusion prevention systems are thereby used to examine network traffic flows in order to find malicious software and to prevent vulnerability exploits.

An IPS is used to identify malicious activity, record detected threats, report detected threats and take preventative action to stop a threat from doing damage. An IPS tool can be used to continually monitor a network in real time.

Intrusion prevention is a threat detection method that can be utilized in a security environment by system and security administrators. These tools are useful for systems as a prevention action for observed events. In addition, with many potential ways that suspicious activity can occur, it is important to have a plan in place for detecting potential attacks.

An intrusion prevention system is made to expand on the base capabilities found in intrusion detection systems (IDSes).

An intrusion prevention system will work by scanning through all network traffic. To do this, an IPS tool will typically sit right behind a firewall, acting as an additional layer that will observe events for malicious content. In this way, IPS tools are placed in direct communication paths between a system and network, enabling the tool to analyze network traffic.

The following are three common approaches for an IPS tool to protect networks:

If any threats are detected, an IPS tool is typically capable of sending alerts to the administrator, dropping any malicious network packets, and resetting connections by reconfiguring firewalls, repackaging payloads and removing infected attachments from servers.

IPS tools can help fend off denial-of-service (DoS) attacks, distributed denial-of-service (DDoS) attacks, worms, viruses or exploits, such as a zero-day exploit. According to Michael Reed, formerly of Top Layer Networks (acquired by Corero), an effective intrusion prevention system should perform more complex monitoring and analysis, such as watching and responding to traffic patterns, as well as individual packets. "Detection mechanisms can include address matching,HTTP[Hypertext Transfer Protocol] string and substring matching, generic pattern matching, TCP [Transmission Control Protocol] connection analysis, packet anomaly detection, traffic anomaly detection andTCP/UDP[User Datagram Protocol] port matching."

Three types of intrusion prevention systems appear commonly. These types are the following:

In addition, there are other types of IPS tools, including ones that analyze wireless networks. Broadly speaking, however, an intrusion prevention system can be said to include any product or practice used to keep attackers from gaining access to your network, such asfirewalls andantivirus software.

Benefits of intrusion prevention systems include the following:

Disadvantages to intrusion prevention systems include the following:

IDSes are software tools made to detect and monitor network traffic. Both IPS and IDS tools will read network packets and compare their contents with known threats. However, IDS differs in what actions are taken next. An IDS tool will not take any action on its own. An IDS requires a human to analyze results and make decisions on what to do next. This is why IPS is seen as an extension to IDS.

An IDS is designed to monitor a network and to send alerts to administrators if a threat is found. However, an IPS is designed to control network access and to protect a network from harm.

Like anIDS, an IPS will monitor network traffic. However, because anexploitmay be carried out quickly after the attacker gains access, intrusion prevention systems also have the ability to take immediate action, based on a set of rules established by the network administrator. For example, an IPS might drop apacketthat it determines to be malicious and block all further traffic from thatInternet Protocol (IP) addressorport. Legitimate traffic, meanwhile, should be forwarded to the recipient with no apparent disruption or delay of service.

Read the original here:

What is an Intrusion Prevention System (IPS)? - SearchSecurity