Intrusion Detection Systems (IDS) vs Intrusion Prevention Systems (IPS): What’s What?

An Intrusion Detection System (IDS) and Intrusion Prevention System (IPS) have very similar acronyms by which they are commonly known, yet they perform very different tasks within the network security process. So what exactly do they do, how do they do it, and does your organization need either, neither, or both as part of your overall security posture?

Intrusion Detection System 101

Definitions are important in the security world—you have to understand what you are dealing with before you can accurately determine if it’s a good fit for the needs of your organization. So what exactly is an Intrusion Detection System (IDS)? Simply put, an IDS can be either a hardware device or software application that monitors network traffic, incoming and outbound, for any malicious activity or security policy violation. Think of it as an intruder alarm, sounding an alert if it spots any activity that could lead to network and data compromise. It does this by inspecting the packets that flow across the network in order to detect known indicators of compromise and traffic patterns that suggest suspicious activity. In other words, an IDS is a passive system used to bring real-time visibility into potential network compromises.

How the IDS achieves this will depend on the type of system being deployed. They can be either network based, or host based. Network-based Intrusion Detection Systems (NIDS) will have sensors strategically placed within the network itself, sometimes at multiple locations, to monitor the most traffic without creating performance bottlenecks. Host-based Intrusion Detection Systems (HIDS) do things differently, and are run on specific hosts or devices, only monitoring the traffic associated with them. Either type can take different approaches to detecting suspicious traffic. Some might use signature detection, comparing packets against a database of known threats. Some might use an anomaly-based approach, comparing traffic patterns against an established network “normality” baseline. Some will combine both methods. All are known for generating false positives, at least initially. The IDS will need configuration to fine-tune it for the particular “norms” of your network and the devices attached to it.

Intrusion Prevention System 101

An Intrusion Prevention System (IPS) is like an IDS on steroids. Not only can it detect the same kind of malicious activity and policy violation that an IDS does, but as the name suggests it can execute a real-time response to stop an immediate threat to your network. Like an IDS, the IPS can be NIPS-based with sensors at various points of the network or HIPS-based with sensors on the host to monitor individual devices. Unlike the IDS, an IPS has the ability to configure policy-based rules and actions to be executed when any anomaly is detected. Think of it as being an active defense system, tailored to best suit your business needs in terms of security posture.

Although often considered a firewall, this is an erroneous assumption about an IPS. If anything, an IPS is a firewall in reverse: The firewall applies a rule-set to allow traffic to flow; an IPS applies a rule-set to deny and drop traffic. That said, there are Unified Threat Management (UTM) devices, which do both and therefore act as firewall and IPS simultaneously. These might appear to offer the best of both worlds, in that they can actively allow “good” traffic while also blocking known “bad” traffic.  However, UTMs can be hard to manage optimally, and tend not to enable the same granularity of control over IPS protections as a stand-alone IPS can offer.

Which do you need?

Now you know the differences between an IDS and IPS, which does your organization need as part of its network security implementation? Truth be told, the stand-alone IDS has pretty much been replaced by the IPS as far as the IT security industry is concerned. That’s not to say intrusion detection is a busted flush, but rather that detection has to be accompanied by prevention technologies in today’s increasingly frantic threat climate. For most organizations, the notion of administering an IDS as a separate solution alongside other reactive solutions makes little sense. What makes more sense is to adopt a layered approach to detection and prevention while working with a managed service provider (MSP) able to make better sense of the complexities of the security function and respond to alerts more effectively.

Davey has been writing about IT security for more than two decades, and is a three times winner of the BT Information Security Journalist of the Year title. An ex-hacker turned security consultant and journalist, Davey was given the prestigious ‘Enigma’ award for his ‘lifetime contribution’ to information security journalism in 2011. 

You can follow Davey on Twitter at @happygeek