Skip to main content
SolarWinds MSP
  • Login
  • Support
  • Partnerships
    • Partnerships Overview
    • Solution Provider Program
    • Technology Alliance Program
    • Distributor Program
SolarWinds MSP
  • Products
    • SolarWinds N-central Automate what you need. Tackle complex networks. Try this remote monitoring and management solution built to help maximize efficiency and scale.
    • SolarWinds RMM Start fast. Grow at your own pace. Try this powerful but simple remote monitoring and management solution.
    • SolarWinds EDR Defend against ransomware, zero-day attacks, and evolving online threats with Endpoint Detection and Response
    • SolarWinds Backup Manage data protection for servers, workstations applications, documents and Microsoft 365 from one SaaS dashboard.
    • Mail Protection & Archiving Protect users from email threats and downtime.
    • Password Management Easily adopt and demonstrate best practice password and documentation management workflows.
      • Passportal Demo
    • PSA & Ticketing Manage ticketing, reporting, and billing to increase helpdesk efficiency.
    • Remote Support Help support customers and their devices with remote support tools designed to be fast and powerful.
  • Solutions

    I'm looking for...

    • Security Solutions
    • Monitoring Solutions
    • Efficiency Solutions
  • Resources
    • Blog
    • Webcasts & Events
    • Ask the N-central Experts
    • Daily Live Demos
    • RMM Foundations Training
    • Upcoming Events
    • Upcoming Webcasts
    • Resource Center
    • COVID-19 Resources
    • Resource Library
      • Case Studies
      • Product Information
      • eBooks
      • White Papers
      • Infographics
    • SolarWinds MSP Free Tools
    • GDPR Resource Center
    • Security Resource Center
    • MSP Institute Webinar Series
    • MSP Advice Project
  • About
    • Contact
    • Customer Success
    • Worldwide sales and support
    • Careers
    • Awards and Recognition
    • Get A Quote
    • Newsroom
      • Press Releases
      • In The News
      • Media Contacts
      • COVID-19 Response
    • Leadership Team
    • Legal
      • Cookie Policy
      • Privacy Notice
      • Software Services Agreement
      • Terms of Use
      • Backup Fair Use Policy
    • Security
      • SolarWinds Security Statement
      • Vendor Data Protection Requirements
    • Support
  • IT Departments
  • Contact Sales
    • Get A Quote
    • General Inquiry
  • TRY NOW
    • SolarWinds RMM
    • SolarWinds Backup
    • MSP Manager
    • SolarWinds Passportal
    • SolarWinds N-central
    • SolarWinds Mail Assure
    • SolarWinds Risk Intelligence
    • SolarWinds Take Control
  • Request a Quote
  • Try Now
    • SolarWinds RMM
    • SolarWinds N-central
    • SolarWinds Backup
    • MSP Manager
    • SolarWinds Mail Assure
    • SolarWinds Passportal
    • SolarWinds Risk Intelligence
    • SolarWinds Take Control
Request quote
Filter Blogs
  • Filter by:
  • MSP Business
    • Automation
    • Backup & Disaster Recovery
    • Security-series
    • Best Practices
    • Business
    • Business Growth
    • Business Risk
    • Cloud Computing
    • Customer Service
    • Cybersecurity
    • Cybersecurity Awareness Month
    • Data
    • GDPR
    • Internet of Things
    • IT Support
    • ITSM
    • LOGICcards
    • Machine Learning
    • Mail
    • Managed Services
    • Marketing
    • Mobile
    • Networking
    • Operations
    • Podcast
    • Product
    • PSA
    • Remote Management
    • Research & Trends
    • Risk Intelligence
    • Security
    • Security Vlog
    • Service Desk
    • Services & Support
    • The Head Nerds
    • Tips & Advice
    • Training
Home Blog MSP Business Security Intrusion Detection Systems (IDS) vs Intrusion Prevention Systems (IPS): What’s What?
Security

Intrusion Detection Systems (IDS) vs Intrusion Prevention Systems (IPS): What’s What?

By Davey Winder
15 August, 2018

An Intrusion Detection System (IDS) and Intrusion Prevention System (IPS) have very similar acronyms by which they are commonly known, yet they perform very different tasks within the network security process. So what exactly do they do, how do they do it, and does your organization need either, neither, or both as part of your overall security posture?

Intrusion Detection System 101

Body_IDS.jpgDefinitions are important in the security world—you have to understand what you are dealing with before you can accurately determine if it's a good fit for the needs of your organization. So what exactly is an Intrusion Detection System (IDS)? Simply put, an IDS can be either a hardware device or software application that monitors network traffic, incoming and outbound, for any malicious activity or security policy violation. Think of it as an intruder alarm, sounding an alert if it spots any activity that could lead to network and data compromise. It does this by inspecting the packets that flow across the network in order to detect known indicators of compromise and traffic patterns that suggest suspicious activity. In other words, an IDS is a passive system used to bring real-time visibility into potential network compromises.

How the IDS achieves this will depend on the type of system being deployed. They can be either network based, or host based. Network-based Intrusion Detection Systems (NIDS) will have sensors strategically placed within the network itself, sometimes at multiple locations, to monitor the most traffic without creating performance bottlenecks. Host-based Intrusion Detection Systems (HIDS) do things differently, and are run on specific hosts or devices, only monitoring the traffic associated with them. Either type can take different approaches to detecting suspicious traffic. Some might use signature detection, comparing packets against a database of known threats. Some might use an anomaly-based approach, comparing traffic patterns against an established network “normality” baseline. Some will combine both methods. All are known for generating false positives, at least initially. The IDS will need configuration to fine-tune it for the particular “norms” of your network and the devices attached to it.

Intrusion Prevention System 101

Body_IPS.jpgAn Intrusion Prevention System (IPS) is like an IDS on steroids. Not only can it detect the same kind of malicious activity and policy violation that an IDS does, but as the name suggests it can execute a real-time response to stop an immediate threat to your network. Like an IDS, the IPS can be NIPS-based with sensors at various points of the network or HIPS-based with sensors on the host to monitor individual devices. Unlike the IDS, an IPS has the ability to configure policy-based rules and actions to be executed when any anomaly is detected. Think of it as being an active defense system, tailored to best suit your business needs in terms of security posture. 

Although often considered a firewall, this is an erroneous assumption about an IPS. If anything, an IPS is a firewall in reverse: The firewall applies a rule-set to allow traffic to flow; an IPS applies a rule-set to deny and drop traffic. That said, there are Unified Threat Management (UTM) devices, which do both and therefore act as firewall and IPS simultaneously. These might appear to offer the best of both worlds, in that they can actively allow “good” traffic while also blocking known “bad” traffic.  However, UTMs can be hard to manage optimally, and tend not to enable the same granularity of control over IPS protections as a stand-alone IPS can offer.

Which do you need?

Now you know the differences between an IDS and IPS, which does your organization need as part of its network security implementation? Truth be told, the stand-alone IDS has pretty much been replaced by the IPS as far as the IT security industry is concerned. That's not to say intrusion detection is a busted flush, but rather that detection has to be accompanied by prevention technologies in today’s increasingly frantic threat climate. For most organizations, the notion of administering an IDS as a separate solution alongside other reactive solutions makes little sense. What makes more sense is to adopt a layered approach to detection and prevention while working with a managed service provider (MSP) able to make better sense of the complexities of the security function and respond to alerts more effectively.

 

Additional reading:

  • How to Protect Your Customers Against the Rising Tide of Malvertising
  • MSPs: How to get your customers’ buy-in for cybersecurity
  • MSP Data Breach 101: 4 things you need to know about data security
  • Security: Why Social Media Is a Weak Point for Security
  • Are companies spending their IT Security Budget on the wrong things?

 

Davey has been writing about IT security for more than two decades, and is a three times winner of the BT Information Security Journalist of the Year title. An ex-hacker turned security consultant and journalist, Davey was given the prestigious 'Enigma' award for his 'lifetime contribution' to information security journalism in 2011. 

You can follow Davey on Twitter at @happygeek

 

© 2018 SolarWinds MSP Canada ULC and SolarWinds MSP UK Ltd.  All rights reserved.

 
The SolarWinds and SolarWinds MSP trademarks, service marks, and logos are the exclusive property of SolarWinds MSP UK Ltd. or its affiliates. All other trademarks are the property of their respective owners.

You might also like...
Automation

What the Head Nerds Were Up to in 2020

Security

January 2021 Patch Tuesday: One Actively Exploited Vulnerability and a Few Likely to Be

Security

December 2020 Patch Tuesday—A quiet(er) finish to a busy year in vulnerabilities

Security

Documentation Management API and Why It’s Important for the MSP Business

Security

What Is FIPS-140-2 Standard and When Is It Required?

Security

Malware-as-a-Service: A Crucial Reason Why Security Has Grown More Complex

Want to stay up to date?

Get the latest MSP tips, tricks, and ideas sent to your inbox each week.

Loading form....

If the form does not load in a few seconds, it is probably because your browser is using Tracking Protection. This is either an Ad Blocker plug-in or your browser is in private mode. Please allow tracking on this page to request a subscription.

Note: Firefox users may see a shield icon to the left of the URL in the address bar. Click on this to disable tracking protection for this session/site

Recent Posts
  • What the Head Nerds Were Up to in 2020
  • RMM and PSA Tools: How to Make the Most of Both
  • How to Empower an IT Help Desk Team for Success
  • Six Tips That Will Make Managing Your MSP Company Easier
  • January 2021 Patch Tuesday: One Actively Exploited Vulnerability and a Few Likely to Be
Categories:
  • Security (230)
  • Tips & Advice (122)
  • Best Practices (94)
  • Managed Services (86)
  • Backup & Disaster Recovery (83)
  • The Head Nerds (75)
  • Business Growth (75)
  • IT Support (42)
  • Business (39)
  • Automation (37)
  • Cybersecurity (37)
  • Operations (34)
  • Mail (33)
  • Remote Management (28)
  • ITSM (25)
  • Cloud Computing (21)
  • Networking (21)
  • Data (21)
  • Marketing (14)
  • Product (11)
  • PSA (11)
  • Service Desk (5)
  • Services & Support (5)
  • Mobile (4)
  • Risk Intelligence (4)
  • Customer Service (3)
  • Internet of Things (3)
  • GDPR (2)
  • Research & Trends (2)
  • Training (2)
  • LOGICcards (1)
  • Business Risk (1)
Show moreless
SolarWinds MSP

Products
  • SolarWinds RMM
  • SolarWinds N-central
  • SolarWinds Backup
  • SolarWinds EDR
  • SolarWinds MSP Manager
  • SolarWinds Mail Assure
  • SolarWinds Risk Intelligence
  • SolarWinds Take Control
  • SolarWinds Passportal
  • All Products Use Cases
Solutions
  • Security Solutions
  • Monitoring Solutions
  • Efficiency Solutions
  • Identify which RMM solution is right for me
  • Drive Efficiency with Automation
  • Manage my MSP Business More Efficiently
  • Manage my IT Department More Efficiently
  • Layered Security
  • Cross-Platform Support
  • Data-Driven Insights
About
  • About Us
  • Careers
  • Newsroom
  • Leadership Team
  • Upcoming Events
  • Subscription Preferences
  • SolarWinds
  • SolarWinds Trust Center
  • COVID-19 Response
Support
  • SolarWinds RMM
  • Solarwinds N-central
  • SolarWinds Backup
  • SolarWinds Mail Assure
  • SolarWinds Take Control
  • SolarWinds MSP Manager
  • Solarwinds Risk Intelligence
  • Solarwinds Threat Monitor
  • SolarWinds Passportal
  • SolarWinds Take Control Downloads
  • Backup & Recovery Downloads
  • Service Status

Footer 2

  • Legal Documents
  • Privacy
  • California Privacy Rights
  • Security Information
  • Sitemap

© SolarWinds MSP Canada ULC and SolarWinds MSP UK Ltd.
All Rights Reserved.