Q

What are the best practices for IPS implementation?

Implementing an intrusion prevention system can be a tricky proposition. Network expert Mike Chapple explains some common IPS deployment challenges.

I want to implement an IPS. What are the top best practices that I should follow?

Implementing an intrusion prevention system can be a tricky proposition. While these devices are quickly becoming integral parts of the security infrastructure in many enterprises, rolling one out for the first time can be an intimidating experience. You're not only creating a potential bottleneck and failure point in your network path, but you're also adding a device that has the ability to intentionally disrupt traffic. That's enough to make any network engineer cringe!

Here are some best practices for deploying an IPS in your enterprise:

  • Run the IPS in "monitor" mode until it's clear that the system is properly tuned. Configured this way, it's acting more like an intrusion detection system (IDS), identifying potential problems but not blocking the flow of network traffic.
  • Keep the number of "block" mode rules to a small, finely tuned set to reduce the possibility of false positive blocks.
  • Consider using a fail-open device to limit the effect of a device failure on your network. In the event of an IPS failure, this allows all traffic to continue uninterrupted. While it's a less-secure configuration, it keeps the network up and running, which is something the network infrastructure team will no doubt appreciate.

For more on this topic, read my tip: Network intrusion prevention systems: Should enterprises deploy now?

This was first published in April 2009

Dig deeper on Network Intrusion Prevention (IPS)

Pro+

Features

Enjoy the benefits of Pro+ membership, learn more and join.

Have a question for an expert?

Please add a title for your question

Get answers from a TechTarget expert on whatever's puzzling you.

You will be able to add details on the next page.

0 comments

Oldest 

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

-ADS BY GOOGLE

SearchCloudSecurity

SearchNetworking

SearchCIO

SearchConsumerization

SearchEnterpriseDesktop

SearchCloudComputing

ComputerWeekly

Close