 |
|
|
| > |
QUESTION POSED ON: 20 May 2008
What are the similarities and the differences between an IDS and an IPS? Can they be used to perform the same functions in a network?
|
|
|
To continue reading for free, register below or login
To read more you must become a member of SearchSecurity.com
Actually, intrusion detection systems and intrusion prevention systems are quite similar in technology, but they perform slightly different functions on the network.
Both IPS and IDS tools are designed to monitor network activity for signs of misuse. There are two basic strategies that they may follow to identify potentially malicious traffic:
systems have databases containing patterns of known malicious activity, similar to those used by antivirus software. They watch all network traffic for any communications that match those patterns and, if they see any matches, trigger an alert.
Anomaly-detection systems monitor the network and build models of normal behavior over a period of time known as the "training period." They then watch the network for activity that deviates from those standards. If the deviation is significant, the anomaly-detection system triggers an alert.
The difference between IPS and IDS systems comes in their handling of alerts. Pure IDS systems simply inform the administrator that suspicious activity took place. IPS systems, on the other hand, have the ability to block the suspicious traffic from entering the network. In fact, the two technologies have already converged for all intents and purposes. Most intrusion detection products have the ability to run in either IPS or IDS mode depending upon the user's configuration.
More information:
There's a good debate taking place right now in the security industry about the proper balance between IPS and IDS in the enterprise. For more, read Network intrusion prevention systems: Should enterprises deploy now?
Get the latest news on intrusion detection and intrusion prevention.
|
|
|
|
|
|
|
|
Search and Browse the Expert Answer Center
Search and browse more than 25,000 question and
answer pairs from more than 250 TechTarget industry experts.
|
|
|
|
|
|
|
|
|
|
|
|
