What are the best practices for IPS implementation?

BROWSE BY TAG Network Security,   Network Intrusion Prevention (IPS),   Network Intrusion Detection and Analysis,   Enterprise Network Security,   VIEW ALL TAGS

Digg This!     StumbleUpon     Del.icio.us

RELATED CONTENT Network Security How to set up a split-tunnel VPN in Windows Vista What is the difference between static and dynamic network validation? Port scan attack prevention best practices Securing the intranet with remote access VPN security How to prevent network sniffing and eavesdropping How to implement virtual firewalls in a complex network infrastructure How to manage network bandwidth with distributed ISP bandwidth How to edit group policy objects to give a user local admin rights How to prevent operating system cloning with AES 256-bit encryption How to securely connect a LAN POS to a remote point-of-sale device Network Intrusion Prevention (IPS) Aligning network security with business priorities Best Intrusion Prevention and Detection Products Port scan attack prevention best practices Lesson 4: How to use wireless IPS Lesson 1 quiz: Risky business Hacker attack techniques and tactics: Understanding hacking strategies SIMs tools and tactics for business intelligence IPS and IDS deployment strategies I'll be watching you: Wireless IPS Know when you need IDS, IPS or both Network Intrusion Prevention (IPS) Research

RELATED GLOSSARY TERMS Terms from Whatis.com − the technology online dictionary Diffie-Hellman key exchange  (SearchSecurity.com) intrusion prevention  (SearchSecurity.com) network behavior analysis  (SearchSecurity.com)

RELATED RESOURCES 2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems Search Bitpipe.com for the latest white papers and business webcasts Whatis.com, the online computer dictionary

Implementing an intrusion prevention system can be a tricky proposition. While these devices are quickly becoming integral parts of the security infrastructure in many enterprises, rolling one out for the first time can be an intimidating experience. You're not only creating a potential bottleneck and failure point in your network path, but you're also adding a device that has the ability to intentionally disrupt traffic. That's enough to make any network engineer cringe!

Here are some best practices for deploying an IPS in your enterprise:

• Run the IPS in "monitor" mode until it's clear that the system is properly tuned. Configured this way, it's acting more like an intrusion detection system (IDS), identifying potential problems but not blocking the flow of network traffic.
• Keep the number of "block" mode rules to a small, finely tuned set to reduce the possibility of false positive blocks.
• Consider using a fail-open device to limit the effect of a device failure on your network. In the event of an IPS failure, this allows all traffic to continue uninterrupted. While it's a less-secure configuration, it keeps the network up and running, which is something the network infrastructure team will no doubt appreciate.

For more on this topic, read my tip: Network intrusion prevention systems: Should enterprises deploy now?