Detecting and Blocking Attacks
We tested how these IPSes handled some of the most common attacks of the last few years. If a tool missed common attacks that are a year old or older, there's concern about the vendor's underlying approach to defining signatures.

				Why IDS is still in the game
				In 2003, Gartner declared, "IDS is dead," thus predicting its eclipse by IPS by 2005. On the surface, it seemed logical: Why stop at just detecting attacks when you can block them? But the IDS vs. IPS question is far more complex. Does IPS eclipse IDS? We think not, given the very nature of what IPS is trying to do. The philosophy of IDS and IPS collide around the mantra, "To block is ideal, to detect is a must." If you think in terms of a pyramid, policy is on the bottom and governs the overall strategies we employ to secure our networks. Enforcement rides above policy, and at the top of the pyramid, we place audit, where we monitor the network for deviations from policy. In this scheme, IPS clearly falls under policy enforcement, IDS under audit. No matter how strict your policies are and how good your IPS is, we still want to know what gets through, leaving an important role for IDS. IDS signatures tend to be more comprehensive than IPS signatures because they can be applied without fear of dropping legitimate traffic. Because most IPS tools focus on blocking attack patterns, they have to be configured carefully so that they don't inadvertently block legitimate traffic when a false positive occurs. That's likely why many of the IPS tools we tested didn't detect even some of the most common attacks. Furthermore, when we discussed some of the attacks that various vendors allowed through, they noted that unambiguously detecting a given complex attack (particularly recent variants of the RPC-DCOM attack) would seriously lower the performance an inline appliance requires. Thus, some vendors choose to err on the side of merely alerting or even missing more complex attacks rather than slowing traffic. Nonetheless, IPS tools can augment security. Rather than asking if IPS should replace IDS, think about it as an extension of our firewalls, which allow traffic for certain services, blocking all other services, with a default policy of, "Deny all except that which is explicitly allowed." IPS operates on the premise, "Allow everything except traffic that matches a set of attack signatures." Thus, for those specific services that are required to pass through a firewall, the IPS tool can block attack patterns. IPS is not a category killer. IDS provides value for detecting malicious behavior, firewalls allow traffic for required services while blocking all others, and IPS tools help to police this required traffic, blocking many possible attack attempts. -- Ed Skoudis & Mike Poor

We chose to attempt the following four attacks:

• The IIS Unicode exploit, which was originally published in October 2000, launched by hand from our Web browser.
• The Windows RPC-DCOM buffer-overflow attack, which was originally published in July 2003 and later included in the Blaster worm, launched from several versions of Metasploit and Core IMPACT.
• The Windows LSASS buffer-overflow attack, which was originally published in April 2004 and included in the Sasser worm, launched from Metasploit and Core IMPACT.
• The Windows SSL PCT buffer-overflow attack, which was originally published in April 2004, launched from Metasploit.