What Role For Intrusion Prevention?

The network intrusion prevention system isn't like the firewall--it's not a must-have security tool at most big companies. But intrusion prevention system (IPS) vendors are adding features and integrating the systems more tightly into security infrastructure. And they might be about to get a big boost--from the federal government.

The U.S. Department of Homeland Security is testing an IPS called Einstein 3 that eventually could be deployed across executive-branch civilian networks. If an IPS got the implicit blessing of Homeland Security, it could help win over security specialists who doubt that the systems will take hold in big companies.

Ask a penetration tester what they worry about when breaking into a remote network, and they'll say "firewall," says Thomas Ptacek, of Matasano Security. "I'd be surprised if they say 'IPS' at all."

Still, the IPS is sharing traffic attack data with the firewall and gaining virtualization features, horsepower, and other enhancements to become more application-aware, as well as to help secure client machines.

Companies are more likely to have an intrusion detection (IDS) system, which spits out alarms if something looks amiss but doesn't take action on them, as an IPS does. The IDS is less invasive to the network.

Vendors are trying to overcome the IPS barriers. Virtual IPS and support for virtualized environments are popping up. Like firewalls, IPSes are starting to recognize application services. The next generation of IPSes will do more to protect against client-side attacks--including having SSL inspection to look inside HTTPS traffic and to inspect IPv6 traffic, says Pentti Lehtinen, technical architect at security vendor Stonesoft.

The cloud is beginning to play a part. Econet's Sentinel IPS runs outside the firewall, and Econet is gathering threat and attack intelligence from customers, like antivirus vendors do, to spot new threats more quickly. One county government security officer notes that, with the cloud setup, attack traffic "doesn't even get to my firewall, so the amount of work for my firewall goes way down."

--Kelly Jackson Higgins ([email protected])

'Very Effective' Security Technologies

50% Firewalls

31% Intrusion prevention and detection

28% Strong passwords

Data: InformationWeek Analytics Strategic Security Survey, April 2010