Intrusion detection and prevention is at the foundation of successful security in-depth. Securing the perimeter requires a solid understanding of these two critical components.

"Security in-depth" is one of the few cybersecurity phrases that has kept its relevance since its introduction. The idea is simple — a threat that evades one defender will be caught by another — but the implementation can be complicated. Two of the related pieces of that implementation are the intrusion detection system (IDS) and the intrusion prevention system (IPS). Getting the most from them will help keep a network as secure as possible.

What makes an IDS/IPS different from a firewall? And what separates an IDS from an IPS? These are common questions that have straightforward answers — in theory. The practice is a bit messier.

A firewall's actions tend to be defined by the wrappers around packets. Firewalls tend to look at source and destination addresses, protocols, and how those "carrier" components fit together and into the rules established by the administrator. The IDS and IPS focus their attention on the contents of the packet, looking for known attacks and misbehaviors, and stopping or repairing the packets based on those signature matches.

As for the difference between an IDS and an IPS, the functional difference is in the name: An IDS is a monitoring device or service, while an IPS actively permits or denies packet passage. A side effect of this difference is that an IDS monitors network traffic via span ports or taps, while an IPS is in-line with the network and, therefore, another potential point of failure for network traffic.

The "bit messier" part of all this comes courtesy of next-generation firewalls (NGFs), unified threat managers (UTMs), and other network protection devices that combine functions and blur lines between different security functions. Regardless of how they are delivered, though, the functions of an IDS/IPS should be part of any network security architecture.

So how do you get the most from your IDS or IPS? The practices listed here are the result of conversations with cybersecurity professionals, conference sessions at industry gatherings, personal experience, and Internet searches. While some practices apply to only one or the other, many apply to both.  

(Image: nali VIA Adobe Stock)

About the Author(s)

Curtis Franklin, Principal Analyst, Omdia

Curtis Franklin Jr. is Principal Analyst at Omdia, focusing on enterprise security management. Previously, he was senior editor of Dark Reading, editor of Light Reading's Security Now, and executive editor, technology, at InformationWeek, where he was also executive producer of InformationWeek's online radio and podcast episodes

Curtis has been writing about technologies and products in computing and networking since the early 1980s. He has been on staff and contributed to technology-industry publications including BYTE, ComputerWorld, CEO, Enterprise Efficiency, ChannelWeb, Network Computing, InfoWorld, PCWorld, Dark Reading, and ITWorld.com on subjects ranging from mobile enterprise computing to enterprise security and wireless networking.

Curtis is the author of thousands of articles, the co-author of five books, and has been a frequent speaker at computer and networking industry conferences across North America and Europe. His most recent books, Cloud Computing: Technologies and Strategies of the Ubiquitous Data Center, and Securing the Cloud: Security Strategies for the Ubiquitous Data Center, with co-author Brian Chee, are published by Taylor and Francis.

When he's not writing, Curtis is a painter, photographer, cook, and multi-instrumentalist musician. He is active in running, amateur radio (KG4GWA), the MakerFX maker space in Orlando, FL, and is a certified Florida Master Naturalist.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights