Intrusion prevention system
An intrusion prevention system (IPS) uses the same concept as an IDS, but, as the name says, it prevents the intrusion by taking corrective action. This action will be customized by the IPS administrator in partnership with the Blue Team.
In the same way IDS is available for hosts (HIDS) and network (NIDS), IPS is also available for both, as HIPS and NIPS. The NIPS placement within your network is critical and the same guidelines that were previously mentioned are applicable here. You should also consider placing the NIPS inline with traffic in order to be able to take corrective action. IPS and IDS detections can usually operate in one or both of the following modes:
- Rule-based
- Anomaly-based
Rule-based detection
While operating this mode, the IPS will compare the traffic with a set of rules and try to verify whether the traffic matches the rule. This is very useful when you need to deploy a new rule to block an attempt...
