Encrypting traffic
Most organizations would deploy an IPS to proactively monitor inbound and outbound traffic, paying particular attention to any malicious traffic in native or other types of security threats.
One technique to evade IPS and anti malware systems is by using encryption. Most firewalls are unable to detect malware within an encrypted packet by default. However, the Next-Generations firewall, has a feature called Deep-packet Inspection (DPI), which usually unpackages the contents of each packet, and scans and analyzes it. If no threats are detected, it repackages and sends off the packet to its destination. If a threat is detected, the firewall will quarantine it and send an alert on its management console interface and any other logging system.
Additionally, most IPSes do not have the capabilities to decrypt a message to view its contents. This would allow an attacker to encrypt the malicious payload and pass it through the IPS appliance without being detected. The following...
