An intrusion prevention system (IPS) stops attacks against systems and networks by blocking unwanted actions, serving as an inline alarm system beyond firewall perimeter defenses. An IPS is not a replacement for other security measures and requires ongoing maintenance. A host-based IPS (HIPS) can stop common and unknown attacks by learning system behaviors and trapping dangerous system calls, providing defense for workstations. A network-based IPS (NIPS) is deployed at the network perimeter in front of and behind firewalls, able to block attacks inline but potentially causing bottlenecks. Both NIDS and NIPS are needed for comprehensive protection, with NIPS blocking threats and NIDS providing passive detection.

1. INTRUSION PREVENTION
SYSTEMS

2. WHAT IS AN IPS?
IPS stops attacks against a system or network:
 Firewalls are the perimeter defense that keeps most of the malicious traffic out
 Ex. Lock on your house
 IPS is an inline alarm system that can block unwanted actions.
Rapidly Maturing Technology

3. WHAT AN IDS IS NOT?
Not a replacement for firewalls, strong policies, system hardening,
timely patching, and other defense-in-depth techniques
Not a low maintenance tool
Not an inexpensive tool
Not a silver bullet

4. HIPS OVERVIEW
Can stop common attack techniques, known and unknown
 Unknown – Learns behaviors of the system
 Anomaly analysis techniques
 Can assist in halting 0-day attacks
Traps system calls that are marked as dangerous
 System call interception
 Application Behavior Monitoring
Uses a combination of file integrity monitoring, network monitoring, and
application behavior monitoring.
 Can buy more time in the patch management race
 Provides a better defense for workstations with expanding network perimeter.
 It is the last line of defense

5. NIPS OVERVIEW
Deployed at the perimeter in front and/or behind the firewall
NIPS vs. NIDS is not what it does but where it is
 Inline vs. Passive
 NIPS can not see the network when compromised b/c inline vs passive.
However it can tie down your network since it is inline
 Bottlenecking
Question: Why do you need both a NIDS and a NIPS?
Correlates OS and vulnerability data with identified attacks
Supports network learning