Dictionary · Defensive Security
IPS
IPS — Intrusion Prevention System
Detection · Intermediate
A system placed in the traffic path that can block activity matching a prevention rule, in addition to alerting. A bad rule can block legitimate work.
Unlike a detector that only watches a copy of the traffic, this one sits in the path and can drop matching packets. Teams start in alert-only mode so a noisy rule does not become an outage.
Picture it
An inline device can block a matching pattern. A noisy rule can also block legitimate work, so teams often tune it in alert-only mode first.
Example: After a signature is tuned, an inline device drops a known malicious pattern and still allows the company's normal file transfer.
Common misconception
- Prevention is not free. A poorly tuned rule can block a business application.