IDS VS. IPS: WHAT ARE THE DIFFERENCES, AND DO YOU NEED BOTH?
Define two foundational security concepts—Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS)— and learn how network evidence supports both.
Defining IDS and IPS systems
Intrusion detection systems (IDS) and intrusion prevention systems (IPS) are cybersecurity tools that can alert security teams to possible intrusions in company systems. Intrusion prevention and detection is sometimes referred to as two parts of a single system (IDPS). However, historically, many organizations have deployed one or the other or consider IDS vs. IPS separate but mutually reinforcing functions.
IDS and IPS can operate on hosts (HIDS and HIPS, respectively) or the network (NIDS and NIPS). The earliest IDS applications date back to the 1990s; IPS functionality emerged as organizations looked for automated methods to block malicious activity instead of simply alerting their security teams to its existence.
Processes, applications, and tools that deliver IDS and IPS functionality are common in many organizations. Each tool type has incorporated more automation and machine learning over time. However, many organizations gain detection and prevention capabilities from other technologies in their security stack and may consider replacing legacy IPS and IDS to reduce tool sprawl and modernize their security posture.
Other combinations of security solutions can deliver the detection and response capabilities of IDS, IPS, or IDPS. Some platforms, such as Network Detection and Response (NDR) and Endpoint Detection and Response (EDR), can provide robust IDS or IPS capabilities or enrich these systems with contextualized data, threat analytics, and deeper visibility into networks and endpoints.
What is an intrusion detection system (IDS)?
An IDS is a passive monitor of the network. It sits out of band (not directly in the network path) and relies on a TAP or SPAN port to copy network traffic in real time. Monitored traffic is analyzed against a database of attack signature sets; when it identifies potential traffic that matches a signature, the IDS system fires an alert or generates log data that prompts the SOC to investigate further.
Signature-based detections can be augmented by anomaly-based detections, which are the product of ML-assisted models that analyze traffic against models of normal network traffic to surface unusual activity patterns.
Modern IDS often combine these detection methods to better defend against novel attack patterns that signature-only detection systems would miss. Being out of band, IDS does not interfere with normal traffic and operations. IDS can operate on traditional networks, cloud deployments, and hybrid environments.
What is an intrusion prevention system (IPS)?
An IPS is an inline tool that combines the detection functionality of IDS with blocking capabilities. It is often placed before or after a firewall in the network path. Like an IDS, an IPS works off a set of signatures and ML models. It inspects network traffic and, like the firewall, can block or reject traffic it finds consistent with known attack patterns or deems potentially harmful based on pre-set rules.
Poorly calibrated, an IPS could block legitimate traffic and disrupt critical business processes. It can also introduce latency if it analyzes traffic at high volume or complexity. Because of this, many IPS systems are set to operate in a detection-only mode, effectively turning the tool into an IDS with unused IPS capability. Increasingly, IPS functionality has been built into next-generation firewalls (NGFW) or unified threat management solutions rather than standalone.
Why IDS and IPS are important
Intrusion detection systems (IDS) and intrusion prevention systems (IPS) improve network security and reduce the risk of successful intrusions by identifying and, in some cases, mitigating network-based attacks. IPS’s control function can automatically block certain traffic and reduce demands on the SOC workflow. Well-tuned IDS, and to an extent IPS, can alert the SOC to suspicious traffic flows that may require further investigation or threat hunting.
Both technologies have expanded to cover hosts and networks in cloud environments. Cloud versions must be scalable and able to observe traffic and hosts. In some cases, a legacy IDS or IPS may not have sufficient cloud capabilities and will need to work in conjunction with security tools built for cloud deployments.
IDS and IPS enable advanced threat detection and can also help SOCs undertake incident response that can thwart attackers before they accomplish their strategic objectives. IDS and IPS deployments can help organizations comply with industry regulations or third-party due diligence. IDS can also aid digital forensic investigations, alert SOCs to behaviors that do not comply with internal policies, or uncover evidence of shadow IT that could leave the organization vulnerable to cyber attacks.
Richer alert context that reduces false positives.
NDR’s monitoring can generate deeper insights into data transfer volume, connecting hosts, ports in use and timestamps than IDS alerts typically provide; best-in-class solutions will also summarize the metadata into comprehensive analysis. The enriched alert context gives security teams greater confidence when they prioritize alerts and determine remediation steps.
Enrichment of encrypted traffic.
Most on-premises and cloud network traffic (including malicious traffic) is encrypted, and decryption is often expensive or impractical. NDR’s analytics can help SOCs understand characteristics of encrypted traffic, including timestamps, packet sizes, flow direction, and even behaviors within the encrypted applications.
Tool integration.
Best-in-class NDR integrates with a wide variety of security solutions and helps SOCs build a comprehensive view of their networks. Its IDS monitoring and alerting capabilities can work in concert with other tools, like packet capture and storage, to improve the organization's overall security posture.
Multi-dimensional detections from signature, behavioral, and anomaly-based to machine-learning
based models.
Targeted collections for network traffic including the Encrypted Traffic Collection, which provides analysts data and detections for monitoring VPN, SSH, RDP, and other connection services as well as the C2 collection for detection of command and control activity.
Integration with IPS, SIEM and other detection solutions. Corelight’s platform is vendor-neutral, and designed to integrate with other tools in the security stack, including endpoint detection and response (EDR), SIEM, and extended detection and response (XDR). Corelight can also supplement NGFW with security-based network analysis that may detect malicious traffic that bypasses the firewall or passes through undetected.
Scalable to cloud environments. Corelight’s functionality extends to cloud and hybrid deployments and covers network traffic and connections that cloud-based security tools can often miss.
Complete triage through a single screen. The Open NDR Platform consolidates telemetry from virtual private clouds, firewalls, north-south and east-west (internal) traffic and all IP addresses within or connected to the network.
Book a demo
We’re proud to protect some of the most sensitive, mission-critical enterprises and government agencies in the world. Learn how Corelight’s Open NDR Platform can help your organization mitigate cybersecurity risk.
