Intrusion Prevention System (IPS)

Intrusion prevention is the process of performing intrusion detection and attempting to stop the possible incidents it detects. An IPS has all the capabilities of an intrusion detection system and adds those response actions. The two share many capabilities, and administrators can usually disable the prevention features of an IPS so that it functions as an IDS.

IPS responses fall into three groups. The IPS can stop the attack itself, for example by terminating the network connection or user session used for the attack, or by blocking access to the target from the offending user account or IP address. It can change the security environment, for example by reconfiguring a firewall, router, or switch to block access from the attacker. Some IPS technologies can also change the attack's content, removing or replacing malicious portions to make it benign, such as stripping an infected attachment from an email.

To block network traffic, a network-based IPS sensor is deployed inline, so the traffic it monitors must pass through it, much like traffic through a firewall. Inline sensors are typically placed at the divisions between networks, such as connections with external networks. A passive sensor, by contrast, monitors a copy of the traffic and no traffic passes through it.

An IPS inherits the accuracy limits of intrusion detection. It cannot detect with complete accuracy, and reducing false positives usually increases false negatives. In operational technology environments, NIST advises considering the impact of automated IPS responses on operations before deployment, and in some cases placing IPS units at higher levels, such as the interfaces to the DMZ.