Network Intrusion-Prevention Systems

With our first "In the Wild" IPS test, we've spent the last five months testing 11 products on our live distributed network connecting sites in Los Angeles, San Jose and Tuscon, Ariz., to help sort out the real from the rhetoric.

An ounce of intrusion prevention may cure your network security ills
Talk about jumping on a bandwagon. When Gartner last summer declared "IDS is dead, long live IPS," marketeers everywhere picked up the intrusion-prevention system buzzword and ran with it.

Go with the flow
Rate-based IPSs detect detailed changes in traffic flow.

Content is king
Attack signatures trigger a range of responses among content-based IPSs.

ForeScout pitches honeypot technology as IPS
A few vendors that wanted to be tested didn't meet our criteria, but ForeScout's ActiveScout caught our attention.

Intrusion prevention as a service
Our review of intrusion-detection system devices attracted the attention of EcoNet.com, a company selling a managed, customer-premises-equipment-based IPS service.

How we did it
How we tested the various intrusion prevention systems.

Why we didn't test performance
Our intrusion-protection system review methodology was open for comment for four months before testing began. We openly solicited vendor input regarding what to test and how to test it. Three vendors pushed hard to include performance testing.

IPS forum
Discuss intrusion prevention and our review with the reviewers.

Top 20 Questions for your IPS vendor
What to ask your IPS vendor when evaluating a product or service.

Product upgrade chart
What has changed in the products since we reviewed them.

Related Links

Error 404--Not Found

From RFC 2068 Hypertext Transfer Protocol -- HTTP/1.1: 10.4.5 404 Not Found The server has not found anything matching the Request-URI. No indication is given of whether the condition is temporary or permanent. If the server does not wish to make this information available to the client, the status code 403 (Forbidden) can be used instead. The 410 (Gone) status code SHOULD be used if the server knows, through some internally configurable mechanism, that an old resource is permanently unavailable and has no forwarding address.