In the near-term, prevention systems likely will replace detection systems at the perimeter. But detection still will be needed elsewhere on the network to augment IPS.
IDS and IPS already are being put into all-in-one appliances like Internet Security Systems’ Proventia series. But it’s not likely that IPS will replace IDS devices until reporting, analysis and correlation are flawless enough to prevent false positives, says Rodney Thayer, principal investigator at Canola & Jones Internet Investigations and a Network World Lab Alliance member.
In the near-term, prevention systems likely will replace detection systems at the perimeter. But detection still will be needed elsewhere on the network to augment IPS, which errs on the side of giving too little event information, explains Mike Pearson, CEO of Digital Stakeout. The managed security services provider uses ISS’ Proventia at each of its 20 data centers for anti-virus, content filtering, anti-spam and intrusion prevention.
“Say someone brings in a laptop and it’s infected with Welchia. Intrusion prevention will not stop that from spreading through the subnet unless it’s directly between the infected computer and everyone else’s,” Pearson says. “You need a detection system to see that something’s spreading. And you need protection systems to drop malicious traffic on the way in.”
