IDS vs. IPS: Is one strategy ‘better?’

If you are plugged into the security grapevine, you likely know that Gartner caused quite a stir when it issued a report in June stating that intrusion-detection systems will be obsolete by 2005.

The research firm’s report predicted that stand-alone network-based IDSs, sometimes called “NIDSs,” will be supplanted by firewalls that combine network-level and application-level filtering to block malicious traffic and specified content. They will also likely perform anti-virus functions.

The new category of device is frequently called an intrusion-prevention system (IPS). Often, these devices work directly in the data path, as opposed to IDS/NIDSs, which traditionally monitor copies of traffic offline.

On the one hand, we need security products to evolve to thwart new attacks in a just-in-time manner. This summer’s Internet escapades revealed that, if nothing else, anti-virus software alone – while great at blocking known infections – doesn’t do well when a brand-new attack first hits. One estimate, for example, is that the Blaster worm infected 137,000 Internet hosts in just two hours. So these suckers can do a lot of damage in the time it takes to create and circulate a fix.

However, is it really necessary to combine functions in one device (in this case, the firewall), as long as you get all the capabilities you need? It would seem that the form factor and strategic placement of these security capabilities in the network should be up to you.

One potential worry is that collapsing all your security filtering into a single edge device has single-point-of-failure/attack and congestion ramifications. Also, are you are going to put all your local users outside your firewall? After all, it’s no secret that many breaches are generated internally.

If the answer is no, the network segments where you would likely perform filtering include data center hosts (via IPS host software), backbone switches and at the traditional perimeter of the network – the WAN edge and, possibly, the wiring closets where wireless LANs connect to the wired LAN.

One of the issues with NIDSs is the volume of false alarms some products generate, making them unwieldy, costly and ineffective. Another controversy is whether newer IPS sensors are more effective when operating directly in the production data path or offline (a.k.a., “promiscuously”), as is the case with most IDS/NIDSs.

We’ll examine these issues in future newsletters.