I see that most IPS available in the market comes with a basic pre-defined policy which administrators can base on when creating their initial IPS policy. However, these policy may be insufficient and the administrator may need to dig deeper. As such what is the best practice when creating an initial policy and making sure nothing gets missed out.
Of course we will be given a list of applications, OS, known ports, etc in a network and we can create a policy from there; but do we keep it strict and limited to the list given to us or do we loosen up a bit for wider protection coverage.
For example, if a web server is running Microsoft IIS but not FrontPage, do we enable rules / signature for both IIS and FrontPage Extensions to ensure that the IPS will be able to pick up FrontPage exploit / probing attempts?
Also, how do we ensure that the usability, functionality and security as well as the performance of the IPS itself is not affected by the IPS policy we've created as some of the rules / signature in certain IPS solutions that I know have overhead / performance impact.