Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If a desicion is to be be made on selecting a mode of fail for an inline IPS that is protecting servers, what are the criteria that should be considored for selecting one of the failure modes:

1- Fail close: if the IPS fails, it will disconnect the server it is protecting.

2- Fail open: if the IPS fails, it will pass through all traffic to the server including any possible attacks.

What are the risks and benefits involved in both scenarios?

share|improve this question

The way to look at which is better for you is to work out what your risk appetite is.

If you must have service at all costs then you don't want to fail closed, as any problem with that IPS will cause a Denial of Service. That is a very rare scenario though - the majority of implementations are configured to protect the server and the data on it.

This is where defence in depth comes into its own. You filter some traffic (eg everything but ports 80/443) using a hardware device - this gives you speed and the ability to remove the vast majority of the traffic that may impact you.

Then use a firewall to limit connections to only those you need. If it can do stateful inspection, this can be used to limit the types traffic.

Then you harden your web server, and locate it in a DMZ which is segregated from your internal network and databases by further firewalls or access controls on routers.

etc etc etc

Layering gives you the ability to cope with the failure of one component, so in your case, if your IPS fails you can make a call based on how secure your other layers are as to whether you fail open and cope with a reduced level of protection until fix, or fail closed and suffer an outage.

share|improve this answer
I take that you are pointing to evaluate security of data versus service availability. If security of data is more important, use fail close. However, if service availability is more important, use fail open. – AdnanG Sep 16 '13 at 10:03
if you want to get that simple, yes, you are right - but I would encourage you to take the wider view, as there is never black or white, only shades of grey. – Rory Alsop Sep 16 '13 at 13:08
@Roy Alsop, I am more concerned about the basic criteria for selecting an option. – AdnanG Sep 17 '13 at 6:20

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.