Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I would like to know can an Network Intrusion Prevention System[IPS] be used as an Network Intrusion Detection System[IDS] and vice versa.

Can the Host based IPS be used as a host based IDS and vice versa ?

Is it necessary to have both IPS and IDS ?

Which one is more reliable Network based IPS /IDS or host based IPS/IDS

share|improve this question
add comment

2 Answers

In IPS is essentially an IDS with extra funtionality. Both an IDS and IPS monitor and report on events, but an IPS can also take some actions to block an attack automatically. So, you could use an IPS as an IDS simply by disabling its reactive measures, but you can't go the other way as the reactive functionality is not there.

Which one you need depends on the security problem you are trying to solve, which cannot be answered as there's not enough information in your post. In general host IPS functionality is the standard in many industries, you could take your steer from that. That's talking purely about host based software, many companies back up host IPS with a network-based IDS system to monitor for events.

share|improve this answer
add comment

I would like to know can an Network Intrusion Prevention System[IPS] be used as an Network Intrusion Detection System[IDS] and vice versa.

Typically an IDS just means that it's architected not to be in-line, or it is set to be in a "monitor mode." There are out-of-line IPSs but they do not function as you would typically expect.

For example, if you had an out-of-line IPS, and it detected some sort of communication it wants to stop between two devices, what most vendors do is spoof two TCP packets with the RST flag out to both sides (for more details, go here). You would think that the devices would then stop communicating due to the RST, but often you will see that the queried server (typically your server) will still provide the response due to some sort of oversight with the TCP packet (In the link I provided, it was because of a an error the vendor made with the sequence number on the TCP RST packet to the web server).

There are some products on the market that are made to be one and not the other . One example I can give is HP's TippingPoint; It is designed to be an in-line NIPS but not a NIDS device. Everything about the device is made to be quick and cutthroat, making split second decisions. This means that it doesn't compete well (although it can function as a NIDS device) in the NIDS space because other NIDS vendors can do things such as add context (SourceFire and McAfee do this) such as information imported from vulnerability scanners.

Can the Host based IPS be used as a host based IDS and vice versa ?

This is a very different question.

One thing you should keep in mind is that IDS/IPS are not the only host-based security mechanisms available. There is also application whitelisting, which is extremely (and arguably more) effective, encryption at rest (if you are worried about data exfiltration - this is not full disk encryption), anti-virus (which is notedly outdated and increasingly less effective), TCP Wrappers, HBSSs, and more.

But to answer your question, there is typically a "monitor mode" functionality built into HIPS products. There is not always a "prevent mode" built into HIDS products (and in some, there is a prevent mode, but it is not very good).

Is it necessary to have both IPS and IDS ?

Typically no, but it depends on what you mean by IPS and IDS. Do you mean HIPS and NIDS? If so, it would make sense to have both. Assuming you mean NIDS and NIPS, it could help but only in very niche high security situations. For instance, it could help when you don't want to rely on a single vendor's signatures. This follows the general best practice of defense in depth, although I would argue that you are just throwing the wrong type of technology at the solution.

With many Network IDPS vendors, you are able to craft your own signatures and import them if the signature doesn't already exist, but this takes a lot of time and knowledge that many teams just do not have.

For this reason you are starting to see vendors in a space created to defend against "Advanced Persistent Threats," or APTs. Some people call this network malware protection and common vendors include Damballa, Fidelis, and FireEye.

Which one is more reliable Network based IPS /IDS or host based IPS/IDS

This is not really an easy question to answer in an overarching fashion. It depends on the vendor, the architecture, and the reason why you are implementing your different security mechanisms. Reliability is relative to what you're trying to accomplish.

If the question is, is one better than the other, then that depends on the mechanism they're using for detection (signatures, heuristics, anomalies, etc.) and how that applies to your individual traffic and attack patterns.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.