Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
As far as I know,
IDS sniffs network traffic, and if intrusion is detected, reports it.
And IPS sniffs network traffic, and if intrusion is detected, rejects it, and reports why it was blocked. Am I right?
And I read that some IPS can even be configured not to drop packets, just to report them.
Apart from the ability to analyze the intrusion and take action myself, is there any other good reason to choose IDS over IPS? Maybe the price tag?
Passively listening to network traffic to detecting suspicious behavior is still important. There are only a few obvious attacks which you might detect and block immediately but there is lots of traffic which only looks a bit suspicious or even innocent. But, if you collect traffic information over some time and maybe from multiple places in your network, you might see a pattern in this innocent traffic which points to anomalies or attacks which try to be stealth (like APT).
Apart from that, the meaning of words like IDS, IPS or firewall is not clearly defined and they are mostly replaced today by even more blurry marketing speech like "next generation firewall" or "unified threat management". The classical IDS products like snort, bro and suricata still exist and are in active development, but they are mostly integrated in UTM or NGFW solutions or things with different marketing names.
I would say that the main reason that most organizations would opt for an IDS over an IPS (assuming they do) is the fact that a false positive on an IDS is much less detrimental than an IPS' false positive.
If an IPS incorrectly takes action against legitimate traffic it thinks is malicious then it's really doing more harm than good.
Do they still sell IDS? I think most vendors these days have an Intrusion Prevention device. This device can be configured to work in 'IDS' or 'IPS' mode. In fact you can even be as specific as saying for a particular set of signatures just detect, do not prevent. You would do this for signatures that are known to throw a lot of false positives. And for some other set of signatures that you are very sure of, you could tell the device to detect and prevent. Gone are the days when there was a clear line between what is considered an IDS and what is considered an IPS.
