What?
What is IDS / IPS?
IDS Stands for Intrusion Detecting System, and IPS stands for Intrusion Prevention System.
An IDS / IPS task is to listen to all the traffic that occurs on any given network and intercept network traffic that does not seem to be legitimate, and try to block this traffic, an IDS / IPS solution works in many cases together with, or is integrated with, a firewall, it may also occur as an independent solution.
What is the main task of IDS / IPS solutions? It is to detect illegal traffic, logging information about it, and try to block / stop this illegal traffic.
Why?
Why is IDS / IPS necessary?
IDS / IPS are needed because there are many types of attacks, and that all of these are not necessarily comming from an external source, so it's a good idea to have a solution that listens to all of the network traffic inside the company.
Network traffic can come from many different sources, a compromised server, client PC, tablet, smart phone, and all of these can be the cause of the illegal traffic that is not desired on the company network, and therefore it is a good idea to block / stop this traffic as soon as possible.
How?
How does IDS / IPS work?
An IDS / IPS solution function by listening to all the network traffic that it have access to, and based on this evaluate each package to ensure that it is legal or illegal.
In essence, a IDS / IPS solution looks at all the packages that make up the traffic between two points, it inspects this traffic to see if it is legitimate or if there is a reason to stop it, to prevent that one of these points are being infected by a virus, worm bot net, or other vulnerability.
Who?
Who should use IDS / IPS?
IDS / IPS solutions are today becoming a "must have" for all businesses, with the increasing development and integration of systems and devices at the intersection of networks, systems and platforms.
Today it is not enough "just" to have a Firewall and Anti-virus solution as these solutions can not capture all the various attack options available today, and that will come in the future.
An IDS / IPS solution is now required to have an additional security layer to protect the company's data, both from external but also internal hackers.
Today there are many IDS / IPS solutions available, but common to them all is to ensure the network communication inside the company.