What is an IDS and IPS Example?

Before making any decisions on using an intrusion detection system (IDS), it is vitally important to make sure you have a good understanding of the differences in types of IDS tools and how those tools fit into your security stack. This blog post will provide a refresher of some IDS and IPS basics, while also discussing the placement of the IDS and providing some intrusion detection system examples.

What is IDS?

An intrusion detection system (IDS) is a cybersecurity tool that analyzes system activity or network traffic for patterns that might indicate an attack. These patterns could be:

Unusual login attempts (repeated failed logins, access from unexpected locations)
Attempts to exploit known vulnerabilities in software
Denial-of-service attacks flooding the system with traffic

By identifying these patterns, IDS helps security personnel identify potential threats and take necessary steps to mitigate those threats. There are two main types of intrusion detection systems:

Network Intrusion Detection System (NIDS): This type of system monitors network traffic for suspicious activity, such as port scans, denial-of-service attacks, or attempts to exploit vulnerabilities.
Host-based Intrusion Detection System (HIDS): This type of system is installed on individual devices and monitors the activity on those devices for suspicious activity.

When an IDS detects suspicious activity, it will typically send an alert to a security administrator. The security administrator can then investigate the alert and take appropriate action, such as blocking the attacker's IP address or shutting down a compromised device.

Intrusion detection systems are an important part of a layered security defense. They can help to identify and respond to attacks that other security measures, such as firewalls, may miss. However, it's important to note that IDS systems are not foolproof and can sometimes generate false alarms or cause alert fatigue.

What is IPS?

Intrusion prevention systems (IPS) are cyber security tools used to monitor network traffic and systems for potentially malicious traffic. Using predefined security policies and rule sets, IPS can block malicious traffic, terminate suspicious connections, or otherwise disrupt the attacker's progress. This can involve techniques like packet filtering, which blocks unwanted traffic based on pre-defined rules, or deep packet inspection, which examines the content of packets for malicious payloads. It is important to note that one of the challenges with IPS is the possibility of non-malicious traffic being blocked based on a “false positive”.

Does IDS/IPS go before or after the firewall?

The ideal placement for an intrusion detection/prevention system depends on your specific network security needs and resource limitations. There are two main approaches:

IDS after the Firewall (Most Common):

Advantages:

- Reduced Load on IDS: The firewall acts as a first filter, blocking a significant portion of unwanted traffic before it reaches the IDS. This improves the efficiency of the IDS by focusing its resources on analyzing legitimate traffic for suspicious activity.

- Focus on Internal Threats: Placing the IDS inside the network allows it to monitor for malicious activity originating from within as well as external threats that bypassed the firewall.

Disadvantages:

- Potential Security Gap: Malicious traffic that slips through the firewall could reach the IDS before being blocked.

IDS before the Firewall (Less Common):

Advantages:

- Early Detection: This provides the potential to know about threats before they even reach the firewall, offering an extra layer of protection.

- Reduced Network Load: Blocking some threats before they enter the internal network can lessen the overall load on network resources.

Disadvantages:

- Increased Resource Consumption: The IDS will need to analyze all incoming traffic, including a larger volume of unwanted traffic, potentially impacting performance.

- Limited Visibility into Internal Threats: Primarily focuses on external threats.

Here are some additional factors to consider:

Network Size and Complexity: For larger networks with complex traffic patterns, placing the IDS after the firewall can be more efficient.
Security Priorities: If internal threats are a major concern, placing the IDS inside the network might be more important.
IDS capabilities: Some advanced IDS systems, like Suricata, can handle the increased load of being placed before the firewall.

Ultimately, the best placement depends on your specific situation. It's recommended to consult with a network security professional to determine the optimal placement for your network environment.

What is an IDS and IPS example?

The best example of an IDS/IPS is Suricata.

Suricata is a free, open-source IDS/IPS cybersecurity tool that acts as both an Intrusion Detection System (IDS) and an Intrusion Prevention System (IPS). It is used by organizations all around the world to detect cyber threats and monitor networks for suspicious activity.

Suricata’s strength lies in its versatility. When tuned correctly, it is a high-performance tool that can handle large volumes of network traffic and generate vast amounts of network traffic data. It is also extremely flexible, offering deep analysis of various protocols and the ability to customize rule sets to fit your organization’s specific needs. Because it’s an open-source IDS/IPS, Suricata benefits from a large, active community that constantly develops and refines its capabilities.

Put simply, Suricata is a powerful and adaptable tool that provides a robust layer of defense for any organization’s network security strategy.

Explore a modern alternative

You need a network security platform that doesn’t generate an endless stream of useless alerts across part of your network, and instead automatically identifies alerts of interest and notifies you of only serious and imminent threats. Your organization deserves response-ready detection with visibility into your entire network regardless of the environment with easy access to all the contextual evidence you need to stop an attack before it can cause damage. Replace your legacy IDS with a modern network detection and response platform that gives you these features and more.

The Stamus Security Platform™ is a network-based threat detection and response solution that eliminates the challenges of legacy IDS while lowering your response time. Stamus Security Platform harnesses the full potential of your network, bringing state-of-the-art threat detection, automated event triage, and unparalleled visibility to the security team.

Book a demo to see if the Stamus Security Platform is right for your organization.

To learn more about replacing your legacy IDS, check out the following resources:

To be notified of new blog posts and other news, make sure to subscribe to the Stamus Networks blog, follow us on Twitter, LinkedIn, and Facebook, or join our Discord.