Intrusion Prevention (IPS) and Intrusion Detection System (IDS)

 Monitor and analyze all traffic in the network segment.

- It consists of a set of sensors that works to detect malicious activities on the network.

- Detect if someone is trying to enter your system or if a legitimate user is misusing it.

IPS complements an IDS by blocking intrusion and preventing further damage to the network. It is a tool that detects and blocks the attacker.

Intrusion Prevention
Hybrid Intrusion Detection Systems

- It is the use of network-based systems and Host-based systems to control and monitor the computational security of an environment.

Students: Felipe Moraes, Luma de Oliveira and Mariana Mondo

Host-based Intrusion Detection Systems (HIDS)

- Monitors and analyzes information collected from a single Host (Machine).

- Does not observe the traffic passing through the network.

- They are installed on servers to alert and identify attacks and attempts to improper access to the machine itself.

INTRUSION DETECTION SYSTEM - IDS

IPS is often located directly behind the firewall and provides a complementary layer of analysis that negatively selects dangerous content.

Intrusion Prevention Steps

Network-based Intrusion Detection Systems (NIDS)

The efficiency of the Intrusion Prevention System - IPS

An intrusion prevention system monitors network traffic and has the ability to take immediate action, based on a set of rules established by the network administrator, in cases where the intrusion occurs due to the nature of the attack and its speed.

An efficient use of the Intrusion Prevention System can, for example, discard a packet that it considers to be malicious and block all traffic from that IP address or port. Traffic that is considered legitimate or secure will be forwarded to the recipient without any apparent interruption or delay in the service.

The detection mechanisms perform the monitoring and analysis of traffic patterns, as well as individual packets, including address matching, string and HTTP substring, TCP connection analysis, detection of packet anomalies and traffic anomalies in port communication TCP / UDP.

Benefits of the network intrusion prevention system for companies 

Most organizations today can benefit from intrusion prevention systems, since the use of technologies dedicated to the use of hardware, software and networks are part of the computational infrastructure of most companies, regardless of their type or sector.

IPS technologies offer several benefits for organizations, let's look at three of the most significant benefits:

Detects and stops attacks that other security controls do not
Supports customization of discovery features to stop activities that are of interest to a single organization only

It reduces the amount of network traffic that reaches other security controls, which reduces the workload for those controls and protects them from direct attacks.

The most important benefit provided by the Intrusion Prevention System is undoubtedly the ability to detect and stop a variety of attacks that cannot be automatically identified by firewalls, antivirus and other company security controls.

The technology employed by IPS uses the combination of several methodologies to detect attacks. Each methodology has its own characteristics, so by using the strongest resources of each methodology, an IPS can detect a wide variety of attacks.

Intrusion prevention systems are critical for most organizations to detect and stop network-based attacks, especially those that cannot be detected by other company security controls.

Information security today has become a mandatory requirement to guarantee not only business continuity, but also the certainty of respecting the privacy and integrity of customers and suppliers.