Question

1. Describe two differences between IDS and Intrusion Prevention System (IPS).

Answer 1

IDS vs IPS

IDS or Intrusion Detection System is an application or dedicated device that monitors the traffic over the network by analyzing each packet and compare them against the models of known attack and determine whether the packet is harmful or not and create a log message if there is attention is needed.

IPS or Intrusion Prevention System works almost the same as IDS but in IPS as its name says have the authority to allow or reject the packets according to the nature of the packets to avoid active attacks and violations.

Let's look at the differences

• IDS is a monitoring tool and IPS is a control system
  • IDS does not take control measures itself. when a packet is identified as a threat IDS creates a log message so that the administrator can look into it.
  • IPS is a control system and is able to allow or reject packets based on the specification of the rules and regulations
• IDS needs human help or another control system to look at the result and take actions where IPS needs to get updates on the rule system about new fashions and technologies in the hacker's world.
• In IDS the faulty detections will not effect the normal working of the network, but in IPS if the rules where not set effectively the entire network will fail even if there is no attack is happening.