IDS and IPS

What it means

IDS and IPS are intrusion detection and prevention systems that monitor network traffic for signs of attack. An IDS alerts on suspicious activity, while an IPS also blocks it automatically, for example by refusing a connection or dropping malicious packets.

Detection works in two ways: by signatures, known attack patterns, and by anomalies, where the system looks for behaviour that deviates from normal. The first is accurate for known threats, the second can catch new attacks but produces more false alarms.

IDS and IPS complement the firewall, which allows or blocks connections by rule but does not inspect traffic content in as much detail. Modern firewalls often include IPS features, and their output is collected in a SIEM system.

How it works in practice

For smaller firms, IPS is usually part of a next-generation firewall or an internet provider's security service. Larger organisations run dedicated systems, with alerts assessed by an internal or external security operations centre.

The system needs tuning: settings that are too sensitive flood administrators with false alarms they stop watching, while settings that are too loose let attacks through. Signatures must be updated regularly so the system recognises new threats.

Network protection is combined with endpoint protection through EDR and a zero trust approach, which assumes an attacker may already be inside the network. For entities under NIS2, monitoring and incident detection are part of the required measures.

What to watch out for

Encrypted traffic, which now makes up most of the internet, limits what IDS and IPS can see. Without decryption at the gateway or protection on the devices themselves, attacks may pass unnoticed, while decryption raises privacy and performance questions.

An IPS that wrongly blocks legitimate traffic can stop an important application or payment system. Rule changes should be tested, and for critical systems it helps to be able to roll back settings quickly.