IDS / IPS (Intrusion Detection/Prevention)

IDS and IPS inspect activity for signs of attacks or policy violations. An Intrusion Detection System observes traffic or host events and raises alerts; an Intrusion Prevention System sits in a position where it can also block, reset or otherwise interrupt matching activity. Detection may use signatures, protocol analysis, reputation, behaviour or anomaly models, each with limitations. An IPS can reduce exposure quickly, but an inaccurate rule may interrupt legitimate business traffic, so changes require tuning, monitoring and rollback. Placement and visibility matter: encrypted or bypassing traffic may not be inspected. Useful evaluation covers protected segments, update sources, false positives, response ownership, logging and failure mode. IDS/IPS complements patching, identity controls, endpoint protection and segmentation rather than replacing them.