You are here: Resources >> What is Intrusion Prevention?
What is Intrusion Prevention?
An intrusion prevention system is any device that exercises access control to protect computers from exploitation. "Intrusion prevention" technology is considered by some to be an extension of intrusion detection (IDS) technology, but it is actually another form of access control, like an application layer firewall.
Intrusion prevention systems (IPS) were invented to resolve ambiguities in passive network monitoring by placing detection systems in-line. A considerable improvement upon firewall technologies, IPS make access control decisions based on application content, rather than IP address or ports as traditional firewalls had done. As IPS were originally a literal extension of intrusion detection systems, they continue to be related.
Intrusion prevention systems may also serve secondarily at the host level to deny potentially malicious activity. There are advantages and disadvantages to host-based IPS compared with network-based IPS. In many cases, the technologies are thought to be complementary. An Intrusion Prevention system must also be a very good Intrusion Detection system to enable a low rate of false positives. Some IPS systems can also prevent yet-to-be discovered attacks, such as those caused by a Buffer overflow.
Due to the fact that a high amount of new security vulnerabilities are discovered on a daily basis, it can be a hassle for the end user to keep all their servers up-to-date with the latest patches. In many cases, the patches used to rectify the security holes can be delayed days, weeks, or even months.
In some critical environments, the installation of patches can break functionality and this can result in a direct loss for the customer if their production systems are not performing optimally due to a dysfunctional patch.
How Does Intrusion Prevention Work?
Intrusion Prevention is an advanced intelligent way of scanning the different layers for vulnerabilities. It consists of many techniques to ensure the optimal and most advanced security level. This includes:
- Database updated multiple times daily for the latest signature definitions.
- Traffic abnormalities are being identified and if consisting of dangerous content will be blocked.
- When a port scan is being performed, an attack will most likely follow in a matter of minutes afterwards.
- Denial of Service (DOS) attacks protection, because a successful DOS attack can cause your system to crash or be permanently damaged.
- Protection for known buffer overflow attacks and or other exploits being launched.
- Zero Day Protection, which is a module that protects for known and unknown Zero Day Vulnerabilities
- Wide protection for webmail, ftp, Windows, Linux, BSD, UNIX, Routers, Firewalls, Databases such as DB2, Oracle, MySQL, MS SQL, PostgreSQL, and more.
Read more about our services and products here: About SecPoint, IT Security Products, and IT Security Jobs.
Privacy Statement |
Link Policy |
User Policy |
IT Security Blog |
IT Security Forum
| SecPoint Pictures
Event Pictures | Exploit Archive | IT Security Web Shop | Vulnerability Library
IT Security Video | Sitemap
© Copyright 1999-2010: SecPoint®
SecPoint ApS - Lergravsvej 53 - 2300 Copenhagen S - Phone +45 70 235 245
Event Pictures | Exploit Archive | IT Security Web Shop | Vulnerability Library
IT Security Video | Sitemap
© Copyright 1999-2010: SecPoint®
SecPoint ApS - Lergravsvej 53 - 2300 Copenhagen S - Phone +45 70 235 245
| Recent awards | Compatible with | Visit us on Facebook! | Visit us on LinkedIn! | Visit us on Myspace! | |||||
 |
 |
 |
 |
 |
 Group! |
 |
 Follow us on Twitter!  |
||
Anti-Spam Appliance - Anti-Spam Firewall - Unified Threat Management Appliance
Anti-Virus - Web Filter Appliance - Anti Spam Appliance - Anti Spam Firewall - UTM Appliance Wifi Security - Wifi Pen Test - Wifi Crack - Wifi Hack - Wifi Audit - Wep Wpa2 Crack
Vulnerability Scanner - Vulnerability Assessment - Security Scanner - Pen Test Appliance