A Comparison of Intrusion Detection Systems and Intrusion Prevention Systems

The main difference revolve around the fact that IDS are used in the ensuring that the network has an adequate degree of preventive security basis against possible any emergent suspicious activity. The IDS attains the above objective via the use of early warning signs made at the system administrators (Patil, Rane & Meshram, 2012). IPS on the other hand is a device whose role is the control of access to the organizations IT networks with the objective of ensuring that they protect the systems from attack as well as abuse. The design of the device is focused on ensuring that they assess the attack data and consequently adopt the corresponding action, blocking the attacks as it develops in most cases, before it succeeds, thus designing a set of rules in the respective firewall (Patil, Rane & Meshram, 2012).

2. It would be appropriate to choose the IPS over IDS in those instances that the focus of the organization or entity in question is to not only detect the intrusion but proceed to protect te network by neutralizing the attack (Patil, Rane & Meshram, 2012). The fact that the IPS works by detecting and consequently neutralizing any existent threats is the main reason that makes it more applicable in cases where mission is to detect and stop threats to the network than IDS whose role is just to detect and inform the network administrators (Patil, Rane & Meshram, 2012).

3. By placing an IDS/IPS behind the border firewall, an organization ensures that they have the needed preventive measures as well we control that will help them to deal with the new as well as existing threats. It additionally ensures the organization has the needed visibility as well as confirmation relating to the state of their internal activities (Patil, Rane & Meshram, 2012).

Reference

Patil, S., Rane, P., & Meshram, D. B. (2012). Ids vs ips. Proceedings of International            Journal of Computer  Networks and Wireless Communications, 2.