- Network based intrusion prevention systems (NIPS) are focused on the network itself, and either through a purpose-built piece of hardware or software is placed inline — typically right behind a network firewall — to monitor traffic for potential threats and prevent them from happening by either blocking the offending traffic or dropping the identified packets. It compares traffic with known threat signatures. Historically, they were used to defend critical network infrastructure, such as firewalls and servers, from malicious internal users.
- Network behavior analysis (NBA) takes NIPS a step further and analyzes behavior and traffic patterns to spot malware and potential threats. This is useful to find and stop zero-day vulnerabilities that may not have any identified or previous network signature.
- Host intrusion prevention systems (HIPS), sometimes called host-based firewalls, are typically installed at each endpoint computer to inspect traffic coming and going from that system and monitor the processes running on that particular machine. Most modern operating systems such as Linux, Windows, and macOS now come with this feature built into the OS.
- Wireless intrusion prevention systems (WIPS) extends NIPS to examine Wi-Fi networks and add the ability to remove any unauthorized devices that have connected to the network.
- Cloud versus on-premises scope. Cloud-based IDS are typically part of larger security solutions that take advantage of cloud providers’ virtual network access to their infrastructure. On-premises IDS are typically based on hardware appliances that mirror network traffic. Some vendors combine both approaches in their products.
How IPS/IDS differ from NDR/EDR/XDR/MDR/ADR
IPS and IDS were created back in the era where threats were easier to detect, when cloud computing and internet applications were in their infancy, and when most applications ran on-premises. But today threats have gotten more complex: they are designed with custom signatures for each target and often have multiple layers of encryption using multiple methods — such as polymorphic or ever-changing mechanisms — to avoid detection.
To keep pace with this increase in complexity, security vendors have created new incident and protection products that go under a variety of acronyms, including network detection and response (NDR), endpoint detection and response (EDR), extended detection and response (XDR), managed detection and response (a SaaS-based subscription service or MDR), and application detection and response (ADR), the latest in the series.
Gartner has taken a slightly different tack and labels for vendors’ network protection products “hybrid mesh firewalls” (Check Point, Palo Alto Networks, Fortinet and Juniper). The hybrid in this label refers to products that have a single management rubric for handling both on-premises and cloud environments. “The role and scope of network firewalls have moved beyond traditional use cases to more innovative use cases involving hybrid environments, hybrid workforces and hybrid teams,” their analysts Rajpreet Kaur and Adam Hils wrote in a report from January 2024. IPS is just one of numerous other network protection strategies employed by these tools.
