2 cissp ® Official Study Guide Eighth Edition

Intrusion Prevention Systems 
An intrusion prevention system (IPS) is a special type of active IDS that attempts to detect 
and block attacks before they reach target systems. It’s sometimes referred to as an intru-
sion detection and prevention system (IDPS). A distinguishing difference between an IDS 
and an IPS is that the IPS is placed in line with the traffi c, as shown in Figure 17.4 . In other 
words, all traffi c must pass through the IPS and the IPS can choose what traffi c to forward 
and what traffi c to block after analyzing it. This allows the IPS to prevent an attack from 
reaching a target. 
F I g u R e 17. 4
Intrusion prevention system
Internet
Access
Internal
Network
Intrusion
Prevention
System
In contrast, an active IDS that is not placed in line can check the activity only after it has 
reached the target. The active IDS can take steps to block an attack after it starts but can-
not prevent it. 
An IPS can use knowledge-based detection and/or behavior-based detection, just as any 
other IDS. Additionally, it can log activity and provide notifi cation to administrators just as 
an IDS would. 

---

Implementing Detective and Preventive Measures 
763
A current trend is the replacement of IDSs with IPSs. Similarly, many appli-
ances that include detection and prevention capabilities focus their use 
on an IPS. Because an IPS is placed inline with the traffic, it can inspect all 
traffic as it occurs.
Specific Preventive Measures 
Although intrusion detection and prevention systems go a long way toward protecting net-
works, administrators typically implement additional security controls to protect their net-
works. The following sections describe several of these as additional preventive measures.