What are the IDS & IPS systems and what are the most important differences between them?
In my post for today, I will address a topic about IPS systems and IDS systems, what are they? And what is its function? And what are the most important differences between them, which is a blog on network security and protection
What is IDS?
The IDS or intrusion detection system is a protection system that can be compared to the antivirus on your device that analyzes all the traffic passing through the network by sending a copy of this traffic to it.
Its main function is focused on practical analysis only, depending on Rules that can be downloaded from the Internet or They were prepared manually, as we will see later, in addition to databases containing information about viruses and worms that were able to penetrate through the firewall on the network, and the system works on it to compare the signature of each virus, which is stored in the database, but what is wrong with this system is that it does not perform any reaction In the direction of this virus, all it does is send a warning to the network administrator that there is something abnormal in the traffic passing through, and from here we can conclude that the word detection does not mean anything but detection, and a small question may come to your mind. What do I benefit from this process? In other words, what will I benefit from if the virus enters the network?
To answer this question, we must first know that this type of system is useful in several cases:
The first case is the detection of vulnerabilities in security systems
The second case is to archive all kinds of threats that occur to the network
The third case: Identifying and correcting the errors committed by the protection officials
What distinguishes this type also is the possibility of placing it away from the real traffic path so that it does not affect the speed of data transmission
What is IPS?
IPS or Intrusion Prevention Systems, which is an upgraded version of the previous system. It performs the detection process first, and then implements a specific prevention reaction, such as making a drop for harmful packages, so it must be placed on the traffic lane directly
What distinguishes it also is the way to respond to dangerous traffic, as it can prevent it, and it can also send settings for security devices on the network, such as firewalls or routers, in order for them to stop it.
Thanks
