An intrusion prevention system (IPS) inspects network traffic for malicious or suspicious activity and takes predefined actions, such as blocking detected traffic. Historically separate, IPS functionality is now typically integrated into next-generation firewalls (NGFWs). section 11.5.2 section 11.6
Understand IPS behavior through its detection and response mechanisms:
- Downloads attack signatures from the vendor; these identifiable data patterns detect malicious activity instead of relying only on user-configured rules. section 11.5.2
- Builds a picture of typical network activity and identifies anomalies that do not match the baseline. section 11.5.2
- Protects against DoS and DDoS attacks, malware, reconnaissance attacks, and SQL injections. section 11.5.2
- Supports Cisco’s next-generation IPS (NGIPS), which adds contextual awareness about applications, device types, operating systems, and users. section 11.5.2
Within an NGFW, IPS complements stateful packet filtering, Application Visibility and Control, and Advanced Malware Protection. This integration simplifies IPS implementation and management. section 11.5.2 section 11.6
