Intrusion Prevention Systems Explained

A basic firewall decides whether traffic is allowed based on addresses and ports. An intrusion prevention system (IPS) goes deeper, examining the content of allowed traffic for signs of attacks and blocking them in real time.

How IPS works

IPS engines compare traffic against signatures of known attacks, such as attempts to exploit vulnerabilities in web servers, VPNs or operating systems. Many also detect anomalies — traffic that behaves unusually.

What IPS protects against

• Exploits targeting unpatched systems
• Malware communication
• Brute-force attempts against services
• Scanning and reconnaissance activity
• Protocol misuse

Virtual patching

When a vulnerability is announced, IPS signatures can block exploitation attempts before you have patched every system — buying valuable time.

False positives

IPS may occasionally block legitimate traffic. Tune policies for your environment, starting in detection mode for sensitive applications before enforcing blocks.

Performance considerations

Deep inspection requires processing power. On appliances, enabling IPS can reduce throughput, so size devices accordingly. Cloud firewalls scale inspection automatically.

Keep signatures updated

IPS is only as good as its signatures. Ensure automatic updates are enabled and working.

Encrypted traffic

IPS cannot inspect encrypted traffic without SSL inspection. Decide which traffic should be decrypted for inspection.

Logging and alerts

Review IPS events to understand attack trends and spot targeted activity.

Complement, not replacement

IPS works alongside patching, endpoint protection and access controls.

The bottom line

IPS adds a powerful layer of protection by stopping attacks in real time. It is a standard feature of UbiFi Cloud Firewall.

Learn more about Cloud Firewall from UbiFi, or talk to our team.