L41
IDS versus IPS and detection mistakes
Cram this first — memory hook
Intrusion Detection System detects; Intrusion Prevention System prevents. Positive = alarm raised, not necessarily a true attack.
Exam trap
An is not automatically more accurate just because it can block. An encrypted flow can limit what a network sensor can inspect.
The slide facts
Intrusion detection and prevention differ in alerting versus blocking. Deployments can be network-based or host-based, and placement matters.
If you have time — extra
An Intrusion Detection System () observes activity and raises alerts. An Intrusion Prevention System () can intervene to prevent traffic, commonly while placed inline. Think a camera notifying a guard versus a checkpoint that can stop entry. A Network-based () watches traffic; a Host-based () observes activity on one endpoint. Signatures recognize known patterns; anomaly methods look for deviations from expected behavior. These are added explanations of how detection can work, not extra slide headings to memorize. A false positive labels legitimate activity suspicious; a false negative misses malicious activity. Inline blocking can disrupt good traffic if detection is wrong, so tuning and availability design matter. An alert still needs a response process; monitoring alone does not necessarily stop the harmful action.
Walkthrough
Place sensors where the relevant evidence is visible, configure appropriate detection, investigate alerts, tune false positives carefully, and validate that prevention blocks the intended behavior without unacceptable disruption.