.

IPS Location in the Network

<<

scucci

Newbie
Newbie

Posts: 29

Joined: Mon Sep 15, 2008 10:55 am

Post Tue Oct 21, 2008 3:33 pm

IPS Location in the Network

Hello,

I was wondering if anyone had a particular opinion on the location of an Intrusion Prevention System (IPS) in a network. Does an IPS normally come before or after a firewall?

Thanks,

Matt
<<

oleDB

User avatar

Recruiters
Recruiters

Posts: 236

Joined: Thu Jul 20, 2006 8:58 am

Location: HOA

Post Tue Oct 21, 2008 3:47 pm

Re: IPS Location in the Network

My preference is for the stand alone IPS to die and become a fully integrated module in your firewall. Similar to the Netscreen IDP, but with the quality of Tipping Point.
<<

scucci

Newbie
Newbie

Posts: 29

Joined: Mon Sep 15, 2008 10:55 am

Post Wed Oct 22, 2008 8:24 am

Re: IPS Location in the Network

But if you had a stand alone IPS would you put in front or behind your firewall? I'm assuming behind but wanted to know any other opinons.
<<

don

User avatar

Administrator
Administrator

Posts: 4226

Joined: Sun Aug 28, 2005 10:47 pm

Location: Chicago

Post Wed Oct 22, 2008 1:38 pm

Re: IPS Location in the Network

Just like anything, there any many ways to do it. oleDB's suggestion is a good one, but if it is stand-alone then I would put it behind the firewall for the simple fact that it would see less traffic and therefore perform better.

You could also put up more than one like on the internal network. I've seen many do this to also watch what is happening on the inside with both the bad guys who compromised a client but also for those pesky insiders who use non-approved apps. Setup an alert system for users running P2P, using excessive bandwidth (mileage will vary) or anything else you can write a signature to detect. I guess this would be more like an EDS - Extrusion Detection System.  :o

Just some ideas,
Don
CISSP, MCSE, CSTA, Security+ SME
<<

scucci

Newbie
Newbie

Posts: 29

Joined: Mon Sep 15, 2008 10:55 am

Post Wed Oct 22, 2008 4:16 pm

Re: IPS Location in the Network

Thanks for your help Don!!
<<

charlottebandit

Newbie
Newbie

Posts: 49

Joined: Sat Jun 10, 2006 4:26 pm

Post Thu Oct 23, 2008 10:36 pm

Re: IPS Location in the Network

scucci wrote:Hello,

I was wondering if anyone had a particular opinion on the location of an Intrusion Prevention System (IPS) in a network. Does an IPS normally come before or after a firewall?

Thanks,

Matt


Many solid firewalls can be purchased with a IPS module in it which makes tons of sense especially when it can detect SQL injections, buffer overflows, scans, URL parsing, certain Web App attacks, and protocol manipulation.  So to answer your question, there are two places I would place an IPS for basic coverage:  at the firewall (perimeter protection), and at the Distribution/Core switches (scans internal users.

From there, throughput becomes an issue so you'd have to go with a slamming sized IPS in your Data Center because most likely it's going to push 10GE lines. 
MS, CCSP, CCNP, CCDP, CEH, CHFI, CPTS

Return to Hardware

Who is online

Users browsing this forum: No registered users and 0 guests

cron
.
Powered by phpBB® Forum Software © phpBB Group.
Designed by ST Software