IDS and IPS in plain English
A firewall uses fixed rules to decide which connections are allowed – much like a gatehouse that only lets in people with a valid badge. An IDS takes a closer look. It analyzes network traffic or activity on a system and looks for signs of an attack, even when the connection itself is permitted.
A comparison: an IDS is like a burglar alarm with motion detectors. It reports intruders but doesn’t stop them – someone else has to respond. An IPS is more like a bouncer who doesn’t let suspicious guests in at all. On the flip side, it occasionally turns away harmless guests when it gets things wrong.
How IDS and IPS work
Depending on where they are deployed, there are two variants:
- Network-based (NIDS/NIPS): The system monitors traffic at central points, such as the internet gateway or between network segments.
- Host-based (HIDS/HIPS): The system runs on an individual server or computer and monitors activity there, such as logins, processes, and file changes.
There are two approaches to detection:
- Signature-based: The system compares traffic with known attack patterns, similar to a virus scanner. This is reliable for known attacks but blind to new ones.
- Anomaly-based: The system learns what “normal” looks like and reports deviations – for example, a server that suddenly sends large amounts of data to the internet at night. This makes it possible to find new attacks as well, though with more false alarms.
The technical difference: an IDS usually receives a copy of the traffic, for example via a mirror port on a network switch, and only observes. An IPS sits directly in the data stream and can cut connections immediately. That’s why it has to be configured with particular care.
Both have their limits. Encrypted traffic conceals its content. Attackers who work with stolen credentials and legitimate administration tools look like regular administrators. And too many false alarms cause real warnings to get lost. That’s why IDS and IPS are supplemented with other building blocks. EDR detects suspicious behavior directly on laptops and servers. A SIEM brings together alerts from many sources.
A practical example
Here’s a typical scenario: A hospital operates an IDS at the boundary between its administrative network and the network for its medical devices. During a red teaming exercise – a commissioned, covert attack – the red team moves through the administrative network using captured credentials. When it scans the network for open services, the IDS does in fact raise the alarm. However, the alert ends up in a shared mailbox that is only checked occasionally.
Only the joint review after the exercise brings this to light. The hospital then establishes clear responsibilities and on-call coverage for critical alerts. In a subsequent purple teaming session, in which attackers and defenders practice together, it sharpens its detection rules.
Why does this matter for businesses?
No protection is airtight. How much damage an attack causes therefore depends heavily on how quickly it is noticed. Attackers who move through a network undetected for an extended period can exfiltrate data and prepare ransomware.
Lawmakers rely on detection, too. In Germany, Section 31(2) of the BSI Act (BSIG) – the act on the BSI, Germany’s Federal Office for Information Security – requires operators of critical facilities (KRITIS, critical infrastructure under German law) to use attack detection systems. Companies covered by NIS2 must report significant security incidents to the joint reporting office of the BSI and the BBK (Federal Office of Civil Protection and Disaster Assistance) – with the initial early warning due within 24 hours. That requires attacks to be noticed in the first place.
Ultimately, the process behind the technology matters more than the technology itself. An IDS whose alerts nobody evaluates is like a burglar alarm wailing in an empty building.
How to protect your organization
- Define monitoring points: Monitor the internet gateway, the transitions between network segments, and particularly sensitive areas such as server or production networks.
- Proceed step by step: Start in detection-only mode, adapt the rules to your environment, and only then start blocking selectively.
- Evaluate alerts: Consolidate alerts centrally and assign responsibilities – including outside business hours. This can be handled by a SOC, for example – a team that continuously monitors your IT.
- Stay up to date: Keep signatures and rules current.
- Combine: Complement network monitoring with EDR and good logging.
- Practice your response: Define who does what when an alert comes in, and run through an emergency scenario.
- Test effectiveness: Check your detection with realistic attacks instead of relying solely on vendor claims.
How Rootsektor can help
With our Red Teaming & APT Simulation service, we attack covertly and log every step with a timestamp. That way, you can see exactly what your IDS, EDR, or SIEM detected – and what it didn’t. As a variant of or complement to red teaming, we offer purple teaming: we play through attack techniques step by step, and your team adjusts its detection rules right away. To discuss a suitable scenario, feel free to contact us; you can also request a quote via our Pentest Quote page.