{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/intrusion-prevention-system","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/intrusion-prevention-system/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/intrusion-prevention-system/"},"term":{"en":"Intrusion prevention system (IPS)","da":"Indtrængningsforebyggelse (IPS)"},"aka":{"en":["IPS"],"da":["IPS","system til indtrængningsforebyggelse"]},"domain":["security"],"cluster":"controls","layer":"network","status":"current","era":2003,"summary":{"en":"A guard placed in the path of network traffic that recognises signs of an attack and blocks them as they happen.","da":"En vagt placeret i netværkstrafikkens vej, som genkender tegn på angreb og blokerer dem, mens de sker."},"body":{"formal":{"en":"A system placed directly in the flow of network packets that checks each against known attack patterns or unusual behaviour and drops or cuts off the traffic it judges harmful before it reaches its target.","da":"Et system placeret direkte i strømmen af netværkspakker, som tjekker hver enkelt mod kendte angrebsmønstre eller usædvanlig adfærd og kasserer eller afbryder den trafik, det vurderer som skadelig, før den når sit mål."},"plain":{"en":"Like a bouncer at the door who turns away anyone matching a description, instead of just phoning the police.","da":"Som en dørmand, der afviser enhver, der passer på en efterlysning, i stedet for bare at ringe til politiet."},"inPractice":{"en":"An outside server sends a request built to abuse a known flaw in a municipality's self-service site for citizens; the IPS recognises the pattern and drops it, and the network team sees only a blocked entry in the log.","da":"En fremmed server sender en forespørgsel, der er lavet til at misbruge en kendt fejl i kommunens selvbetjening for borgere; IPS'en genkender mønstret og kasserer den, og netværksteamet ser kun en blokering i loggen."},"whyItMatters":{"en":"It stops attacks without waiting for a human, but a wrong judgement blocks real users too - so rules must be tuned to balance safety against availability.","da":"Den stopper angreb uden at vente på et menneske, men en forkert vurdering blokerer også rigtige brugere - så reglerne skal justeres, så sikkerhed og tilgængelighed balancerer."}},"deepDive":{"en":"An IPS is an intrusion detection engine given the authority to act, which requires it to sit inline - as a transparent bridge, a routed hop, or a module inside a next-generation firewall - so that every packet passes through it before being forwarded. NIST SP 800-94 groups IDS and IPS together as IDPS and lists the typical prevention actions: dropping the offending packet, terminating the session with TCP resets, blocking the source address for a period, rewriting or normalising malicious content, and instructing a firewall or router to change its rules. In open-source deployments Suricata or Snort run in IPS mode by receiving packets from the kernel through mechanisms such as Linux NFQUEUE or AF_PACKET in inline mode and returning a verdict for each; commercial appliances use dedicated hardware to inspect at line rate.\n\nBeing inline changes the engineering constraints. The IPS adds latency and becomes a single point of failure, so designs must decide between fail-open (traffic bypasses inspection if the engine or appliance fails, often via a hardware bypass module) and fail-closed (traffic stops). Throughput figures from vendors usually assume a minimal rule set; enabling full signatures, TLS decryption and file inspection can cut real throughput substantially. Stream reassembly and protocol normalisation must be complete before a verdict, since the IPS, unlike a passive IDS, cannot reconstruct traffic afterwards.\n\nFalse positives are the operational risk that most distinguishes an IPS from an IDS: an IDS false positive costs analyst time, an IPS false positive is a self-inflicted outage. Deployment therefore usually starts in detect-only mode, measures which signatures fire on legitimate traffic, and enables blocking selectively for high-confidence signatures - typically exploit signatures for specific CVEs - while leaving broad heuristics in alert mode. This targeted use is often called virtual patching: blocking exploitation of a known vulnerability on the wire while the actual patch is tested and rolled out. It is a compensating control, not a fix, and it fails against encrypted traffic the IPS cannot decrypt and against exploit variants that the signature does not match.\n\nRelated concepts: a web application firewall (WAF) is an application-layer IPS specialised in HTTP, operating on parsed requests rather than packets; host-based IPS functionality is today largely absorbed into EDR; and the IPS modules in NGFWs have largely replaced standalone appliances in enterprise perimeters, although standalone sensors remain common in data centres and OT environments where inline blocking must be tightly controlled.","da":"En IPS er en detektionsmotor, der har fået beføjelse til at handle, og det kræver, at den sidder inline - som en transparent bro, et routet hop eller et modul i en next-generation firewall - så hver pakke passerer den, før den sendes videre. NIST SP 800-94 behandler IDS og IPS samlet som IDPS og nævner de typiske forebyggende handlinger: at kassere den skadelige pakke, afbryde sessionen med TCP-resets, blokere kildeadressen i en periode, omskrive eller normalisere skadeligt indhold og instruere en firewall eller router i at ændre sine regler. I open source-opsætninger kører Suricata eller Snort i IPS-tilstand ved at modtage pakker fra kernen via mekanismer som Linux NFQUEUE eller AF_PACKET i inline-tilstand og returnere en afgørelse for hver enkelt; kommercielle appliances bruger dedikeret hardware til at inspicere ved linjehastighed.\n\nAt sidde inline ændrer de tekniske rammer. IPS'en tilføjer forsinkelse og bliver et single point of failure, så designet skal vælge mellem fail-open (trafikken går uden om inspektionen, hvis motoren eller enheden fejler, ofte via et hardware-bypassmodul) og fail-closed (trafikken stopper). Leverandørernes tal for gennemløb forudsætter som regel et minimalt regelsæt; aktiveres alle signaturer, TLS-dekryptering og filinspektion, kan det reelle gennemløb falde betydeligt. Strømsamling og protokolnormalisering skal være fuldført, før der træffes en afgørelse, fordi en IPS i modsætning til en passiv IDS ikke kan rekonstruere trafikken bagefter.\n\nFalske positiver er den driftsrisiko, der mest adskiller en IPS fra en IDS: en falsk positiv i en IDS koster analytikertid, en falsk positiv i en IPS er et selvforskyldt nedbrud. Udrulning starter derfor normalt i ren detektionstilstand, måler hvilke signaturer der udløses af legitim trafik, og slår blokering til selektivt for signaturer med høj træfsikkerhed - typisk exploit-signaturer for konkrete CVE'er - mens brede heuristikker forbliver i alarmtilstand. Denne målrettede brug kaldes ofte virtuel patching: udnyttelse af en kendt sårbarhed blokeres på nettet, mens den egentlige patch testes og rulles ud. Det er en kompenserende kontrol, ikke en rettelse, og den svigter over for krypteret trafik, som IPS'en ikke kan dekryptere, og over for exploit-varianter, som signaturen ikke matcher.\n\nBeslægtede begreber: en web application firewall (WAF) er en IPS på applikationslaget, specialiseret i HTTP og arbejdende på parsede forespørgsler frem for pakker; værtsbaseret IPS-funktionalitet er i dag stort set opslugt af EDR; og IPS-modulerne i NGFW'er har stort set erstattet selvstændige appliances ved virksomhedens perimeter, selv om selvstændige sensorer stadig er almindelige i datacentre og OT-miljøer, hvor inline-blokering skal styres stramt."},"edges":[{"type":"requires","to":"cs/packet","confidence":"high","strength":"normal"},{"type":"requires","to":"cs/firewall","confidence":"high","strength":"normal"},{"type":"kind-of","to":"security/control","confidence":"high","strength":"normal"},{"type":"mitigates","to":"security/vulnerability","why":{"en":"It can block attempts to use a known weakness while a patch is still pending.","da":"Den kan blokere forsøg på at udnytte en kendt svaghed, mens en patch stadig mangler."},"confidence":"medium","strength":"minor"}],"depth":4,"sources":[{"title":"Cyber Security Fast Track - Ordliste","tier":"course-material"},{"title":"NIST SP 800-94 - Guide to Intrusion Detection and Prevention Systems (IDPS)","tier":"standard","publisher":"NIST"}],"draft":true}