The great intrusion prevention debate

When we pioneered IPS in 2002, IDS vendors unanimously claimed it was impossible. Most were quick to point out that false positives and latency would adversely impact the network. Ironically, these problems were created by inferior implementations of IDS products. Today every single IDS vendor offers an IPS. The problem is, not all IPSes are created equal, and indeed most of the shortcomings you highlight are true for the vast majority of these products, but not all. Second, it is common practice for naysayers to pick a corner case scenario that cannot be caught by today’s IPS products and to ignore the other 99 percent of cases that are fully covered.

MR: Misinformed? Please. Sourcefire, with the broader Snort community, invented the techniques for identifying threats targeting an underlying vulnerability -- as opposed to simple exploit signatures. Regarding the hardware-vs.-software debate, knowing the performance of our IPS products on today’s advanced network platforms -- near-zero latency at up to 8 gigabits -- while also knowing that we can adapt infinitely more quickly and cost-effectively than hardware-based approaches certainly allows me to sleep much better at night.

When Sourcefire questioned those who declared IDS dead, it wasn’t because we saw no value in the blocking function. It was because we knew that the blocking function could never be 100-percent effective. Your acknowledgement of the need for behavioral anomaly detection argues that exact point. Leveraging persistent awareness of network assets -- their composition, behaviors, vulnerabilities, and change -- is at least as important as inspecting the traffic targeting those assets. So rather than simply following the herd, Sourcefire has both embraced IPS -- one of our products won Best Intrusion Solution at this year’s RSA show -- while also recognizing the limitations of any filtering technology in the broader landscape of network threat.

When the final chapter on this debate is written, I am confident that intrusion prevention will mean much more than just IPS.