Knowledge / detection network acsc-glossary

Intrusion prevention system (IPS)

IDS with a fist. Identifies unwanted traffic and can block it in the moment. Mis-tune it and you become the outage.

An IPS identifies malicious or unwanted activity and can block it in real time. Host or network. Compensating controls for a known web flaw often live here or on a WAF.

Put it in-line only when you can fail closed or fail open on purpose, and when someone owns false positives at 2am. Prevention that pages the whole company for a banner ad is not prevention.

Fact source: ASD's ACSC glossary.