Firewalls and IDS/IPS

A secure network needs both enforcement and visibility.

A firewall enforces policy by allowing or blocking traffic at a network boundary or host. An intrusion detection system (IDS) examines activity and reports behavior that may be malicious. An intrusion prevention system (IPS) adds the ability to stop selected traffic, usually because it sits inline with the flow.

These controls answer different questions:

The distinction matters. A firewall can correctly allow an HTTPS connection that carries a malicious request because the policy permits HTTPS. An IDS may recognize the request as suspicious but cannot block it when deployed passively. An IPS can block it, but a false positive can now interrupt legitimate traffic.

This chapter explains how packet filters, stateful firewalls, application-aware controls, IDS, and IPS make decisions; where they should be placed; and how to operate them without turning the security control itself into an outage.