Intrusion prevention

Intrusion prevention, at its most basic, requires some way of recognizing intrusions in real time, of being able to handle both known and unknown types of attacks, and then having a way of blocking the incursions. This can happen in two ways:

* Network-based intrusion prevention puts a device directly on the network in a critical data path that inspects all the traffic allowed through by the firewall, which is the first line of perimeter defense. Those prevention products use various methods to spot trouble, such as looking for the characteristic signatures of known viruses or comparing the current traffic to a baseline of normal traffic behavior. If the devices detect anomalies, they block the traffic from continuing onto the network.

* Host-based intrusion prevention places intelligent agents on each host computer or server to flag intrusions by comparing the behavior of systems against

expected norms. If deviations occur, the systems then have some way of blocking the procedures that are causing the anomalous behavior without affecting the machine's normal operations.

About the Author

Brian Robinson is a freelance writer based in Portland, Ore.

Featured

  • IT Modernization
    Eisenhower Executive Office Building (Image: Wikimedia Commons)

    OMB's user guide to the MGT Act

    The Office of Management and Budget is working on a rules-of-the-road document to cover how agencies can seek and use funds under the MGT Act.

  • global network (Pushish Images/Shutterstock.com)

    As others see us -- a few surprises

    A recent dinner with civil servants from Asia delivered some interesting insights, Steve Kelman writes.

  • FCW Perspectives
    cloud (Singkham/Shutterstock.com)

    A smarter approach to cloud

    Advances in cloud technology are shifting the focus toward choosing the right tool for the job and crafting solutions that truly modernize systems.

Stay Connected

FCW Update

Sign up for our newsletter.

I agree to this site's Privacy Policy.