Adoption of IPS increasing, cautiously

摘要

Blocking attacks with intrusion-prevention systems rather than simply monitoring for them with intrusion-detection systems is slowly gaining ground inside corporations and government agencies, despite worries about disrupting legitimate traffic. But many organizations often don't use the full blocking capability of these products, whether installing them in a firewall-based Internet zone or deep inside a corporate LAN. To gain confidence that blocking won't backfire on them with false positives, organizations are using IPS in what's called mixed or bridge mode.This lets them stymie a portion of attack traffic, such as com- puter worms, but otherwise lets the IPS work like an in-line IDS.