Prevention Always Fails
"Gartner sees IPS as the next generation of IDS, when they're likely the next generation of firewall," says Marty Roesch, founder of Sourcefire, an IDS vendor. Roesch is also the creator of Snort, an open-source, rules-based language for writing detection signatures.
Roesch insists that IDSs and IPSs are separate technologies with mutually exclusive functions. "IPS is access control, and IDS is network monitoring. IPS is policy enforcement, and IDS is audit. It's not the IDS's job to secure your network. Its job is to tell you how insecure it is."
But Roesch's distinction may not resonate in the wider security market. "Joe Average doesn't want to monitor traffic and comb through data and make changes in rules and policies based on detected attacks," says Jeff Wilson, executive director of Infonetics Research (www.infonetics.com). "They want to stop attacks."
-- end article --
Fine -- prevention is always preferable to detection. But prevention always fails, at some point. How do you determine the scope of a compromise when your IPS fails to detect and prevent an attack? You better be able to fail back on your audit capabilities, which log what they see and make no value judgements.