Introduction to Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS)
What this domain tests
This domain tests whether you can distinguish detection from prevention, choose signature or anomaly methods, place sensors correctly, and tune alerts for OT. The key judgment is that blocking traffic in a control network can be riskier than alerting on it.
Core rules
- An IDS detects and alerts; an IPS can block inline. Signature detection matches known patterns; anomaly detection compares behavior with a baseline. Both produce false positives that need tuning.
- In OT, passive IDS is common because it can be fed from a SPAN port or network TAP without adding latency or a failure point. Inline IPS can drop safety-critical traffic or break a fragile protocol.
- Use protocol-aware inspection for Modbus/TCP, DNP3, and EtherNet/IP: unauthorized function codes, writes to protected registers, new masters, and abnormal request rates are high-value alerts.
- Place sensors at zone boundaries, the DMZ, and key control-network choke points. East-west traffic inside the control network matters as much as perimeter traffic.
- Define response before deployment: who triages, what is isolated, and when an alert justifies blocking. Tune with known-good baselines and change tickets.
- Encrypted or proprietary traffic may limit inspection, so combine network data with endpoint and log sources.
Worked example
An IDS alerts on a Modbus write from an engineering laptop to a PLC at 02:00. Reasoning: the signature is a write function code to a protected PLC. First verify the asset baseline and change schedule. If no approved change exists, treat it as unauthorized: preserve logs, contact the owner, and isolate the laptop or restrict its route. If a maintenance ticket exists, document it and add a narrow exception or tune the rule. Do not auto-block the PLC link until you know the operational consequence.
Traps
- Deploying an inline IPS on a safety-critical link without a fail-safe design.
- Monitoring only the IT/OT boundary and missing control-network east-west traffic.
- Assuming encryption can be inspected without keys or a proxy.
- Never tuning, so operators ignore alerts.
- Confusing IDS with antivirus or with vulnerability scanning.