The result is a confused marketplace. "Since there are so many different ways to detect an attack, it’s very unclear what you mean when you use a term such as intrusion prevention," says Pete Lindstrom, research director for Spire Security, an independent analyst company.

Lindstrom and other analysts differentiate true intrusion prevention systems from older technologies, such as firewalls and IDSs, that have been updated with new "prevention" features. Broadly speaking, the new crop of IPS products fall into two categories: host-based intrusion prevention (HIP) products such as those offered by Entercept, Harris and Okena; and even newer network-based intrusion prevention appliances offered by companies including Intruvert, OneSecure and TippingPoint.

Locking Down the Host

A HIP product protects servers and workstations through software agents that sit between applications and the OS’s kernel. It intercepts system activity on the lowest level—disk read-write requests, network connection requests, and attempts to change the registry and write to memory—and either allows or denies the activity based on predetermined rules. For example, an application would not be able to modify certain files or change data in the system registry. A HIP system can also block behavior that is clearly malicious, such as rewriting OS executables. The upshot is that most security exploits simply won’t work. Attackers might be able to get through your network defenses to a server, but they couldn’t actually do anything once they got there.

For Stuart McClure, president and CTO of Foundstone, host-based intrusion prevention is a much-needed stopgap measure. Foundstone, a security software and services company, uses Entercept to protect its servers against known vulnerabilities without having to install security patches first. This lets the company test and install patches on a monthly schedule instead of rushing to install them as soon as they are released.

A HIP benefits from contextual information about the server being attacked, which can make it more efficient than blanket network security. "You can get a microscopic analysis of what’s going on," says Ed Skoudis, vice president of security strategy for Predictive Systems, an IT consultancy that works with both Okena and Entercept. A HIP system on a Solaris box can safely ignore attacks aimed at Windows systems, for instance. And because they focus on behavior, HIP systems can resist never-before-seen attacks, whereas network-based IDS and IPS systems require constant updates to identify the latest worms, viruses and exploits.

There are downsides to host-based intrusion prevention, however. It’s useless against intrusions aimed at your network in general—such as denial-of-service attacks. You also need to install it on every system you want to protect, which can create a deployment headache. (HIP vendors have only recently started adding enterprise-level management tools to their products.) HIP also uses some system resources, although McClure estimates only 2 percent to 5 percent of CPU time.