IPS

What is an IPS?

An IPS (Intrusion Prevention System) is a security system that analyses network or host activity for attacks and suspicious behaviour and, on a match, intervenes itself by blocking the traffic, terminating the session or taking another protective action. Where an IDS only raises an alert, an IPS usually sits inline in the connection and can stop an attack before it reaches its target, without waiting for an administrator to respond. In office networks an IPS is a standard feature of the next-generation firewall. In OT environments it is deployed far more carefully, because a wrongful block can bring a production process to a halt.

⚙️ How does an IPS work?

An IPS inspects inbound and outbound traffic in real time, often down to the application layer using deep packet inspection. The NIST guide SP 800-94 (Guide to Intrusion Detection and Prevention Systems, 2007) distinguishes three detection methods:

• Signature-based - compares traffic with patterns of known attacks and exploits; accurate, but blind to new zero-days
• Anomaly-based - compares behaviour with a learned baseline (anomaly detection); catches unknown attacks, but produces more false positives
• Stateful protocol analysis - checks whether traffic follows the protocol specification, for example whether a Modbus function code is valid and fits the current session

On a match, an IPS can:

• Drop packets - the malicious packet never arrives, while the rest of the connection continues
• Terminate the session - with a TCP reset to one or both sides
• Block a source - temporarily stop all traffic from an IP address or port
• Trigger other systems - add a rule to a firewall, redirect traffic to a quarantine segment or send an event to the SIEM for coordinated action
• Log and alert - every action is recorded for analysis and forensic investigation

Open-source engines express this as rule actions. Suricata, for instance, has alert, pass, drop and reject: the same rule can merely alert in IDS mode and drop the packet in IPS mode.

🧱 What types of IPS are there?

NIST SP 800-94 distinguishes four classes, which are often combined in practice:

🔄 What is the difference between an IDS and an IPS?

Technically, IDS and IPS often share the same engine and the same rules. The difference lies in their position in the network and in their authority to intervene.

Many products are therefore an IDPS: a single system that can be set per segment or per rule to detect only or to block as well.

🏭 How do you deploy an IPS in industrial networks?

In OT, availability weighs more heavily than confidentiality. An IPS that wrongly blocks a write command to a PLC can ruin a batch or stop a plant. Industrial IPS solutions and industrial firewalls with an IPS function therefore have some distinctive features:

• OT protocol awareness - they understand Modbus, DNP3, OPC UA, S7comm and IP and can, for example, block all write or programming commands while letting read requests from SCADA through
• Hardware bypass - on power loss or a software fault the appliance passes traffic through (fail-open) so the process keeps running; at a safety-critical boundary fail-closed may be preferred instead, see fail-safe
• Virtual patching - an IPS rule blocks exploitation of a known vulnerability in a PLC or HMI that cannot be patched yet, bridging the gap until the next maintenance window in patch management
• Learning phase - weeks in detection mode first, then blocking only for rules that do not affect legitimate traffic

Preferably place an IPS at the boundary between IT and OT, in or around the DMZ or IDMZ, and on conduits between zones in the Purdue Model. Keep it out of time-critical fieldbus links: PROFINET IRT runs with cycle times of one millisecond or less, and safety protocols such as PROFIsafe monitor every telegram with a watchdog time. Added delay or an unexpectedly dropped packet can trigger a communication fault or a safe stop there.

🧭 How do you introduce an IPS step by step?

1. Inventory and segment - define zones and conduits according to the zones and conduits model and map assets and protocols.
2. Choose the position - start at the IT/OT boundary and on conduits carrying remote access, not at cell or field level.
3. Run in detection mode - let the system observe for two to four weeks, including maintenance and product changeovers, and tune rules for false positives.
4. Enable blocking selectively - first for clear-cut cases such as known exploits, scans and forbidden function codes; keep the rest on alert.
5. Test and document - test bypass and failover during a maintenance shutdown and record every rule change through change management.
6. Connect to monitoring - forward all events to the SIEM or OT SOC and agree who may lift a block.

🔐 What role does an IPS play in Defense in Depth and regulation?

An IPS is one layer within Defense in Depth and does not replace other measures. It works alongside firewalls, IDS, SIEM, VPN, network segmentation and host protection. In IEC 62443-3-3 it maps to the system requirements for zone boundary protection (SR 5.2), malicious code protection (SR 3.2) and continuous monitoring (SR 6.2). The OT guide NIST SP 800-82 (revision 3, September 2023) treats detection and prevention as a complement to segmentation and stresses that security measures in OT must first be tested for their effect on the process.

For Dutch organisations covered by the Cybersecurity Act (Cyberbeveiligingswet), in force since 15 August 2026, an IPS is not a requirement in itself. It is, however, a common technical measure to prevent and detect attacks, and its logging supports the incident reporting obligation.

❓ Frequently asked questions

What does IPS stand for?

IPS stands for Intrusion Prevention System. An IPS detects attacks in network or host traffic and blocks them itself, whereas an IDS (Intrusion Detection System) only alerts. Systems that can do both are also called IDPS.

Is an IPS part of a next-generation firewall?

Yes, almost every next-generation firewall has a built-in IPS function that checks traffic for attack patterns alongside port and application rules. A standalone IPS appliance is mainly still found where throughput is very high or in industrial networks that need specific protocol knowledge.

Can an IPS disrupt the production process?

Yes, an IPS can disrupt a production process if a false positive blocks legitimate traffic or if the appliance itself fails without a bypass. That is why an IPS in OT first runs in detection mode, blocks only clearly malicious traffic and stays out of time-critical fieldbus links.

What is virtual patching with an IPS?

Virtual patching means that an IPS rule blocks exploitation of a known vulnerability before the vulnerable system itself has been patched. In OT this is useful because a PLC or HMI often can only be updated during a maintenance shutdown. It is a stopgap, not a replacement for the patch.

Does an IPS help with encrypted traffic?

With encrypted traffic, such as OPC UA with encryption, a network IPS only sees metadata such as addresses, ports and certificates. Inspecting the content then requires TLS inspection at the boundary or a host IPS on the endpoint.

Which open-source IPS engines exist?

The best-known open-source IPS engines are Snort and Suricata. Snort was developed by Martin Roesch in 1998 and has been part of Cisco since the acquisition of Sourcefire in 2013. Suricata, first released in 2010, is developed by the Open Information Security Foundation and has rule keywords for Modbus, DNP3 and EtherNet/IP, among others.

📌 In summary

An IPS detects attacks in network or host traffic and intervenes itself by blocking traffic or terminating sessions, whereas an IDS only alerts. In OT environments it sits on carefully chosen boundaries, first in detection mode and with a bypass, so it adds a valuable layer to a cybersecurity architecture without disrupting production.