IPS technologies can respond to a detected threat by attempting to prevent it from succeeding. Briefly describe the three groups of response techniques they use.

Question

What will be an ideal response?

Answer 1

The IPS stops the attack itself. Examples of how this could be done are as follows:
1) Terminate the network connection or user session that is being used for the attack
2) Block access to the target (or possibly other likely targets) from the offending user account, IP address, or other attacker attribute
3) Block all access to the targeted host, service, application, or other resource.

The IPS changes the security environment. The IPS could change the configuration of other security controls to disrupt an attack. Common examples are reconfiguring a network device (e.g., firewall, router, switch) to block access from the attacker or to the target, and altering a host-based firewall on a target to block incoming attacks. Some IPSs can even cause patches to be applied to a host if the IPS detects that the host has vulnerabilities.

The IPS changes the attack's content. Some IPS technologies can remove or replace malicious portions of an attack to make it benign. A simple example is an IPS removing an infected file attachment from an e-mail and then permitting the cleaned email to reach its recipient. A more complex example is an IPS that acts as a proxy and normalizes incoming requests, which means that the proxy repackages the payloads of the requests, discarding header information. This might cause certain attacks to be discarded as part of the normalization process.