Summary of differences

	IDS	IPS
Placement	Out-of-band or not in the direct lines of communication	In-band or in the direct pathway of communication
System type	Passive (monitoring and notify)	Active (monitoring and ability to take action)
Detection mechanisms	Signature detection Exploit facing	Statistical anomaly-based detection Signature detection Exploit facing or vulnerability facing

Keep in mind that an IDS listens and reports, but does not take any action, while the IPS listens and takes action if criteria is met.

Why?

A common way of looking at network security in terms of intrusion system is:

Security = Visibility + Control

Typically, the network and security teams place controls on a network, but how do they know if those controls are working if there is no visibility on the network? That is why we use IDS/IPS. IDS/IPS plays an important role as it acts as one of many complementary layers of IT security technology. While typically several security layers exist because no one layer can provide all the...