Application layer security
In the previous section, we looked at firewalls. Although they are one of the very important components in the network security architecture, they lack the functionality of scanning the data section of the TCP header.
This is one of the reasons why IPS was used along with firewalls. IPS has the capability to analyze the payload of the TCP packets and can block suspicious attempts accordingly.
Intrusion Prevention Systems
In order to understand IPS, let's take this real-world use case. In and around June 30, 2011, an exploit in vsftpd was introduced. Any system running the vulnerable version of vsftpd could be easily exploited to gain the shell to run any commands.
Since the exploit has a particular signature, the IPS system can block the exploit from reaching the server even if it is running a vulnerable version of the vsftpd application.
Many times, there are zero day exploits that are released and releasing a security patch does take time, maybe a day. In this case...
