IDS vs IPS:

1. IDS (Intrusion Detection System): passively MONITORS traffic and raises ALERTS when suspicious patterns are seen. Doesn't block. 2. IPS (Intrusion Prevention System): inline device that can DROP, RESET, or QUARANTINE traffic that matches malicious signatures. 3. DEPLOYMENT: • IDS: out-of-band (on a SPAN/mirror port) — no risk of false positives blocking legit traffic. • IPS: in-line — must be very accurate to avoid breaking legitimate sessions. 4. DETECTION methods: SIGNATURE-based (known attack patterns), ANOMALY-based (deviation from baseline), HYBRID. 5. Snort, Suricata, Zeek are common open-source examples. _Source: NIST SP 800-94 (Intrusion Detection and Prevention) — referenced from CSF DE.CM._