Intrusion Prevention System (IPS)
PCIComplianceHubLast updated
An extension of intrusion detection systems that not only detects potential threats but also takes automated actions to block or prevent malicious activity, such as dropping packets, terminating connections, or reconfiguring network devices.
Applies to. 11.5.1 is written for intrusion-detection and/or intrusion-prevention techniques, so an IPS satisfies it in the same places an IDS would: all traffic at the perimeter of the Cardholder Data Environment and at critical points within it, alerts to personnel on suspected compromises, and engines, baselines and signatures kept current. Because an IPS performs a security function, its logs fall under the daily review in 10.4.1, its failure must be detected and alerted under 10.7.2, and its alerts must be handled by the incident response plan under 12.10.5.
Example. A payment gateway runs an inline IPS on the path between its public web tier and its transaction-processing segment. When a burst of requests matches the signature of a known application exploit, the IPS drops the connections and raises an alert, and the analyst who picks it up checks whether any request reached the application before the block engaged.
Limits. Blocking does not replace alerting: 11.5.1.b checks that personnel are alerted to suspected compromises, so an IPS set to drop traffic silently does not meet the requirement on its own. 10.7.2 lists network security controls and IDS/IPS as separate critical security control systems: an IPS acts on traffic that matches attack patterns, while a network security control decides which connections are permitted in the first place, and one does not stand in for the other. An IPS run in detection-only mode is an IDS for the standard's purposes, and an IPS whose signatures are stale fails 11.5.1.c however it is deployed.