Architecture options – where does an IPS fit in your data center?
Where you should place an IPS in your data center is an important decision, so we'll discuss this decision while providing a dose of IPS/IDS history.
Back in the day, data centers were configured with a "crunchy shell, soft chewy center" architecture. In other words, protections were focused on the perimeter, to protect against external attacks. Internal systems were mostly trusted (usually trusted too much).
This put the IDS at the perimeter, often on a SPAN port or on a network tap. If you review the tap options that we discussed in Chapter 11, Packet Capture and Analysis in Linux, if deployed this way, it was normally a one-way tap, electrically preventing the IDS from sending traffic. This was to minimize the possibility that the IDS itself might be compromised.
A second, trusted interface would be used to manage the IDS.
This configuration evolved to eventually include the ability...
