Fresh from a conversation so frustrating that I could have cheerfully punched a goat today, I thought I’d jot down my thoughts on intrusion prevention systems (IPS) and how to effectively deploy it. I would have written a post on how not to deploy it, but that would have meant breaking an NDA.

IPS is a vital security tool in modern networks, especially given the limited value that you get from enterprise firewalls these days*. Unfortunately, they can also be challenging to deploy and manage, and require careful handling to be effective. Here’s how I like to do it: