Network defense: IDS, IPS and network segmentation

Firewalls decide what may pass. But traffic that is allowed can still be harmful: a permitted web connection might carry an attack, and a trusted laptop might already be compromised. Network defense adds two further ideas. The first is watching traffic for signs of trouble, the job of intrusion detection and prevention systems. The second is designing the network so that when something does go wrong, the damage stays small. That is segmentation.

IDS: the alarm system

An intrusion detection system (IDS) monitors network traffic or computer activity and raises an alert when it sees something suspicious. NIST’s guide to intrusion detection and prevention systems, SP 800-94, describes several kinds. A network IDS watches traffic on a network segment, usually from a copy of the traffic so it never slows it down. A host-based IDS watches activity on a single computer. An IDS only reports; a person or another system decides what to do.

How detection works

IPS: the alarm that can also lock the door

An intrusion prevention system (IPS) does everything an IDS does, but it sits in the path of the traffic and can act: drop a malicious packet, end a connection or block an address. The trade-off is risk. A false alarm in an IDS produces an unnecessary alert; a false alarm in an IPS blocks legitimate work. Many organisations therefore run new rules in detection-only mode first and switch to prevention once they trust them.

The encryption problem

Most traffic today is encrypted with TLS, which is excellent for privacy but means a network IDS can no longer read the content of web connections. Organisations respond in three ways. Some decrypt traffic at a proxy, which is invasive and breaks some apps. Some rely on metadata: which addresses talk, when, how much data flows, and what the connection announces before encryption starts, such as the server name. And some move detection onto the devices themselves, where traffic can be linked to the program that produced it.

FireAI follows the metadata and on-device approach on a Mac. It never decrypts your traffic. It reads what connections reveal in the clear, such as DNS lookups and the server name in a TLS handshake, and ties each connection to the app that made it. In Alert mode, the first time an app tries to reach a destination with no rule yet, FireAI pauses that connection and asks you, showing the app, the destination and, when it can tell, the country and company behind it, all without looking inside the encrypted content.

Segmentation: limiting the blast radius

In a flat network, every device can talk to every other device. If one is compromised, the attacker can move sideways, a technique called lateral movement, until they reach something valuable. Segmentation divides the network into zones and controls traffic between them. CISA recommends it as a core defense precisely because it contains intrusions: a compromised printer in one segment should not be able to reach the finance servers in another.

• VLANs split one physical network into several logical ones.
• Firewalls or access control lists between segments decide which zones may talk, and on which ports.
• A DMZ holds internet-facing servers, so a breach there does not open the internal network.
• Microsegmentation applies rules down to individual workloads or devices, a key idea in zero trust.

Segmentation at home and in small offices

You do not need an enterprise budget to use these ideas. Most home routers offer a guest network: put visitors, smart TVs, cameras and other IoT devices there, and keep your work computers on the main network. Change default passwords on routers and devices, and keep their firmware updated. On your Mac, a host firewall acts as a segment of one: FireAI’s Who’s online view lists the devices sharing your network, so an unexpected one stands out, and its rules decide what each app on your Mac may reach.