What are the differences between ids and utm?

Dear Fawaz and all,

The latest trend to emerge in the network intrusion prevention arena is referred to as unified threat management, or UTM. UTM systems are multilayered and incorporate several security technologies into a single platform, often in the form of a plug-in appliance. UTM products can provide such diverse capabilities as antivirus, VPN, firewall services, and antispam as well as intrusion prevention.

The biggest advantages of a UTM system are its ease of operation and configuration and the fact that its security features can be quickly updated to meet rapidly evolving threats.

Intrusion detection systems (IDSs) are designed to detect, log, and respond to unauthorized

network or host use, both in real time and after the fact. IDSs are available from a wide selection of vendors and are an essential part of network security. These systems are implemented in software, but in large systems, dedicated hardware is required as well. IDSs can be divided into two categories: network-based systems and host-based systems. Two primary methods of detection are used: signature-based and anomaly-based.

Hope you got it.

Regards/ Zubair Ahmed

The difference between them is the same difference between a bedroom and a bed. A bed is part of a bedroom. However, you can move the bed out of the bedroom and use it as a dedicated bed in the hallway, in balcony, or anywhere.

 IDS/IPS (also referred to as IDP) is part of UTM since2004 but you can still use it as a dedicated technology in its own hardware or software platform. Based on my experience with UTM firewalls in terms of security, i extremely encourage to use it. But in terms of performance, i extremely discourage using it and i would rather prefer using dedicated boxes. Why? The ASIC processor that is designed to run all these capabilities has shown no promising. In practice, when i turn on all of these nice looking capabilities all at once, the result is sluggish internet access, high firewall's CPU time, and inaccurate attack or virus detection. I would recommend UTMs for small to med size companies not enterprise ones. In addition to what Zubair has clarified, a UTM firewall also provides content/url filtering and load balancing.

Just correcting a minor thing on what just Zubair said, a firewall capability  is not a part of UTM itself because a UTM system is simply a firewall :) just a thought  

Utm as the name suggests, combines several security features such as stateful firewall, application controls,ISP,av,web caching into a single appliance . These features can be turned on as options to add capabilities to stateful firewalls.usually, the more features you turn on, the more impact it has on the overall firewall throughput. 

Ids are intrussion detection systems that mostly rely on signature similar to anti virus to detect know threats. As the name suggests, ids are mostly deplyed to detect and notify as opposed to prevent or block threats. Although some ids do have capabilities to respond to threats. Most ids are usually not deployed in line . Traffic is mirrored or copied. ips on the other hand are mostly deployed in line mode on the path of the traffic.