Review: HP S330 IPS

The HP S330 Intrusion Prevention System is an appliance developed by TippingPoint, which was acquired by Hewlett-Packard more than a year ago. Designed for several different roles, the S330 can protect against the entry of malware from the Internet as well as protect and isolate sensitive information between internal network zones.

The device is easy to deploy and manage, either by itself or as part of a larger implementation — simply plug it into the proper Ethernet ports and to a source of electricity and it’s ready to go.

End-User Advantages

You won’t need a full IT department to deploy or operate the HP S330. While it might help to have someone who is trained in network security to set up the device, routine operation requires minimal training. Yet despite its relative simplicity, the S330 can protect the network against a range of malicious attacks — everything from port scanning to malware entry. IT departments can also use it to protect against undesirable activities, including instant messaging, Facebook updates or YouTube videos.

Once the S330 is installed and set up on the network, the device is highly configurable. You can set different parameters for different ports or segments —even for different IP addresses— and support up to four Ethernet streams.  You can also create security profiles that differ according to the type of anticipated threat and the nature of the network being protected.

For smaller offices, the S330 can be a self-contained IPS solution. It features a well-designed and flexible web interface that allows for a complete configuration, and then lets you create reports, view logs and see what threats have been blocked.

In addition to intrusion prevention, the S330 can perform a variety of traffic management tasks by limiting peer-to-peer links and streaming media, and it can rate-limit specific types of traffic. The device stays up to date by downloading HP’s Digital Vaccines twice a week, an application that targets the latest exploits and even zero-day threats.

Why It Works for IT

The HP S330 IPS solves a significant problem faced by every IT department: the need to do more with less. Very little IT staff time is required to get the device up and running. Once it is operational, only occasional support is needed, and nearly every function can be performed by onsite staff.

In large installations, multiple S330 devices can be managed by a single HP/TippingPoint Security Management System (SMS), a separate appliance that can manage the operation of the IPS devices across an enterprise, either in groups or individually. The SMS appliance includes an easy-to-use management application that provides an enterprisewide view in a single dashboard and management interface.

The S330 provides effective intrusion prevention whether the device is installed inside the firewall, outside the firewall or between network zones. This is serious security that also happens to be extremely easy to manage and implement.

Disadvantages

Initial configuration of the S330 requires the use of a serial port and terminal emulation software. This won’t be much of an issue for a dedicated IT staff, which is probably equipped to handle this requirement. But with serial ports having disappeared from notebook computers, and with Microsoft having dropped terminal emulation from Windows 7, smaller offices may find themselves looking for USB serial adapters and terminal emulators from the web. This is not an insurmountable problem, but another form of initial configuration would be welcome.