Choosing an Intrusion Detection or Intrusion Prevention System for PCI DSS

IDSes differ from IPSes in that they will only send alerts to the administrators if suspect activity is detected. An IPS will take corrective actions.

A network TAP provides the best possible connection point for any type of intrusion detection solution. It eliminates potential bottlenecks and dropped packets.

IPS solutions are considered the “next generation” of intrusion detection and, when properly configured, will take corrective actions in addition to alerting appropriate personnel.

source: PCI Compliances, Tony Bradley 2007