A potential solution to the problem of building more secure but still affordable and timely systems is to combine Commercial-Off-The-Shelf (COTS) hardware and software with proven techniques from the fault tolerant community. A prestigious University such as Princeton approach to achieve such stability forgo a COT solution an invested in a Intrusion Prevention Systems (IPS).
Intrusion Prevention Systems (IPS)
Intrusion Prevention Systems (IPS) are network-based devices or host-based applications that protect systems against computer hacking attacks by analyzing each message passing through it. The messages that match any of the thousands of known attack patterns or "signatures," messages that violate domestic and international networking standards, attempts to scan network devices, denial of service attacks, reconnaissance activity (i.e., testing computers to find less protected systems).
Once an attack is detected, the IPS can be configured to take any of the following actions:

It can capture information about the attack to a log file.
It can continue to capture subsequent data from a suspicious source.
It can drop the message completely.
It can drop subsequent messages from a suspicious source.
It can e-mail and/or page appropriate support personnel.
Types of network-based IPS solutions
In-line Intrusion Prevention Systems: An in-line IPS must positioned between the untrusted network environment and the trusted network it is intended to protect. All traffic that is to be screened must pass through the IPS for analysis and, if certain criteria are met, for discard.
Out-of-band Intrusion Prevention Systems: An out-of-band IPS is connected to the network infrastructure in a manner that allows it to view all traffic passing through the networking equipment without being physically between the sending and receiving devices. Since the network traffic does not pass through an out-of-band IPS, it cannot merely drop communication messages that it determines are malicious. Instead, the out-of-band IPS issues transactions to both devices to mimic a break in their communication session which should cause the offending message to not be processed by the receiving computer.
The University has chosen to deploy in-line IPS solutions primarily because there is less certainty that an out-of-band IPS will stop the processing of all identified malicious communications traffic.

Even though the University has centrally managed intrusion prevention systems, the use of a departmentally managed IPS can provide value by protecting departmental systems against attacks by any computer on our network that has been infected by a virus or any other form of malicious software. Additionally, it is likely that a departmental IPS can be configured with a more aggresive set of rules than we can deploy centrally due to the diversity of computer equipment we must support.

A potential solution to the problem of building more secure but still affordable and timely systems is to combine Commercial-Off-The-Shelf (COTS) hardware and software with proven techniques from the fault tolerant community. COTS software and hardware can provide cheap (though unreliable) components to build information systems.

Fault tolerant techniques can build reliable systems from unreliable components despite intermittent or transient faults. In fact, highly available systems have been built with this approach. There have been many other explorations of fault-tolerant approaches to providing reliable systems based on COTS hardware and software. Most fault tolerant techniques work against faults that can be modeled as rare events occurring at random. The external faults that pertain specifically to computer and network security have different characteristics. These “faults,” namely, computer and network attacks, can occur frequently and repeatedly. Their success depends on internal faults that are usually called vulnerabilities. These vulnerabilities are most often design, programming, or configuration mistakes, which cause software components to exhibit unintended behavior when presented with data or circumstances not foreseen by the developer or administrator. Vulnerabilities can be exploited by an attacker to obtain privileges or to inject additional errors into the system or to deny service to the system’s legitimate users. An attacker can explore a series of potential vulnerabilities until successful, and when successful, he can repeatedly use the exploit that provided success against the same system or other systems with the same vulnerability. These security-related faults not only can propagate from one machine to another (most dangerously, from a primary system to its backup system) but they are highly likely to repeat in time. This implies a significant additional value for fault diagnosis, including machine learning techniques, and system adaptation for intrusion prevention. Early in the development of fault tolerant computing, considerable attention was paid to fault diagnosis. With the recognition that most software faults were Heisenbugs and the importance of failfast semantics to minimize mean time to repair, fault diagnosis became a luxury. To combat the long-lived, persistent, and malicious characteristics of computer and network attacks, additional innovative techniques are required. One area of research, which has been applied to this domain by others, is the study of Byzantine faults. Byzantine faults are arbitrary faults, that is, faults not defined by the fault model of the system. As such, they represent a large, indeed, infinite class of faults. A fundamental result from the study of Byzantine faults is that fault tolerance for n Byzantine faults requires 3n+1 redundant components. Therefore, implementations of the algorithms for Byzantine fault tolerance may quickly become impractical, both because of cost and because of system complexity.

Our approach is to augment standard fault tolerant techniques with active defenses and design diversity. Repeatable errors are prevented by an out-of-band control system, which modifies the system security posture in response to detected errors. Where feasible, the system employs COTS-supplied design diversity (different operating systems and server applications like web servers or Data Base Management Systems). These measures are combined with fault tolerant techniques (including failure detection, failfast semantics, redundancy, and failover) to tolerate intrusions. This paper describes the system called HACQIT (“hack-it”)1. In the remainder of this section, we describe our assumptions and the system hardware and software architecture. Section 2 describes our attack identification and learning mechanisms. Section 3 describes a special type of detection by diversity. Section 4 describes isolation mechanisms. Section 5 describes continual repair. Section 6 contains the conclusions supported by our work so far.