McAfee UTILITIES 4.0 Betriebsanweisung PDF herunterladen (Seite 24)

Configuring IPS Policies

IPS policies turn host intrusion prevention protection on and off, set the reaction level to events,

and provide details on exceptions, signatures, and application protection rules.

Contents

Overview of IPS policies

Working with IPS Options policies

Working with IPS Protection policies

Working with IPS Rules policies

Overview of IPS policies

The IPS (Intrusion Prevention System) feature monitors all system and API calls and blocks

those that might result in malicious activity. Host Intrusion Prevention determines which process

is using a call, the security context in which the process runs, and the resource being accessed.

A kernel-level driver, which receives redirected entries in the user-mode system call table,

monitors the system call chain. When calls are made, the driver compares the call request

against a database of combined signatures and behavioral rules to determine whether to allow,

block, or log an action.

Signature rules and how they work

Signature rules are patterns of characters than can be matched against a traffic stream. For

example, a signature rule might look for a specific string in an HTTP request. If the string

matches one in a known attack, action is taken. These rules provide protection against known

attacks.

Signatures are designed for specific applications and specific operating systems; for example,

web servers such as Apache and IIS. The majority of signatures protect the entire operating

system, while some protect specific applications.

Host and network IPS signature rules

Attacks can follow a signature pattern of characters. This signature can identify and prevent

malicious activity. For example, a signature is set to look for the string ../ in a web URL. If the

signature is enabled and the system encounters this string, an event is triggered.

Signatures are categorized by severity level and by the danger an attack poses. They are

designed for specific applications and for specific operating systems. The majority protect the

entire operating system, while some protect specific applications.

McAfee Host Intrusion Prevention 7.0 Product Guide for use with ePolicy Orchestrator 4.024

1 2 ... 19 20 21 22 23 24 25 26 27 28 29 ... 111 112

Keine Kommentare

McAfee UTILITIES 4.0 Betriebsanweisung Seite 24