McAfee SAV85E - Active VirusScan - PC Manual de usuario descargar pdf (Pagina 18)

White Paper Access Protection in McAfee VirusScan Enterprise and

Host Intrusion Prevention

“Prevent modiﬁcation of VMware Server ﬁles and settings”

Intention: This rule protects VMware Server registry values and processes from alteration or deletion by

malicious code.

Risks: This rule protects the VMware Server product from modiﬁcation by any process not listed in the

policy’s exclusion list.

“Prevent modiﬁcation of VMware virtual machine ﬁles”

Intention: This rule protects VMware virtual machine ﬁles from alteration or deletion by malicious code.

Risks: This rule protects the VMware virtual machine ﬁles from modiﬁcation by any process not listed in

the policy’s exclusion list.

User-deﬁned Rules

There are three purposes a rule can have:

Prevent malicious code running in the ﬁrst place

•

If malicious code is running, prevent it from spreading to other computers

•

If malicious code is running, prevent a payload from damaging the local computer

•

And for each of those categories there are two sub-divisions:

Target the rule at a known, newly discovered threat

•

Target the rule at all unknown future threats of a particular type

•

In all cases we are assuming that the regular virus detection is unable to detect the code—probably

because we are in the small window after the worm goes wild and before .DATs are released

and distributed.

Targeting Rules at New, Known Threats

Introduction

The ﬁrst reference for these will be the VIL entry for the newly discovered threat. For example, if

W32/Bagle.ab@MM has just been discovered, then the VIL page

http://vil.nai.com/vil/content/v_125089.htm will exist but the .DATs will not have been released yet.

The ﬁrst priority will be to create one or more rules that prevent virus from infecting your computers.

However, because the virus is known to be in the wild, you can assume that some of your computers are

infected. Therefore, the second priority is to create rules that help identify those computers, and prevent

the virus from spreading and causing damage.

1 2 ... 13 14 15 16 17 18 19 20 21 22 23 24

Sin comentarios

McAfee SAV85E - Active VirusScan - PC Manual de usuario Pagina 18