McAfee UTILITIES 4.0 Guía de usuario descargar pdf (Pagina 11)

Prevention you can divide administrative duties based on product features, such as IPS or

firewall.

Deploying Host Intrusion Prevention to thousands of computers is easily managed because

most computers fit into a few usage profiles. Managing a large deployment is reduced to

maintaining a few policy rules. As a deployment grows, newly added systems should fit one or

more existing profiles, and can be placed under the correct group on the System Tree.

Preset protection

Host Intrusion Prevention offers two types of protection.

Basic protection is available through the McAfee Default policy settings. This “out-of-the-box”

protection requires no tuning and generates few events. Clients can be initially deployed on a

large scale, even before you tune the deployment. For many environments this basic protection

may be sufficient.

Advanced protection is also available from some preconfigured IPS and firewall policies or by

creating custom policies. Servers, for example, need stronger protection than that offered in

basic protection.

Adaptive and learn mode

To further tune protection settings, Host Intrusion Prevention clients can create client-side rules

to server-mandated policies that block legitimate activity. The automatic creation of client rules

is permitted when clients are placed in

adaptive

learn

mode. In adaptive mode, available for

IPS, Firewall, and Application Blocking features, client rules are created without interaction from

the user. In learn mode, available for Firewall and Application Blocking features, the user

responds to alerts, indicating whether or not to create a client rule.

After client rules are created, you can analyze them decide which if any to convert to to

server-mandated policies. Adaptive and learn modes can be turned off at any time to tighten

the system’s protection.

Often in a large organization, avoiding disruption to business takes priority over security concerns.

For example, new applications may need to be installed periodically on some computers, and

you may not have the time or resources to immediately tune them. Host Intrusion Prevention

enables you to place specific computers in adaptive mode for IPS protection. Those computers

will profile a newly installed application, and forward the resulting client rules to the ePolicy

Orchestrator server. The administrator can promote these client rules to an existing or new

policy, then apply the policy to other computers to handle the new software.

Tuning

As part of Host Intrusion Prevention deployment, you need to identify a small number of distinct

usage profiles and create policies for them. The best way to achieve this is to set up a test

deployment, then begin reducing the number of false positives and generated events. This

process is called

tuning

Stronger IPS rules, for example, target a wider range of violations, and generate more events

than in a basic environment. If you apply advanced protection, McAfee recommends using the

IPS Protection policy to stagger the impact. This entails mapping each of the severity levels

(High, Medium, Low, and Information) to a reaction (Prevent, Log, Ignore). By initially setting

all severity reactions except High to Ignore, only the High severity signatures will be applied.

The other levels can be raised incrementally as tuning progresses.

Introducing Host Intrusion Prevention 7.0

Policy tracking and tuning

11McAfee Host Intrusion Prevention 7.0 Product Guide for use with ePolicy Orchestrator 4.0

1 2 ... 6 7 8 9 10 11 12 13 14 15 16 ... 111 112

Comentarios a estos manuales

Sin comentarios

McAfee UTILITIES 4.0 Guía de usuario Pagina 11

Comentarios a estos manuales

Relacionado con productos y manuales para Software McAfee UTILITIES 4.0