McAfee UTILITIES 4.0 Guía de usuario descargar pdf (Pagina 30)

Working with IPS Rules policies

The IPS Rules policy applies intrusion prevention safeguards. This policy is a multiple-instance

policy that can have multiple instances assigned. For example, for an IIS Server you might

apply a general default policy, a server policy, and an IIS policy, the latter two configured to

specifically target systems runnings as IIS servers.

Each policy contains details on:

• Exception Rules

• Signatures

• Application Protection Rules

You also need to go to the Host IPS tab under Reporting to work with:

• IPS Events

• IPS Client Rules

This policy category contains a preconfigured default policy, which provides basic IPS protection.

You can view and duplicate the preconfigured policy; you can edit, rename, duplicate, delete,

and export custom policies you create.

On the Policy Catalog policy list page, click New Policy to create a new custom policy; click

Duplicate under Actions to create a new custom policy based on an existing policy.

Change the policy’s assignment on the Policy Assignment page. For a group, go to Systems

| System Tree, select a group, and then on the Policies tab click Edit Assignment. For a

system, go to Systems | System Tree, select a group that contains the system, and then on

the System tab, select the system and select More Actions | Modify Policies on a Single

System.

To assign more than one instance of the IPS Rules policy on the Policy Assignment page,

click New Policy Instance, and select a policy from the Assigned Polices list for the additional

policy instances.

Tasks

Working with IPS signatures

Working with IPS Application Protection rules

Working with IPS Exceptions

Working with IPS events

Managing IPS client rules

Working with IPS signatures

Signatures describe security threats, attack methodologies, and network intrusions. Each

signature has a default severity level, which describes the potential danger of an attack:

• High — Signatures that protect against clearly identifiable security threats or malicious

actions. Most of these signatures are specific to well-identified exploits and are mostly

non-behavioral in nature. They should be prevented on every host.

• Medium — Signatures that are behavioral in nature and deal with preventing applications

from operating outside of their environment (relevant for clients protecting web servers and

Microsoft SQL Server 2000). On critical servers, you may want to prevent those signatures

after fine-tuning.

Configuring IPS Policies

Working with IPS Rules policies

McAfee Host Intrusion Prevention 7.0 Product Guide for use with ePolicy Orchestrator 4.030

1 2 ... 25 26 27 28 29 30 31 32 33 34 35 ... 111 112

Comentarios a estos manuales

Sin comentarios

McAfee UTILITIES 4.0 Guía de usuario Pagina 30

Comentarios a estos manuales

Relacionado con productos y manuales para Software McAfee UTILITIES 4.0