McAfee UTILITIES 4.0 Guía de usuario descargar pdf (Pagina 36)

runs as a service. If not, it is blocked; if it listens on a port or runs as a service, it is permitted

to hook.

Figure 9: Application Protection Rules analysis

The IPS component maintains an information cache on running processes, which tracks hooking

information. The firewall component determines if a process listens on a network port, calls an

API exported by the IPS component, and passes the information to the API to be added to the

monitored list. When the API is called, the IPS component locates the corresponding entry in

its running processes list. A process that is not already hooked and is not part of the static block

list is then hooked. The firewall provides the PID (Process ID), which is the key for the cache

lookup of a process.

The API exported by the IPS component also allows the client user interface to retrieve the list

of currently hooked processes, which is updated whenever a process is hooked or unhooked.

A hooked process will be unhooked if the server sends an updated process list that specifies

that the already hooked process should no longer be hooked. When the process hooking list is

updated, every process listed in the information cache of running processes is compared against

the updated list. If the list indicates that a process should be hooked and it’s not already hooked,

that process will be hooked. If the lists indicate that a process should not be hooked and it is

already hooked, that process will be unhooked.

The process hooking lists can be viewed and edited on the Application Protection Rules

tab. The client user interface, unlike the view on the IPS Rules policy, shows a list of all hooked

application processes.

Configuring IPS Policies

Working with IPS Rules policies

McAfee Host Intrusion Prevention 7.0 Product Guide for use with ePolicy Orchestrator 4.036

1 2 ... 31 32 33 34 35 36 37 38 39 40 41 ... 111 112

Sin comentarios

McAfee UTILITIES 4.0 Guía de usuario Pagina 36