McAfee UTILITIES 4.0 Guía de usuario descargar pdf (Pagina 8)

Basic protection

Host Intrusion Prevention ships with a set of default settings that provide basic “out-of-the-box”

protection for your environment. These settings include:

• IPS protection is enabled; high severity signatures are prevented and all other signatures

are ignored.

• Firewall, quarantine, and application blocking protection are not enabled.

• McAfee applications are listed as trusted applications for all rules except IPS self-protection

rules.

• Predefined applications and processes are protected.

Advanced protection

For advanced protection, switch from the default settings to stronger preset settings, or create

custom settings.

Start with a sample deployment to monitor and tune the new settings. Tuning involves balancing

intrusion prevention protection and access to required information and applications per group

type. You can do this manually or automatically by enabling learn or adaptive mode.

Types of Host Intrusion Prevention policies

A policy is a collection of settings that you configure and enforce through the ePolicy Orchestrator

console. Applying policies ensures that your security needs on managed systems are met. Host

Intrusion Prevention provides four policy features, each with a set of security options. These

are: IPS, Firewall, Application Blocking and General. Except for General, each feature

contains a “rules” policy with rules that define behavior, and an “options” policy that enables

or disables application of the rules.

Ownership of policies is assigned in the Policy Catalog. After a policy is created, it can be

edited or deleted only by the creator of the policy, the person associated as an owner of the

policy, or the global administrator. Deleting a policy can be done only in the Policy Catalog.

IPS policies

The IPS (Intrusion Prevention System) feature contains three policies that protect computers

with host intrusion prevention technology. It details exceptions, signatures, application protection

rules, events, and client-generated exceptions.

• IPS Options. Turns on or off IPS protection and application of adaptive mode.

• IPS Protection. Defines the reaction to events that signatures generate.

• IPS Rules. Defines exceptions, signatures, and application protection rules. This policy,

referred to as a multiple-instance policy, allows for a profile of settings through the application

of multiple policies under a single policy instance.

Firewall policies

The Firewall feature contains four policies that filter network traffic, allowing legitimate traffic

through the firewall and blocking the rest.

Introducing Host Intrusion Prevention 7.0

Types of Host Intrusion Prevention policies

McAfee Host Intrusion Prevention 7.0 Product Guide for use with ePolicy Orchestrator 4.08

1 2 3 4 5 6 7 8 9 10 11 12 13 ... 111 112

Sin comentarios

McAfee UTILITIES 4.0 Guía de usuario Pagina 8