McAfee GUARD DOG 2 Guía de instalación descargar pdf (Pagina 15)

McAfee

IntruShield

IPS System IntruShield Best Practices

Special Topics: Best Practices Initial tuning

Sensor actions

There are multiple sensor actions that are available for configuration per attack. These

include:

 Dropping Further Packets: Only works in in-line mode. Will drop a detected attack

packet and all subsequent packets in the same flow.

 Firewall Action: Sensor will communicate with a designated firewall to dynamically

configure ACL's. This feature works with a limited number of firewalls and is rarely

used in the field. Future software releases will add the implementation of ACL's to

sensor capabilities

Response management

When an IntruShield sensor detects activity to be in violation of a configured policy, a

preset response from the sensor is integral to the protection or prevention process.

Proper configuration of responses is crucial to maintaining effective protection. Critical

attacks like buffer overflows and DoS attacks require responses in real time, while

scans and probes can be logged and researched to determine compromise potential

and the source of the attack.

Developing a system of actions, alerts, and logs based on specific attacks or attack

parameters (such as severity) is recommended for effective network security. For

example, since IntruShield can be customized to protect any zone in a network,

knowing what needs to be protected can help to determine the response type. If

monitoring outside of the firewall in in-line mode, preventing DoS attacks and attacks

against the firewall is crucial. Most other suspicious traffic intended for the internal

network, including scans and low-impact well-known exploits, are best logged and

analyzed as the impact is not immediate and a better understanding of the potential

attack purpose can be determined. Thus, if you are monitoring outside of a firewall in

in-line mode, it is important to not set the policies and responses so fine that they

disrupt the flow of traffic and slow down the system; rather, prevent the crippling traffic

from disrupting your network.

Remember that response actions are decoupled from alerting. Pay particular attention

to this with the Recommended For Blocking (RFB) category of attacks, lest you enable

blocking for an attack, but disable alerting, causing the attack to be blocked without your

knowledge. (Unless that is your goal.)

Note

See Chapter 7 of the Manager Administrator’s Guide for more details on sensor

actions.

1 2 ... 10 11 12 13 14 15 16 17 18 19 20 ... 24 25

Sin comentarios

McAfee GUARD DOG 2 Guía de instalación Pagina 15