McAfee HISCDE-AB-IA Product Guide - Page 32

Configuring IPS Policies Overview of IPS policies • Protect against network denial-of-service attacks and bandwidth-oriented attacks that deny or degrade network traffic. Host Intrusion Prevention contains a default list of a small number of network IPS signatures for Windows platforms. You can edit the severity level, log status, and client rule creation setting of these signatures, but you cannot presently add custom network signatures. The list of signatures is updated if needed whenever you install a content update. Behavioral rules Behavioral rules block zero-day attacks and enforce proper operating system and application behavior. Heuristic behavioral rules define a profile of legitimate activity. Activity not matching these rules is considered suspicious and triggers a response. For example, a behavioral rule might state that only a web server process can access HTML files. If any other process attempts to access HTML files, action is taken. This type of protection, called application shielding and enveloping, prevents compromise of applications and their data and prevents applications from being used to attack other applications. In addition, behavioral rules block buffer overflow exploits, preventing code execution resulting from a buffer overflow attack, one of the most common methods of attacking servers and desktops. Reactions A reaction is what the Host Intrusion Prevention client does when a signature of a specific severity is triggered. The client reacts in one of three ways: • Ignore - No reaction; the event is not logged and the operation is not prevented. • Log - The event is logged but the operation is not prevented. • Prevent - The event is logged and the operation is prevented. A security policy might state, for example, that when a client recognizes a low-severity signature, it logs the occurrence of that signature and allows the operation to occur; and when it recognizes a high-severity signature, it prevents the operation. NOTE: Logging can be enabled directly on each signature. The IPS Protection policy automatically sets the reaction for signatures depending on severity level. Exceptions An exception overrides an activity blocked by the reaction to a signature. In some cases, behavior that a signature defines as an attack might be part of a user's normal work routine or an activity that is legal for a protected application. To override the signature, you can create an exception that allows legitimate activity. For example, an exception might state that for a particular client, an operation is ignored. You can create these exceptions manually, or place clients in adaptive mode and allow them to create client exception rules. To ensure that some signatures are never overridden, edit the signature and disable the Allow Client Rules options. You can track the client exceptions in the ePolicy Orchestrator console, viewing them in a regular, filtered, and aggregated views. Use these client rules to create new policies or add them to existing policies that you can apply to other clients. 32 McAfee Host Intrusion Prevention 8.0 Product Guide for ePolicy Orchestrator 4.5