HP t5710 HP Sygate Security Agent and Symantec Embedded Security:Frequently As - Page 5

5

The following table compares the advantages of the whitelist and blacklist policies:

Q:

What viruses, worms, or vulnerabilities will HP Sygate Security Agent block?

A:

Both Microsoft Windows Firewall and HP Sygate Security Agent prevent worm attacks such as Blaster

and Sasser; however, only HP Sygate Security Agent has the ability to help stop propagation to other

systems due to the whitelist approach which allows only known, listed programs to access the

network.

Assessing your vulnerability to an attack is one of the most important steps that you can take to

ensure that your system is protected from possible intruders. The information from this assessment can

help you set the various options on your Agent to protect your system from attack. The Sygate Online

Services (SOS) scanner scans your computer and attempts to determine your IP address, operating

system, Web browser, and other information about your system. You can then choose one of the

following more focused scans:

•

Quick Scan: Encompasses several scanning processes to perform a brief, general scan. It

usually takes 20 seconds or less to accurately scan your devices ports, protocols, services,

and possible Trojans. It records the results in the Agent Security Log.

•

Stealth Scan: Uses specialized stealthing techniques that mimic portions of legitimate com-

puter communication to detect the presence of a computer. The Stealth scan takes about 20

seconds to complete and is most likely not recorded in the Security Log.

Policy

Advantages

Disadvantages

Blacklist Firewall

Policy

•

Building and managing a firewall policy can be a

time-consuming and frustrating process for both

the administrators and the users. A firewall with a

default blacklist can be installed without first

defining a security policy for access through the

firewall.

•

With a default blacklist policy, it is possible to

quickly install a firewall without a significant

amount of up-front security competency required

by the installers.

•

It is more prone to allow undesired

behavior and security policy

violations, such as reverse-tunnels,

trojans, worms, and similar

attacks.

•

It is difficult to switch from a default

blacklist to a whitelist model.

Whitelist Firewall

Policy

•

Greater security because only known services

and network activities are allowed by default. This

minimizes the effectiveness of trojans, viruses, and

worms that use unknown, unlisted programs.

•

It is easy to switch a default whitelist firewall to a

blacklist firewall.

•

Installing a whitelist firewall takes more up-front

time, because you must determine the list of what

to allow through the firewall before it is installed

and functional.

•

Managing a whitelist firewall

policy is more time consuming in a

network with actively changing

needs and demands.

•

It can be a frustrating to users

because they have to request

access to services, rather than

having access by default.

Section	Page
HP Sygate Security Agent and Symantec Embedded Security: Frequently Asked Questions	1
Question and answers	2
Overview	2
Q: Are thin clients susceptible to viruses or worms?	2
1. With the HP thin client computing model, your exposure to virus attack on the thin client system is less than a standard Wind...	2
2. The HP thin client computing model utilizes PC blades and/or servers located in the data center. You can protect and monitor ...	2
3. Since no user data resides on the thin client, there is no risk of user data loss due to a virus or worm on the thin client.	2
4. If a thin client’s image is compromised or corrupted, the recovery time is typically measured in minutes instead of hours. You can often perform recovery with a simple reboot of the client.	2
Q: What does HP deliver in the factory image?	2
Q: What is the free functionality?	3
Q: How can I get signature updates for the Sygate firewall to ensure protection from the latest threats?	3
Q: How can I obtain antivirus support for my thin clients?	3
Q: How do I buy Symantec Embedded Security?	3
Firewall questions	4
Q: What approach has HP taken to secure my thin client?	4
Q: How is the HP Sygate Security Agent different than Microsoft Windows Firewall?	4
Q: What is the difference between a whitelist and a blacklist approach?	4
Q: What viruses, worms, or vulnerabilities will HP Sygate Security Agent block?	5
Q: How do I use the SOS scanner?	6
1. Double-click the Sygate icon to launch the HP Sygate Security Agent GUI.	6
2. Select Tools > Test Your System Security to automatically launch Internet Explorer and links to SOS at http://scan.sygate.com.	6
3. From the Sygate site, select the tests you want to perform.	6
Q: Which inbound and outbound ports has HP allowed?	6
Q: What is the HP Sygate Policy Editor and what does it do?	7
Q: Where do I obtain the HP Sygate Policy Editor?	8
Q: Is there a fee associated with the HP Sygate Policy Editor?	8
Q: Who do I contact for technical support on the HP Sygate Policy Editor?	8
Q: How do I modify the ports against the applications already specified by HP?	8
1. Log on as Administrator.	8
2. Right-click on the Sygate systray icon.	8
3. Select Advanced Rules.	8
Q: Is there a limitation to which ports and/or applications that I can add?	8
Q: What if my application uses a range of ports?	8
Q: Can I or do I need to specify whether my application uses UDP or TCP?	8
Q: Is there a risk to opening all ports for an application?	8
Q: Is there a limit to the number of rules I can add?	8
Q: Is there a list of well-known ports and their respective applications?	8
Log files	9
Q: How do I view the log files while at the thin client?	9
1. Log in as Administrator.	9
2. Right-click the Sygate icon in the system tray.	9
3. Select Logs.	9
Q: How do I retrieve the log files remotely?	9
Q: What does the log file reveal?	9
Q: How do I know that a port or application has been blocked?	9
Q: What should I do when an application is blocked?	9
Intrusion detection	10
Q: What is the functionality of an Intrusion Detection System (IDS)?	10
Q: How do I deploy modified policies with Altiris?	10
Q: Are there best practices for automating deployment?	10
Q: How do I make IDS files persistent?	10

HP t5710 HP Sygate Security Agent and Symantec Embedded Security:Frequently As - Page 5

Both Microsoft Windows Firewall and HP Sygate Security Agent prevent worm attacks such as Blaster

Page 5 highlights