Symantec 10521146 Administration Guide - Page 349

Glossary 349 intelligence The continual analysis of threats, vulnerabilities, and system and network environments to better provide information, as opposed to data, which aids in the protection of system and network environments. interface group A collection of multiple monitoring interfaces on a Symantec Network Security 7100 Series appliance sharing one sensor process which correlates all network traffic as if it were seen by a single interface. interface pair Two monitoring interfaces which are configured together using in-line mode. One of the pair connects to the inside network, and the other connects to the outside network. interface, monitoring A designated port (also called copy port or mirror port) that creates a copy of the traffic flow on a specific network device. The monitor interface sends this data to Symantec Network Security to examine out-of-band so there is no loss of network functionality. internal threat A threat that originates within an organization. Internet A web of different, intercommunicating networks funded by both commercial and government organizations. It connects networks in many countries. No one owns or runs the Internet. There are thousands of enterprise networks connected to the Internet, and there are millions of users, with thousands more joining every day. intrusion detection A security service that monitors and analyzes system events for the purpose of finding and providing real-time, or near real-time, warning of attempts to access system resources in an unauthorized manner. intrusion management The centralized management of intrusion-based security technologies to identify, manage, and mitigate network intrusions based on security policy. IP (Internet Protocol) The method or protocol by which data is sent from one computer to another on the Internet. Each computer (known as a host) on the Internet has at least one address that uniquely identifies it to all other computers on the Internet. IP address A unique number that identifies a workstation on a TCP/IP network and specifies routing information. Each workstation on a network must be assigned a unique IP address, which consists of the network ID, plus a unique host ID assigned by the network administrator. This address is usually represented in dot-decimal notation, with the decimal values separated by a period (for example 123.45.6.24). IP hijacking An attack in which an active, established session is intercepted and taken over by the attacker. This attack may take place after authentication has occurred, which allows the attacker to assume the role of an already authorized user. IP spoofing An attack in which someone intercepts and co-opts an active, established session. IP spoofing is also an attack method by which IP packets are sent with a false source address, which may try to circumvent firewalls by adopting the IP address of a trusted source. This fools the firewall into thinking that the packets from the hacker are actually from a trusted source. IP spoofing can also be used simply to hide the true origin of an attack.