Host Intrusion Prevention 7.0.0 for ePO 4.0 Product Guide - McAfee

Configuring IPS Policies
Overview of IPS policies
Host intrusion prevention signatures
Host IPS protection resides on individual systems such as servers, workstations or laptop. The
Host Intrusion Prevention client inspects traffic flowing into or out of a system and examines
the behavior of the applications and operating system for attacks. When an attack is detected,
the client can block it at the network segment connection, or can issue commands to stop the
behavior initiated by the attack. For example, buffer overflow is prevented by blocking malicious
programs inserted into the address space exploited by an attack. Installation of back door
programs with applications like Internet Explorer is blocked by intercepting and denying the
application’s “write file” command.
Benefits of host IPS
• Protects against an attack and the results of an attack, such as preventing a program from
writing a file.
• Protects laptops when they are outside the protected network.
• Protects against local attacks introduced by CDs or USB devices. These attacks often focus
on escalating the user’s privileges to “root” or “administrator” to compromise other systems
in the network.
• Provides a last line of defense against attacks that have evaded other security tools.
• Prevents internal attack or misuse of devices located on the same network segment.
• Protects against attacks where the encrypted data stream terminates at the system being
protected by examining the decrypted data and behavior.
• Independent of network architecture; protects systems on obsolete or unusual network
architectures such as Token Ring or FDDI.
Network intrusion prevention signatures
Network IPS protection also resides on individual systems. All data that flows between the
protected system and the rest of the network is examined for an attack. When an attack is
identified, the offending data is discarded or blocked from passing through the system.
Benefits of network IPS
• Protects systems located downstream in a network segment.
• Protects servers and the systems that connect to them.
• Protects against network denial-of-service attacks and bandwidth-oriented attacks that deny
or degrade network traffic.
Behavioral rules
Behavioral rules define legitimate activity. Activity not matching the rules is considered suspicious
and triggers a response. For example, a behavioral rule might state that only a web server
process should access HTML files. If any other process attempts to access HTML files, action
is taken. These rules provide protection against zero-day and buffer overflow attacks.
Behavioral rules define a profile of legitimate activity. Activity that does not match the profile
triggers an event. For example, you can set a rule stating that only a web server process should
access web files. If another process attempts to access a web file, this behavioral rule triggers
an event.
McAfee Host Intrusion Prevention 7.0 Product Guide for use with ePolicy Orchestrator 4.0
25