Host Intrusion Prevention 7.0.0 for ePO 4.0 Product Guide - McAfee

Introducing Host Intrusion Prevention 7.0
Types of Host Intrusion Prevention policies
Basic protection
Host Intrusion Prevention ships with a set of default settings that provide basic “out-of-the-box”
protection for your environment. These settings include:
• IPS protection is enabled; high severity signatures are prevented and all other signatures
are ignored.
• Firewall, quarantine, and application blocking protection are not enabled.
• McAfee applications are listed as trusted applications for all rules except IPS self-protection
rules.
• Predefined applications and processes are protected.
Advanced protection
For advanced protection, switch from the default settings to stronger preset settings, or create
custom settings.
Start with a sample deployment to monitor and tune the new settings. Tuning involves balancing
intrusion prevention protection and access to required information and applications per group
type. You can do this manually or automatically by enabling learn or adaptive mode.
Types of Host Intrusion Prevention policies
IPS policies
A policy is a collection of settings that you configure and enforce through the ePolicy Orchestrator
console. Applying policies ensures that your security needs on managed systems are met. Host
Intrusion Prevention provides four policy features, each with a set of security options. These
are: IPS, Firewall, Application Blocking and General. Except for General, each feature
contains a “rules” policy with rules that define behavior, and an “options” policy that enables
or disables application of the rules.
Ownership of policies is assigned in the Policy Catalog. After a policy is created, it can be
edited or deleted only by the creator of the policy, the person associated as an owner of the
policy, or the global administrator. Deleting a policy can be done only in the Policy Catalog.
The IPS (Intrusion Prevention System) feature contains three policies that protect computers
with host intrusion prevention technology. It details exceptions, signatures, application protection
rules, events, and client-generated exceptions.
• IPS Options. Turns on or off IPS protection and application of adaptive mode.
• IPS Protection. Defines the reaction to events that signatures generate.
• IPS Rules. Defines exceptions, signatures, and application protection rules. This policy,
referred to as a multiple-instance policy, allows for a profile of settings through the application
of multiple policies under a single policy instance.
Firewall policies
The Firewall feature contains four policies that filter network traffic, allowing legitimate traffic
through the firewall and blocking the rest.
8
McAfee Host Intrusion Prevention 7.0 Product Guide for use with ePolicy Orchestrator 4.0