McAfee HISCDE-AB-IA - Host Intrusion Prevention Manuale utente

McAfee Host Intrusion Prevention 8.0

Product Guide for use with ePolicy Orchestrator 4.5

No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language in any form

or by any means without the written permission of McAfee, Inc., or its suppliers or affiliate companies.

TRADEMARK ATTRIBUTIONS

AVERT, EPO, EPOLICY ORCHESTRATOR, FOUNDSTONE, GROUPSHIELD, INTRUSHIELD, LINUXSHIELD, MAX (MCAFEE SECURITYALLIANCE

EXCHANGE), MCAFEE, NETSHIELD, PORTALSHIELD, PREVENTSYS, SECURITYALLIANCE, SITEADVISOR, TOTAL PROTECTION, VIRUSSCAN,

WEBSHIELD are registered trademarks or trademarks of McAfee, Inc. and/or its affiliates in the US and/or other countries. McAfee Red in

connection with security is distinctive of McAfee brand products. All other registered and unregistered trademarks herein are the sole property

of their respective owners.

LICENSE INFORMATION

License Agreement

NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED,

WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH

TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS

THAT ACCOMPANY YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET,

A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU

DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN

THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND.

McAfee Host Intrusion Prevention 8.0 Product Guide for ePolicy Orchestrator 4.52

Contents

Introducing Host Intrusion Prevention..................................................7

Host IPS protection.........................................................................7

Host IPS policies...........................................................................8

Host IPS policy management.................................................................9

HostIPSpolicytrackingandtuning...........................................................10

Managing Your Protection...............................................................12

Information management...................................................................12

Host IPS dashboards...............................................................12

Host IPS queries...................................................................13

Policy management........................................................................16

Where to find policies...............................................................16

Configuring polices.................................................................17

Default protection and tuning........................................................18

Host IPS policy migration............................................................22

System management......................................................................23

Host IPS permission sets............................................................23

Host IPS server tasks...............................................................25

HostIPSeventresponses............................................................26

Host IPS protection updates .........................................................27

Configuring IPS Policies..................................................................29

Overview of IPS policies....................................................................29

Methodsfordelivery of IPS protection.................................................30

Signatures........................................................................31

Behavioralrules....................................................................32

Reactions.........................................................................32

Exceptions........................................................................32

Application protection rules..........................................................33

Events...........................................................................33

Enable IPS protection......................................................................33

Configuring the IPS Options policy....................................................34

Set the reaction for IPS signatures...........................................................35

3McAfee Host Intrusion Prevention 8.0 Product Guide for ePolicy Orchestrator 4.5

Configuring the IPS Protection policy..................................................36

Define IPS protection......................................................................36

Configuring the IPS Rules policy......................................................37

Assigningmultiple instances of thepolicy...............................................37

FAQ — Multiple-instance policies......................................................38

How IPS signatures work............................................................39

How IPS application protection rules work..............................................43

HowIPS exceptions work............................................................46

MonitorIPSevents........................................................................47

Managing IPS events...............................................................48

Creating an exception from an event..................................................49

Creating a trusted application from an event............................................50

MonitorIPSclientrules.....................................................................50

Managing IPS client rules............................................................50

Configuring Firewall Policies............................................................52

Overview of Firewall policies................................................................52

How firewall rules work.............................................................53

How firewall rule groups work .......................................................55

How the Host IPS catalog works......................................................58

Firewall stateful packet filtering and inspection. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59

How learn and adaptive modes affect the firewall. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63

Firewall client rules.................................................................64

Enable firewall protection...................................................................64

Configuring the Firewall Options policy ................................................65

FAQ—McAfeeTrustedSourceandthefirewall...........................................66

Define firewall protection...................................................................67

ConfiguringtheFirewallRulespolicy...................................................68

Creating and editing firewall rules ....................................................69

Creating and editing firewall rule groups...............................................69

Creatingconnectionisolationgroups...................................................70

Blocking DNS traffic................................................................70

Usingthe HostIPScatalog...........................................................70

Managingfirewallclient rules.........................................................71

FAQ— Useof wildcards inFirewall Rules...............................................72

Configuring General Policies ............................................................73

Overview of General policies................................................................73

Define client functionality...................................................................74

McAfee Host Intrusion Prevention 8.0 Product Guide for ePolicy Orchestrator 4.54

Contents

ConfiguringaClientUIpolicy.........................................................74

Setting Client UI general options......................................................75

Setting Client UI advanced options and passwords. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75

Setting Client UI troubleshooting options...............................................76

Define trusted networks....................................................................77

Configuring a Trusted Networks policy.................................................78

Define trusted applications..................................................................78

Configuring a Trusted Applications policy...............................................79

Creating and editing Trusted Application rules. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79

Assigningmultiple instances of thepolicy...............................................80

Working with Host Intrusion Prevention Clients .....................................81

OverviewoftheWindowsclient..............................................................81

System tray icon menu..............................................................81

ClientconsoleforWindowsclients.....................................................83

UnlockingtheWindowsclientinterface.................................................83

Setting client UI options.............................................................83

Troubleshooting the Windows client...................................................84

Windows client alerts...............................................................86

AbouttheIPS Policy tab.............................................................88

About the Firewall Policy tab.........................................................89

About the Blocked Hosts tab.........................................................91

EditingtheBlocked Hosts list.........................................................92

About the Application Protection List tab...............................................92

About the Activity Log tab...........................................................93

Overview of the Solaris client ...............................................................94

Policy enforcementwiththeSolarisclient...............................................94

Troubleshooting the Solaris client.....................................................95

Overview of the Linux client ................................................................97

Policy enforcementwith the Linuxclient................................................97

Notes about the Linux client.........................................................97

Troubleshooting the Linux client......................................................98

Appendix A — Writing Custom Signatures and Exceptions.........................101

Rule structure...........................................................................101

Common sections.................................................................102

Optional common sections..........................................................104

Wildcards and variables............................................................104

Windowscustomsignatures................................................................107

5McAfee Host Intrusion Prevention 8.0 Product Guide for ePolicy Orchestrator 4.5

Contents

Windows class Buffer Overflow......................................................107

Windows class Files...............................................................108

Windows class Hook...............................................................111

Windows class Illegal Host IPS API Use...............................................112

Windows class Illegal Use..........................................................113

WindowsclassIsapi (HTTP).........................................................113

Windows class Program............................................................116

Windows class Registry............................................................117

Windows class Services............................................................120

Windows class SQL................................................................122

Classesanddirectivesper Windowsplatform...........................................123

Non-Windowscustomsignatures............................................................127

Solaris/Linux class UNIX_file........................................................127

Solaris/Linux class UNIX_apache (HTTP)..............................................130

Solaris/Linux class UNIX_Misc.......................................................131

Solaris class UNIX_bo..............................................................132

Solaris class UNIX_map............................................................133

Solaris class UNIX_GUID...........................................................133

Classes and directives per UNIX platform..............................................134

Appendix B — Troubleshooting........................................................136

General issues...........................................................................136

Host IPS logs............................................................................141

Clientcontrol.exe utility....................................................................144

McAfee Host Intrusion Prevention 8.0 Product Guide for ePolicy Orchestrator 4.56

Contents

Introducing Host Intrusion Prevention

McAfee®Host Intrusion Prevention is a host-based intrusion detection and prevention system

that protects system resources and applications from external and internal attacks. It provides

a manageable and scalable intrusion prevention solution for workstations, notebooks, and critical

servers, including web and database servers. Its patented technology blocks zero-day and

known attacks.

Host Intrusion Prevention (sometimes abbreviated in the product as Host IPS or HIP) can protect

information and prevent the compromising of system and network resources and applications

that store and deliver information. It accomplishes this with an end-point firewall feature and

an intrusion prevention system (IPS) feature. The IPS feature has monthly content updates,

which reduces the urgency of patches for new threats. The Host Intrusion Prevention firewall

feature is purchased separately or in combination with the Host Intrusion Prevention IPS feature.

Host Intrusion Prevention is fully integrated with ePolicy Orchestrator and uses its framework

to deliver and enforce policies. This approach provides a single management solution that allows

for mass deployment of up to 100,000 systems in multiple languages across an entire enterprise

for true global coverage.

Contents

Host IPS protection

Host IPS policies

Host IPS policy management

Host IPS policy tracking and tuning

Host IPS protection

After all the required components for Host Intrusion Prevention are installed and communicating,

you are ready to apply protection, monitor events, and update policies and content as needed.

Basic protection

Host Intrusion Prevention ships with a set of default settings that provide basic protection for

your environment. These settings include:

• For IPS protection:

• High severity signatures are prevented and all other signatures are ignored

•McAfee applications are listed as trusted applications for all rules except IPS self-protection

rules

• Predefined applications and processes are protected

• For firewall protection:

7McAfee Host Intrusion Prevention 8.0 Product Guide for ePolicy Orchestrator 4.5

Basic network connectivity is allowed•

NOTE: When Host Intrusion Prevention 8.0 is first installed no protection is enabled. You must

enable protection in the IPS Options or Firewall Options policy and apply the policy to the client.

Advanced protection

For advanced protection, switch from the default settings to stronger preset settings, or create

custom settings.

Start with a sample deployment to monitor and tune the new settings. Tuning involves balancing

intrusion prevention protection and access to required information and applications per group

type.

Host IPS policies

A policy is a collection of settings that you configure and enforce through the ePolicy Orchestrator

console. Applying policies ensures that your security needs on managed systems are met. Host

Intrusion Prevention provides three policy features, each with a set of security options. These

are: IPS,Firewall, and General. IPS and firewall features contain a “rules” policy with rules

that define behavior, and an “options” policy that enables or disables the rules.

Ownership of policies is assigned in the Policy Catalog. After a policy is created, it can be

edited or deleted only by the creator of the policy, the person associated as an owner of the

policy, or the global administrator. Deleting a policy can be done only in the Policy Catalog.

IPS policies

The IPS feature contains three policies that protect both Windows and non-Windows computers.

It details exceptions, signatures, application protection rules, events, and client-generated

exceptions.

•IPS Options (All platforms). Turns on or off IPS protection and application of adaptive

mode for tuning.

•IPS Protection (All platforms). Defines the protection reaction to events that signatures

generate.

•IPS Rules (All platforms). Defines signatures, exceptions, and application protection rules.

This policy is a multiple instance policy, which allows for several IPS Rules policies, instead

of a single policy, to be assigned to a system. The effective policy is then the result of the

merged contents of the policies. If there are conflicting settings, the most protective explicit

setting is applied.

Firewall policies

The Firewall feature contains three policies that protect Windows computers only. It filters

network traffic, allowing legitimate traffic through the firewall and blocking the rest.

•Firewall Options (Windows only). Turns on or off firewall protection and application of

adaptive or learn mode for tuning.

•Firewall Rules (Windows only). Defines firewall rules.

•Firewall DNS Blocking (Windows only). Defines the domain name servers that are to be

blocked.

Introducing Host Intrusion Prevention

Host IPS policies

McAfee Host Intrusion Prevention 8.0 Product Guide for ePolicy Orchestrator 4.58

General policies

The General feature contains three policies that can apply to both the IPS and Firewall features.

•Client UI (Windows only). Defines access to the Host Intrusion Prevention user interface

on Windows client systems, including troubleshooting options. Also provides

password-protection on all non-Windows client systems.

•Trusted Networks (Windows only). Lists IP addresses and networks that are safe for

communication. Used with the IPS and Firewall features.

•Trusted Applications (All platforms). Lists applications that are trusted to perform most

operations. Used with the IPS feature. This policy is also a multiple instance policy, which

allows for several Trusted Applications policies, instead of a single policy, to be assigned to

a system. The effective policy is the result of the merged contents of the policies. If there

are conflicting settings, the most protective setting is applied.

Host IPS policy management

The ePolicy Orchestrator console allows you to configure Host Intrusion Prevention policies

from a central location.

How policies are enforced

When you change Host Intrusion Prevention policies in the ePolicy Orchestrator console, the

changes take effect on the managed systems at the next agent-server communication. This

interval is set to occur once every 60 minutes by default. To enforce policies immediately, you

can send an agent wake-up call from the ePolicy Orchestrator console.

Policies and their categories

Policy information for Host Intrusion Prevention is grouped by

feature

and

category

. Each policy

category refers to a specific subset of policies.

policy

is a configured group of settings for a specific purpose. You can create, modify, or

delete as many policies as needed.

Each policy has a preconfigured McAfee Default policy, which cannot be edited or deleted.

Except for IPS Rules and Trusted Applications, all policies also have an editable My Default

policy based on the default policy. Some policy categories include several read-only preconfigured

policies. If these preconfigured policies meet your needs, you can apply any one of them. These

read-only policies, like all policies, can be duplicated and the duplicate customized, if needed.

IPS Rules and Trusted Applications policies are

multiple-instance policies

because you can assign

multiple policy instances under a single policy. The policy instances are automatically combined

into one effective policy.

TIP: The McAfee Default policies for IPS Rules and Trusted Applications are automatically

updated as part of the content update process. McAfee recommends always assigning these

policies to all clients and creating additional policy instances to customize the behavior of these

two policies.

How policies are applied

Policies are applied to any System Tree group or system by inheritance or assignment.

Inheritance

determines whether the policy settings for any system are taken from its parent.

By default, inheritance is enabled throughout the System Tree. You can break inheritance by

Introducing Host Intrusion Prevention

Host IPS policy management

9McAfee Host Intrusion Prevention 8.0 Product Guide for ePolicy Orchestrator 4.5

direct policy

assignment

. Host Intrusion Prevention, as managed by ePolicy Orchestrator, enables

you to create policies and assign them without regard to inheritance. When you break this

inheritance by assigning a new policy, all groups and systems below inherit the new policy.

Policy ownership

Each policy is required to have an assigned owner. Ownership ensures that no one can modify

the policy other than the global administrator, the creator of the policy, or the person associated

as the policy owner. Any administrator can use any policy that exists in the catalog, but only

the creator, owner, or global administrator can modify it.

TIP: Rather than use a policy owned by a different administrator, we recommend that you

duplicate the policy, then assign the duplicate. Otherwise, if you assign a policy that you do

not own to System Tree groups that you administer, and the owner of the policy modifies it,

all systems to which this policy is assigned receive these modifications.

Host IPS policy tracking and tuning

The deployment and management of Host Intrusion Prevention clients are handled from ePolicy

Orchestrator. In the ePO System Tree you can group systems hierarchically by attributes. For

example, you might group a first level by geographic location and a second level by operating

system platform or IP address. McAfee recommends grouping systems by Host Intrusion

Preventionn configuration criteria, including system type (server or desktop), use of major

applications (web, database, or mail server), and strategic locations (DMZ or intranet). You can

place systems that fit a common usage profile into a common group on the System Tree. In

fact, you might name a group after its usage profile, for example,

Web Servers

With computers grouped in the System Tree according to type, function, or geographic location,

you can easily divide administrative functions along the same lines. With Host Intrusion

Prevention you can divide administrative duties based on product features, such as IPS or

firewall.

Deploying Host Intrusion Prevention to thousands of computers is easily managed because

most computers fit into a few usage profiles. Managing a large deployment is reduced to

maintaining a few policy rules. As a deployment grows, newly added systems should fit one or

more existing profiles, and be placed under the correct group on the System Tree.

Preset protection

Host Intrusion Prevention offers two types of protection:

• Basic protection is available through the McAfee Default policy settings. This protection

requires little or no tuning and generates few events. For many environments this basic

protection might be sufficient.

• Advanced protection is also available from some preconfigured IPS and firewall policies or

by creating custom policies. Servers, for example, need stronger protection than that offered

in basic protection.

Both scenarios require some tuning of protection settings for actual working environments is

required.

Adaptive mode

To help tune protection settings, Host Intrusion Prevention clients can create client-side rules

to server-mandated policies that block legitimate activity. The automatic creation of client rules

Introducing Host Intrusion Prevention

Host IPS policy tracking and tuning

McAfee Host Intrusion Prevention 8.0 Product Guide for ePolicy Orchestrator 4.510

Questo manuale è adatto per i seguenti modelli

Indice

Altri manuali McAfee Software

McAfee

McAfee VIRUSSCAN ENTERPRISE 8.7I PATCH 1 - S... Manuale di istruzioni

McAfee

McAfee NAPCKE-AB-AA - VirusScan For NetApp Manuale utente

McAfee

McAfee WEBSHIELD SMTP Manuale utente

McAfee

McAfee DFFCDE-AA-DA - Endpoint Encryption For Files Manuale utente

McAfee

McAfee INTERNET GUARD DOG 3.0 Manuale utente

McAfee

McAfee DR SOLOMON S ANTI-VIRUS 8.5 Manuale utente

McAfee

McAfee VirusScan Manuale utente

McAfee

McAfee STUDENT SURVIVAL KIT 1.0-GETTING STARTED Manuale utente

McAfee

McAfee INTERNET SECURITY 2010 Manuale utente

McAfee

McAfee TEECDE-AA-AA - Total Protection For Endpoint Manuale utente

McAfee

McAfee MSA09EMB1RAA - Site Advisor Plus 2009 Manuale utente

McAfee

McAfee INTERNET SECURITY 2008 Manuale utente

McAfee

McAfee EBCACE-AA-HA - E-Business Client - PC Manuale utente

McAfee

McAfee ENDPOINT ENCRYPTION ENTERPRISE - BEST PRACTICES... Manuale utente

McAfee

McAfee VSF09EMB1RAA - VirusScan Plus 2009 Manuale utente

McAfee

McAfee SMB EDITIONS Manuale utente

McAfee

McAfee FIREWALL 2.1-GETTING STARTED Manuale utente

McAfee

McAfee UNINSTALLER 6.0 Manuale utente

McAfee

McAfee VIRUSSCAN ENTERPRISE 8.7I PATCH 3 - S... Manuale di istruzioni

McAfee

McAfee VIRUSSCAN WIRELESS 1.0 - Manuale utente

McAfee

McAfee TSA00M005PAA - Total Protection Service Manuale utente

McAfee

McAfee FOUNDSTONE ON-DEMAND Manuale utente

McAfee

McAfee Agent 4.0 Manuale di istruzioni

McAfee

McAfee UTILITIES 4.0 Manuale utente

Manuali Software popolari di altre marche

COMPRO

COMPRO COMPROFM Manuale utente

Muratec

Muratec OFFICEBRIDGE ONLINE Manuale utente

Oracle

Oracle Contact Center Anywhere 8.1 Manuale utente

Adobe

Adobe 65007312 - Photoshop Lightroom Manuale

Avaya

Avaya NULL One-X for RIM Blackberry Manuale utente

HP ProLiant BL420c Manuale utente

PS Audio

PS Audio PowerPlay Manuale del proprietario

Brady

Brady LOCKOUT PRO 3.0 Manuale di servizio

Avaya

Avaya Interaction Center Manuale utente

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Manuale

Novell

Novell GROUPWISE 8 - INTERNET AGENT Manuale utente

Oracle

Oracle Application 9i Manuale utente

Acer

Acer RDM Manuale utente

Canon

Canon Vixia HF21 Manuale utente

Canon

Canon ZR950 Manuale utente

Samsung

Samsung Auto Backup Manuale utente

Polycom

Polycom Vortex EF2201 Istruzioni per l'installazione e il funzionamento

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c Manuale utente