F-SECURE LINUX SECURITY, Manual

Page: 9 / 219

predefined security profiles which are tailored for common use cases to select the traffic you
want to allow and deny.
• If an attacker gains a shell access to the system and tries to add a user account to login to
the system later, Host Intrusion Prevention System (
HIPS ) detects modified system files and
alerts the administrator.
• If an attacker has gained an access to the system and tries to install a userspace rootkit by
replacing various system utilities,
HIPS detects modified system files and alerts the
administrator.
• If an attacker has gained an access to the system and tries to install a kernel rootkit by loading
a kernel module for example through
/sbin/insmod
or
/sbin/modprobe
, HIPS detects
the attempt, prevents the unknown kernel module from loading and alerts the administrator.
If an attacker has gained an access to the system and tries to install a kernel rootkit by
modifying the running kernel directly via
/dev/kmem
, HIPS detects the attempt, prevents
write attempts and alerts the administrator.
Key Features and Benefits
The product offers superior protection against viruses and worms and is transparent to end-users.
Superior Protection against Viruses and Worms
The product scans files on any Linux-supported file system. This is the optimum solution for
computers that run several different operating systems with a multi-boot utility.
• Scans files on any Linux-supported file system.
Note: The real-time scanning is not supported when using an NFS server, but other
scan methods work.
• Superior detection rate with multiple scanning engines.
• A heuristic scanning engine can detect suspicious, potentially malicious files.
• The product can detect and categorize riskware items.
• The product can be configured so that the users cannot bypass the protection.
• Files are scanned for viruses when they are opened or closed and before they are executed.
• You can specify what files to scan, how to scan them, what action to take when malicious
content is found and how to alert about the infections.
• Recursive scanning of archive files.
• Virus definition database updates are signed for security.
F-Secure Linux Security | Welcome | 9