HP Sygate Security Agent User Guide
antivirus:
Software and technology that is used to detect malicious computer applications,
prevent them from infecting a system, and clean files or applications that are infected
with computer viruses. Sygate software works together with, but does not include,
antivirus software.
application authentication:
Authenticating an application that is running on a network is
accomplished by taking the entire binary of an application and performing an MD5
hash and then comparing it with the application fingerprint stored on an Agent. If
the application was changed, it may not be authenticated depending on the rules that
an Agent is using. See also application control, application fingerprint, DLL
authentication, MD5 hash.
application control:
Applications and what versions of the particular application can either
be allowed or disallowed via security policies.
application fingerprint:
A 128-bit number that is generated by performing an MD5 hash of
an entire application packet. It is unique for each application. If the application is
changed in any way, the application fingerprint changes. See also application
authentication.
authentication:
The process by which a system identifies an individual or a computer to
make sure that the user or computer is who they claim to be.
authorization:
The process of granting or denying access to a specific network resource or
domain based on the user’s identity.
B
backtrace:
A way of using ICMP to determine all the hops between your computer and an
intruder on another computer. See also Internet Control Message Protocol (ICMP).
broadcast:
Sending a packet to everybody on the network. See also multicast, unicast.
buffer overflow:
Applications set aside areas of memory, or buffers, for use as storage,
frequently setting aside a finite amount of memory for a buffer. A buffer overflow
exists when an application attempts to store more data than can fit in a fixed-size
buffer. Buffer overflow attacks occur when an intruder is able to send data in excess
of a fixed-size application buffer and the application does not check to ensure this
doesn’t happen. By overflowing a buffer with executable code, an intruder can cause
an application to perform unexpected and often malicious actions using the same
privileges the application has been granted.
52
