Symantec 10521146 - Network Security 7120, Administration Manual

Page: 349 / 392

349 Glossary
intelligence The continual analysis of threats, vulnerabilities, and system and network environments
to better provide information, as opposed to data, which aids in the protection of system
and network environments.
interface group A collection of multiple monitoring interfaces on a Symantec Network Security 7100
Series appliance sharing one sensor process which correlates all network traffic as if it
were seen by a single interface.
interface pair Two monitoring interfaces which are configured together using in-line mode. One of the
pair connects to the inside network, and the other connects to the outside network.
interface, monitoring A designated port (also called copy port or mirror port) that creates a copy of the traffic
flow on a specific network device. The monitor interface sends this data to Symantec
Network Security to examine out-of-band so there is no loss of network functionality.
internal threat A threat that originates within an organization.
Internet A web of different, intercommunicating networks funded by both commercial and
government organizations. It connects networks in many countries. No one owns or runs
the Internet. There are thousands of enterprise networks connected to the Internet, and
there are millions of users, with thousands more joining every day.
intrusion detection A security service that monitors and analyzes system events for the purpose of finding
and providing real-time, or near real-time, warning of attempts to access system resources
in an unauthorized manner.
intrusion management
The centralized management of intrusion-based security technologies to identify,
manage, and mitigate network intrusions based on security policy.
IP (Internet Protocol) The method or protocol by which data is sent from one computer to another on the
Internet. Each computer (known as a host) on the Internet has at least one address that
uniquely identifies it to all other computers on the Internet.
IP address A unique number that identifies a workstation on a TCP/IP network and specifies routing
information. Each workstation on a network must be assigned a unique IP address, which
consists of the network ID, plus a unique host ID assigned by the network administrator.
This address is usually represented in dot-decimal notation, with the decimal values
separated by a period (for example 123.45.6.24).
IP hijacking An attack in which an active, established session is intercepted and taken over by the
attacker. This attack may take place after authentication has occurred, which allows the
attacker to assume the role of an already authorized user.
IP spoofing An attack in which someone intercepts and co-opts an active, established session. IP
spoofing is also an attack method by which IP packets are sent with a false source address,
which may try to circumvent firewalls by adopting the IP address of a trusted source. This
fools the firewall into thinking that the packets from the hacker are actually from a
trusted source. IP spoofing can also be used simply to hide the true origin of an attack.