Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual

Page: 18 / 861

18 Introducing the security gateway
Key components of the security gateway
Antivirus scanning
The security gateway lets you configure antivirus scanning and filtering policies for any traffic that
uses the FTP, HTTP, POP3, and SMTP protocols. Some scanning and filtering policy features differ
depending on the protocol that you are using.
Configurable options include the following:
Intrusion detection and prevention
Symantec Gateway Security 5000 Series v3.0 provides an intrusion detection and prevention
component that protects internal network resources from attack by pinpointing malicious activities,
identifying intrusions, and responding rapidly to attacks.
Traditionally, network intrusion detection systems (NIDS) consist of one or more sensors deployed
across an enterprise and a console to aggregate and analyze the collected data. The majority of
commercial IDS products are based on a system that examines network traffic for special patterns of
attack. This method of detection is called signature-based detection. Some NIDS systems miss attacks
because they cannot keep pace with the high traffic volumes, or generate unmanageable numbers of
alerts due to false positives.
Symantec’s intrusion detection and prevention component provides a common, highly coordinated
approach to detect attacks at very high speeds within the network environment. Using an array of
detection methodologies to enhance attack identification, the intrusion detection and prevention
component monitors network traffic and collects evidence of malicious activity with a combination of
traffic rate monitoring, protocol state tracking, and IP packet reassembly.
Protect your
environment from
threats The security gateway offers settings to help prevent denial of service attacks, which are
caused by large container files or files that contain multiple, embedded compressed files.
You can also protect your security gateway by configuring settings to block files that
cannot be scanned.
You can use some scanning and blocking policy settings during a virus outbreak to
further protect your security gateway. Once you have information on the characteristics
of a new virus, you can use this information to block the infected attachment or email
immediately, before virus definitions for the new virus are posted. For maximum
coverage, you can scan all file types rather than limiting the file types that are scanned
for viruses.
Optimize scanning
performance You can configure settings to restrict the resources that handle certain types of files and
specify the file types to be scanned.
Provide user
comforting The security gateway lets you enable data trickle user comforting for the POP3, HTTP,
and FTP protocols. The data comforting feature trickles small amounts of the file to the
user while the file is being scanned. This prevents the user from receiving a session time-
out error when downloading a large file. Using data comforting can compromise virus
integrity. Serious consideration should be given to a number of factors before you use the
data comforting feature.
Respond to threats You can configure the security gateway to respond to virus detections in the following
ways:
■
Add an x-virus header to an email message and deliver the email and attachment to
the recipient.
■
Repair the infection or delete the infected file if it is unable to be repaired.
■
Automatically delete the infected file.
You can configure these settings separately for each protocol. You can also notify users
when a virus has been detected and what actions the security gateway took with the
infected file.