Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual

Page: 321 / 861

320 Preventing attacks
Blocking suspicious or malicious traffic with IDS
About intrusion detection and prevention
The Internet exposes e-business resources to significant risks. Damage can include diminished
customer confidence, intellectual property loss, legal liability, and time and money to recover from an
attack. In addition to the peripheral protection services it provides, the security gateway provides an
intrusion detection and prevention component that uses a hybrid detection architecture to pinpoint
malicious activities, identify intrusions, and respond rapidly to both common and novel attacks.
The intrusion detection and prevention (IDS/IPS) component works with the driver, analyzes packets,
and sends alerts back to the driver for any suspicious traffic it detects. The driver then determines the
next course of action for the packet.
Signature engine
The IDS/IPS component consists of a signature engine with a battery of signatures. Signatures are
patterns that are known to be harmful. They are used to detect malicious traffic by searching for
specific patterns of words, characters, lengths, and more. The IDS/IPS component compares traffic to
these signatures and responds at a high rate of speed if it finds a match. The signatures included with
the security gateway are not modifiable. Signatures may be added, removed, or modified through
LiveUpdate.
Signature variables
IDS/IPS provides signature variables that can be used to specify ports on which to look for attacks. The
signature variables allow you to set a value in one place that is then used in multiple signatures. This
focuses signatures to search in specific locations, which speeds the search and enhances performance.
You can use the Advanced Options tab to modify the values of the signature variables to adapt to your
environment.
When you activate a change to a signature variable, and the security gateway cannot validate the
change, a log event with a severity level of Error is generated. The most likely cause is one of the
following problems:
■
The value entered for the signature variable is invalid or in an invalid format.
■
The signature variable name is invalid.
■
The IDS compilation fails due to the new values entered for the signature variables.
Performing a LiveUpdate does not affect any modifications that you have made to signature variables.
The modified signature variables continue to apply to the updated signatures.
The Advanced options appendix contains a table with the available signature variables. The table
includes IDS signature variables for ports, servers, external and internal lan and net, evolution, and
sunrpc. The IDS signature variables begin with the idssym prefix. For example, a signature variable for
sunrpc is idssym.sunrpc.
For instructions on modifying advanced options and the signature variables that you can modify, see
“Configuring advanced options” on page 545.
About IDS/IPS policies
IDS/IPS policies control how signature settings are applied to the various components on the security
gateway. Each IDS/IPS policy contains a set of signatures that the security gateway searches for, and
log and block settings for the entire set of intrusion events on the gateway. To enable the intrusion
detection and prevention functionality, you apply a pre-configured IDS/IPS policy or one that you have
created to a security gateway component such as an interface or packet filter.
Each IDS/IPS policy is based on one of four heuristic detection levels. These heuristic levels control
logging and blocking based on the severity and alert level of detected events. The security gateway
includes pre-configured IDS/IPS policies that are named after the heuristic detection levels that define