Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual

Page: 334 / 861

333 Preventing attacks
Protecting your network resources from virus infections
Protecting your network resources from virus infections
The security gateway lets you configure antivirus scanning and filtering policies. You can perform
antivirus scanning on any traffic using the FTP, HTTP, POP3, and SMTP protocols. Some scanning and
filtering policy features differ depending on the protocol that you are using.
This section covers the following topics:
■
About antivirus scanning
■
Preventing denial of service attacks
■
Blocking files that cannot be scanned
■
Optimizing scanning resources
■
Avoiding potential session time-out errors
■
Blocking mail attachments that are known threats
■
Responding to virus detections
■
Adding antivirus protection to a rule
■
Troubleshooting antivirus protection
About antivirus scanning
The security gateway features all of the virus scanning technologies that are available in Symantec
antivirus products. The security gateway antivirus scanner detects viruses, worms, and Trojan horses
in all major file types. The security gateway also includes a decomposer that handles most compressed
and archive file formats and nested levels of files.
The security gateway antivirus scanner also detects mobile code such as Java™, ActiveX
®
, and stand-
alone script-based threats. The security gateway uses Symantec antivirus technologies for heuristic
detection of new or unknown viruses, to provide protection from new classes of viruses automatically
through LiveUpdate, and to detect polymorphic viruses.
If you would like to know whether the security gateway or any other Symantec product protects
against a specific virus, visit the Symantec Security Response™ Web site at:
http://securityresponse.symantec.com
For additional background information, see the following topics:
■
“Ways to protect your environment from threats” on page 333
■
“Optimizing antivirus scanning performance” on page 334
■
“Avoiding session time-outs when downloading large files using data comforting” on page 334
■
“Responding to antivirus threats” on page 334
■
“Keeping your antivirus protection up-to-date” on page 335
Ways to protect your environment from threats
The security gateway offers settings to help prevent denial of service attacks, which are caused by
large container files or files that contain multiple, embedded compressed files. You can also protect
your security gateway by configuring settings to block files that cannot be scanned.
You can use some scanning and blocking policy settings during a virus outbreak to further protect your
security gateway. Once you have information on the characteristics of a new virus, you can use this
information to block the infected attachment or email immediately, before virus definitions for the
new virus are posted. Or, for maximum coverage, you can scan all file types rather than limiting the
file types that are scanned for viruses.