Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual

Page: 336 / 861

335 Preventing attacks
Protecting your network resources from virus infections
Keeping your antivirus protection up-to-date
You can update your antivirus definitions through Symantec LiveUpdate technology. LiveUpdate
ensures that your antivirus protection remains current.
After the 30-day grace period, you must have a valid antivirus and antispam subscription license to use
the antivirus scanning feature. You must also have a valid Content Security subscription license to
receive updated virus definitions through LiveUpdate.
The following topics describe how to keep your antivirus protection up to date:
■
“Configuring and running LiveUpdate” on page 79
■
“Understanding and using licenses” on page 86
Preventing denial of service attacks
Certain container files can cause a denial-of-service attack. This can occur with container files that are
large, that contain large numbers of embedded compressed files, or that have been designed to
maliciously use resources and degrade performance. To protect against this type of attack, you can
impose limits for handling container files.
The container file limits you set using the Antivirus Configuration tab are applied only when the
security gateway runs a data scan, during the following types of content security checking:
■
Antivirus scanning
■
Content filtering with Dynamic Document Review (DDR)
■
Heuristic antispam scanning
■
Whitelist/blacklist checking
■
Subject pattern matching
When any of the maximum values is met or exceeded for a given file, the security gateway stops
processing the file and generates a log entry. You can specify whether to allow or deny access to these
files. Access is denied by default.
Warning:
If you allow access to a file that has not been fully scanned, you expose your network to
threats. If you allow access and the security gateway detects a threat, the security gateway will not
repair the file, even if under normal circumstances the infection could be repaired. In this case, the file
is handled as though the file is not repairable.
In addition to establishing resource limits for container files, you can block access to all or certain
types of malformed container files. Computer viruses and malicious programs sometimes create
intentionally malformed files. The security gateway recognizes these distortions. If the security
gateway can identify the container type, in many cases it can repair the container file. In other cases,
the container type cannot be determined, and the distortion can be used as criteria to reject potentially
infected files. You can allow or block access to malformed containers. The security gateway is
configured by default to block container types that cannot be identified.
The setting for malformed containers is applied only to MIME-encoded messages, which are only used
by the SMTP and POP3 protocols.
Note:
Because email handled by the POP3 protocol has already arrived at the user’s mailbox, the
security gateway cannot block it even when you configure the SGMI to block malformed containers.
These messages are permitted to pass through and the incident is logged.
Prerequisites
None.