Freedom9 freeGuard Blaze 2100, Руководство пользователя

Страница: 84 / 224

A T T A C K D E T E C T I O N A N D P R E V E N T I O N
Attack Stages
5-2
Security Appliance User Guide Version 3R2
5
• To gain control of the firewall access control list.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
A T T A C K S T A G E S
Attacks usually happen in two steps:
1
The attacker gathers information by:
Performing an IP address sweep to determine which
hosts on the network are active.
Determining the active ports on host found during the IP
address sweep.
Determining the current operating system of the host and
weaknesses in that operating system.
2
The attacker launches the attack by:
Concealing the attack.
Executing the attack.
Removing or hiding evidence of the attack.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
D E T E C T I N G A N A T T A C K
To prevent hackers from exploiting a network, the appliance uses stateful
inspection to dynamically filter and secure all network connections.
Stateful inspection enables the appliance to note components in the IP
packet and TCP segment headers, including the source and destination
IP addresses, source and destination ports and packet sequence
numbers. This information maintains the state of each TCP session and
UDP session traversing a security policy. When a responding TCP packet
arrives, the appliance compares the information in the header with the
state entries currently in the state table. If the appliance finds a match,
it allows the responding packet to pass through the firewall. If the
appliance does not find a match, it drops or rejects the packet.