Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Руководство администратора

Страница: 20 / 861

20 Introducing the security gateway
Network security best practices
To use the security gateway’s LiveUpdate capabilities, you must purchase subscription licenses that
entitle you to updates of the following content security services:
■
Antivirus
■
Antispam
■
Content filtering
■
Dynamic document rating
■
Intrusion detection and prevention
Security Gateway Management Interface
The Security Gateway Management Interface (SGMI) is a Web-based graphical user interface for
managing and monitoring all functions on the security gateway.
SGMI wizards help you configure the objects that represent your network environment and internal
and external resources. You combine these objects in rules, VPN tunnels, and packet filters that control
access through the security gateway.
The monitoring capabilities of the SGMI let you view the status of connections, the health of the
appliance, log messages generated by the security gateway, and IDS/IPS alerts.
The system management features of the SGMI let you create management accounts, configure and run
LiveUpdate of content security components, create SSL certificates, and manage licenses for the
security gateway features you have purchased.
Network security best practices
Symantec encourages all users and administrators to adhere to the following basic security practices:
■
Turn off or remove unnecessary operating system services.
By default, many operating systems install auxiliary services that are not critical, such as FTP,
Telnet, or Web servers. These services are avenues of attack. If they are removed, blended threats
have fewer exploitation points and you have fewer services to maintain through patch updates.
■
If there is a known exploit for one or more network services, disable or block access to those
services until they are properly patched.
■
Automatically update your antivirus definitions at the gateway, server, and client.
■
Always keep your patch levels up-to-date, especially on computers that host public services and are
accessible through the security gateway, such as HTTP, FTP, mail, and DNS services.
■
Enforce a password policy. Complex passwords make it difficult to crack password files on
compromised computers. This helps to prevent or limit damage when a computer is compromised.
■
Configure your email server to block or remove email that contains file attachments that are
commonly used to spread viruses, such as .vbs, .bat, .exe, .pif and .scr files.
■
Isolate infected computers quickly to prevent further compromising your organization. Perform a
forensic analysis and restore the computers using trusted media.
■
Train employees not to open attachments unless they are expecting them. Also, do not execute
software that is downloaded from the Internet unless it has been scanned for viruses. Simply
visiting a compromised Web site can cause infection if certain browser vulnerabilities are not
patched.
You can find additional information, in-depth white papers, and resources regarding enterprise
security solutions by visiting the Symantec Enterprise Solutions Web site at
http://enterprisesecurity.symantec.com .