Cisco Cisco IPS 4255 Sensor Libro bianco

White Paper

Page 1 of 4

Risk Rating and Threat Rating: Simplify IPS Policy
Management

Introduction

Depending on the size of the enterprise and where an intrusion prevention system (IPS) is placed,

your IPS may generate thousands to millions of alerts every day. Analyzing all these alerts can be

a daunting task. Cisco

IPS Sensor Software Version 5.0 introduced risk rating and threat rating,

two powerful features that greatly simplify IPS policy management and day-to-day operations. Risk

rating is a quantitative measure of your network’s threat level before IPS mitigation. Threat rating is

a quantitative measure of your network’s threat level after IPS mitigation.

Risk rating and threat rating can greatly enhance your productivity and increase the security of

your network and assets. This white paper explains how risk rating and threat rating are calculated,

and explains how to build policies with risk rating and threat rating.

Risk Rating Calculation

Risk rating is a quantitative measure of your network’s threat level before IPS mitigation. For each

event fired by IPS signatures, Cisco IPS Sensor Software calculates a risk rating number. The

factors used to calculate risk rating are:

●

Signature fidelity rating: This IPS-generated variable indicates the degree of attack

certainty.

●

Attack severity rating: This IPS-generated variable indicates the amount of damage an

attack can cause.

●

Target value rating: This user-defined variable indicates the criticality of the attack target.

This is the only factor in risk rating that is routinely maintained by the user. You can assign

a target value rating per IP address in Cisco IPS Device Manager or Cisco Security

Manager. The target value rating can raise or lower the overall risk rating for a network

device. You can assign the following target values:

◦

75: Low asset value

◦

100: Medium asset value

◦

200: Mission-critical asset value

●

Attack relevancy rating: This IPS-generated value indicates the vulnerability of the attack

target.

●

Promiscuous delta: The risk rating of an IPS deployed in promiscuous mode is reduced by

the promiscuous delta. This is because promiscuous sensing is less accurate than inline

sensing. The promiscuous delta can be configured on a per-signature basis, with a value

range of 0 to 30. (The promiscuous delta was introduced in Cisco IPS Sensor Software

Version 6.0.)

●

Watch list rating: This IPS-generated value is based on data found in the Cisco Security

Agent watch list. The Cisco Security Agent watch list contains IP addresses of devices

involved in network scans or possibly contaminated by viruses or worms. If an attacker is

found on the watch list, the watch list rating for that attacker is added to the risk rating. The