Cisco Cisco IPS 4520 Sensor Libro bianco
© 2012 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public Information.
Page 4 of 6
Figure 4. Sensor at Industrial Supplies Distributor (IND-2)
Permissive access control in front of sensor
Figure 5
and
Figure 6
show data from two sensors at a professional services firm. One sensor (PRO-1) is in
Europe and the other is in Asia (PRO-2). Both sensors have firewalls in front of them, but with relatively lax access
controls. While PRO-1 has been undergoing a tightening of its access environment in recent weeks, PRO-2 has
not yet benefitted from similar tightening. As a result of the lax access environment, Global Correlation plays a
major role in denying bad traffic and the effect is more prominent in the case of PRO-2 (nearly 100% of bad traffic
denied) than PRO-1 (43% of bad traffic denied). As it turns out for PRO-2, a significant portion of the malicious
traffic originates at web-zero.net, a well-known bad traffic source.
Figure 5. Sensor at Professional Services Firm (PRO-1)