Информационное Руководство для Cisco Cisco IPS 4255 Sensor

The Cisco Incident Control System includes embedded software and support from Trend Micro.

Point of sale and registration data will be provided to both Cisco and Trend Micro.

Important notices, privacy statements, and trademarks of Cisco Systems, Inc. can be found on cisco.com.

Page 6 of 8

MEG can be used to correlate the precursors to worm penetration with the event pertaining to the worm itself. This increases the confidence level

of dropping packets associated with the worm.

MULTI-VECTOR THREAT IDENTIFICATION

What are the main benefits of the Cisco IPS Sensor Software Version 5.0 Application Inspection Engine?

Organizations are becoming increasingly dependent on Web services. This increases their exposure to blended application-layer attacks.

The detection of misuse and attempts to bypass any implemented Web services security mechanisms requires the ability to process application-layer

data. Cisco IPS Sensor Software Version 5.0 delivers an advanced Application Inspection Engine (AIE) that uses sophisticated algorithms to

perform application analysis. The Application Inspection Engine allows organizations to use their Cisco IPS sensors to enforce policy decisions

based on content detected at the application layer and stop malicious behavior on the network.

Does the IPS sensor have visibility into application-layer attacks that would allow policy decisions to permit/deny such traffic into the network?

Application inspection technologies delivered in Cisco IPS Sensor Software Version 5.0 allow enforcement of policy decisions based on

content detected at the application layer. This can also be extended to control permitted traffic via user-defined policies.

How does a Cisco IPS device deal with users who are attempting to tunnel unauthorized applications through commonly used ports as a way of

subverting corporate security policies?

Cisco IPS Version 5.0 Sensor detects and prevents covert channel tunneling through Port 80. For example, a request message can be inspected

that indicates traffic is being tunneled through Web ports using the application GoTomypc. Similarly, users can easily disguise the use of file sharing

applications such as Kazaa by tunneling the traffic through Port 80. These types of activities can be accurately identified and subsequently stopped.

The benefits to the user are increased visibility into activity targeted to subvert corporate security policy, which eventually results in worm

mitigation and bandwidth preservation.

Attackers can manipulate HTTP methods to disguise the insertion of malicious code. How can Cisco IPS Version 5.0 Sensor prevent this from

happening?

Cisco IPS Version 5.0 can be configured to enforce RFC compliance for HTTP methods to prevent such misuse. The users may permit or deny

specific HTTP methods (GET or POST, for example) to control HTTP transactions in a detailed manner.

When a worm or virus injection vector is associated with an e-mail attachment that can be characterized with certain commonly used MIME

types, how can I ensure that these MIME types are not permitted into my network?

Cisco IPS Sensor Software Version 5.0 delivers advanced MIME filtering mechanisms that can accurately classify and stop certain MIME types

from causing damage to critical assets.

Attackers have the ability to modify the content of certain MIME types and embed malicious code within the body of a message as a way of

disguising attack vectors. How can my IPS sensor prevent this activity?

Cisco IPS Version 5.0 has the ability to verify the content header with the actual content. For example, if the MIME type is a JPEG, the IPS

sensor can verify that the message body is indeed a JPEG message. This can help prevent attacks where malicious code in contained in a non-JPEG

attachment under a JPEG MIME-type-header.

What is the main benefit of Cisco's VoIP engine?

With the widespread deployment of VoIP, the infrastructure supporting VoIP implementation must be secured appropriately. Even minimal

downtime can result in millions of dollars of lost revenue and greater customer support costs. Cisco IPS Sensor Software Version 5.0 supports a

VoIP engine that accurately identifies and prevents attacks in VoIP environments. The protection of voice gateways from attacks such as DoS

attacks and buffer overflows helps to ensure business continuity.