لطفا منتظر باشید ...
Host-Based IPS and the Cisco Security Agent
Host intrusion prevention through the use of the CSA provides threat protection for server and desktop hosts by using rules that control operating system, application, and network stack behavior. It identifies and prevents malicious behavior, thereby eliminating known and unknown security risks.Host-based IPS consists of two components:
- CSA Software
- CSA Management Console (MC)
The following sections describe both major components of host-based IPS.
CSA Software
The CSA provides host-based IPS, distributed firewall capabilities, malicious mobile code protection, operating system integrity assurance, and audit log consolidation, all within a single product. It monitors processor control, limits activity such as buffer overflows and Registry updates, writes to the system directory, and launches installation programs.CSA policy enforcement is through analyzing behavior instead of relying on signature matching. Therefore, it mitigates both known and unknown or "day-zero" attacks. In a day-zero attack, a worm or virus generally overflows a buffer, writes to the Registry, or writes to the system directory. Mitigating day-zero attacks means that the first day a new attack hits the Internet, hosts and servers are protected because host-based IPS software stops the behavior that infects the host or server.CSA's attack mitigation capability results from the fact that it resides next to the operating system kernel and so has application visibility. All system calls to file, network, and configuration resources are intercepted by one of CSA's four interceptors:
- File system
- Network
- Configuration
- Execution space
When an application needs access to a system resource, it makes an operating system call to the kernel. CSA intercepts these operating system calls and compares them to the cached security policy. If the request does not violate the policy, it is then passed to the kernel for execution.If the request does violate the policy, CSA takes the following actions:
- The request is blocked and not passed to the kernel.
- An appropriate error message is passed back to the application.
- An alert is generated and sent to the CSA MC.
Management Center for CSA
The Management Center for CSA, or CSA MC, is the platform that provides a single GUI management interface for the administrator. All agents report to this platform, and it is used to configure, log, and display alerts that are generated by the agents.
