IPS-1技术培训-chi课件

CheckPointIPS-1议程网络安全的威胁IPS-1产品线总览IPS-1介绍精确而细致的攻击防护自学习的/自适应的/可控的安全性高级的分析和报表功能直观的中央管理模式汇总大量的变化带来了新的安全需求操作系统的补丁网络环境调整新的弱点攻击网络及应用攻击ExposureExposureExposureExposure资产的分类和分级及时的网络变化学习动态的弱点防护主动的检测和防御环境的变化新的安全需求多样化的威胁蠕虫木马漏洞扫描间谍软件混合攻击移动设备蠕虫木马数据泄露后门程序私人恩怨网络变更弱点/漏洞发布策略的违反兼容性问题更多的假阳性攻击策略的执行需要更加细致的监控和记录大量的员工带来的复杂性增加安全性的问题攻击内部威胁被动威胁需求:直观的/自适应的/可控的入侵防御攻击内部威胁被动威胁来源检测和防御需求边界的防御多样的检测技术精确的检测结果细致的策略执行内部防御自定义的检测方法主动的隔离动态的蠕虫缓解屏蔽和控制动态屏蔽弱点攻击自动学习和控制细致的分析和报表IPSMarketOppurunity

IDC:年度安全调查Dedicatedvs.IntegratedIPSMarketSize

2007IPSMarketsDedicatedIPS-$1.2BillionIntegratedIPS-$400MillionGrowthMarketsCheckPointpositionedinbothsegmentsCheckPointIPS-1™*强大而精确的入侵防护精确而细致的入侵防护自学习/自适应/可控的安全高级的分析和报表直观的中央管理模式IDS/IPS成型模式

MaturityTime初期阶段知晓阶段防御阶段成熟的操作阶段IDS,VAIPS,VACheckPointIPS-1Firewalls议程网络安全的威胁IPS-1产品线总览IPS-1介绍精确而细致的攻击防护自学习的/自适应的/可控的安全性高级的分析和报表功能直观的中央管理模式汇总IPS-1架构3rdPartyIntegration

HPOpenView

Arcsite,Intellitactics

Netforensics

NessusMore…IPS-1ManagementDashboardCentralizedManagementRealTimeViewsAdvancedForensicsReportingandCompliance

IPS-1ManagementServerOptimizedDataStoreMulti-ElementCorrelationDynamicShielding

IPS-1SensorHybridDetectionEngineConfidenceIndexingOpensignaturelanguageMulti-modepreventionappliancewithFailover

IPS-1产品线RemoteofficesBranchoffice&MidsizebusinessesEnterprise&DataCentersPricePerformance$16,000$7,000$28,0004Gbps500Mbps100MbpsIPS-1Sensor50and200IPS-1Sensor500$110,000IPS-1PowerSensor1000and2000$75,000IPS-1模块IPS-1Sensor50IPS-1Sensor200IPS-1Sensor500IPS-1PowerSensor1000IPS-1PowerSensor2000NetworklocationRemoteoffice/networkperimeterRemoteoffice/networkperimeterNetworkperimeter(multi-segment)Networkcore(multi-segment)Networkcore(multi-segment)Throughput(IPS/IDS)50/75Mbps200/250Mbps500Mbps/1Gbps1/2Gbps2/4GbpsConcurrentsessions100,000200,000500,0001.2million2.8millionMonitoringinterfaces2x10/100/1000Mbpscopper2x10/100/1000Mbpscopperor2x1000Mbpsfiber4x10/100/1000Mbpscopperor4x1000Mbpsfiber8x10/100/1000Mbpscopperor8x1000Mbpsfiber8x10/100/1000Mbpscopperor8x1000Mbpsfiber议程网络安全的威胁IPS-1产品线总览IPS-1介绍精确而细致的攻击防护自学习的/自适应的/可控的安全性高级的分析和报表功能直观的中央管理模式汇总危机防御任务：

IPS-1混合引擎混合检测引擎弱点特征可扩展特征异常检测协议分析应用的自学习IP重组OS指纹应用指纹多元素关联性动态蠕虫缓解N-Code™

签名语言强大的混合签名语言扩展了检测能力针对30种以上的应用层协议的零日(0-day)攻击防范协议分析介绍NetworkLayer&TransportLayerprotocolanalysis网络和传输层的协议分析技术ApplicationLayerpre-processinganalysis应用层预处理技术ApplicationLayerprotocolanalysis应用层协议分析技术Protocolmis-use协议误用Protocolabnormal,static&dyamicabnormal协议异常,静态&动态异常State-basedapplicationlayerprotocolanalysis基于状态的应用层协议分析技术模式匹配vs

协议分析PM-O(n)PA-O(logn)协议分析的搜索树运算法则的复杂性协议分析的案例AnoldversionSendmail

BufferOverflowvulnerability$telnet25WIZshellorDEBUG#Thenyoucangaintherootshell！传统的模式匹配的检测Inspecteverypacket

,ifitcontains： “WIZ” |“DEBUG”Step1Inspecttheportnumber,Minimizetheinspectionscope

Port25:{ “WIZ” |“DEBUG”}Step2Ifthepacketsendbyclientside （查看数据包是否由client端发送）

Port25:{ Client-sends:“WIZ”| Client-sends:“DEBUG”}Step3StatefulInspection+AbnormalDetection (状态检测＋异常分支判断）

Port25:{

statefulclient-sends:“WIZ”|

statefulclient-sends:“DEBUG” afterstateful“DATA”client-sends line>1024bytesmeans possiblebufferoverflow}应用层状态检测介绍

基于关联性检测(ContextBasedInspection)TransportLayerstatetrack(传输层状态跟踪)单向双向会话+序列号ApplicationLayerstatetrack（应用层状态跟踪）Data/CommandSequenceFinitestatemachineFinitestatemachine范例基于关联性检测范例Recordastateoftheconnection，contextbasedinspectionAttackString1helotestmailfrom:testrcptto:testvrfydecodedatahellotest.quit

AttackString2helotestmailfrom:testrcptto:testdatahellotestvrfydecode.quitOS指纹和应用指纹信息ExampleofOSfingerprintx86basedoverflowattackwillnoteffectSPARCplatform自学习的/自适应的/可控的安全性

动态屏蔽架构动态屏蔽架构NetworkflowsNetworkChangesEndpointProfilingVulnerabilityInformationAdaptiveUpdatesActiveQuarantineSmartPolicyComplianceContextDetection管理和前摄的保护可以防止网络中的弱点攻击VulnerabilityBrowser

激活弱点扫描,可以进行察看和管理在弱点被利用以前采取行动来发现并进行防护措施Result:确认你的网路得到了充分的保护IPS-1提供一个建议以使得网络更加安全Nessus

介绍（扫描工具）TheNessusprojectStartedbyRenaud

Deraisonin1998;SupportbyTenableNetworkSecurity,Since2002;ThemostpopularVULscanner,Nessusscannerisusedby75,000organizationsworld-wide;UNIXbased,nowwindowsbasedversionisavailable(3.0.5)Licensefree,noIPlimitation.(Update7dayslaterthan“directfeedsupport”,whichis$1200peryear)高级分析和报表

信心索引&关联性报警快速分析攻击数据实时攻击监控和主动防御实时攻击事件和报警的分组和溢出抑制在预定义的报表基础创建更加丰富的报表内容简单/深度的监控和报警AlertBrowser在一个简单的界面中根据分级提供了所有的报警信息多个内置报警组–或者根据你的需要自建新的组Result:管理员可以进行快速分析和有效使用多种信息内容ConfidenceIndexingRealtimeAlertCorrelation小型部署非常简单…中央,可升级管理…但是也可以方便的扩展到企业部署图形化,自动的and导航模式功能保证您的网络在足够的安全性能IPS-1ProtectionEngine(Linux,Solaris)IPS-1EnterpriseServer(Linux,Solaris)EnterpriseDeploymentSmartSensor100(Appliance)中央化管理Client(Windows,Linux,Solaris)InternetMgmtNetSales&AccountingIT&EngineeringPowerSensor1000(Appliance)BasicDeploymentD.C.Seattle.SanJoseDallas

NewYork.EasternRegionalServer(Linux,Solaris)WesternRegionalServer(Linux,Solaris)Real-TimeVisibilityMangementReportsDetailedKnowledgeIPS-1优势高性能的防护Dataraterangesfrom50Mbpsto4Gbps.IPS-1PowerSensorsofferportdensity,highavailabilityfeaturesandplug-indatarateexpandability,guaranteeingdatarateexpansionwithoutforkliftupgrades.IPv6支持IPv6isacriticalrequirementintheU.S.FederalgovernmentandEuropeandIPS-1offersfullIPv6support.开放式签名语言IPS-1signaturesandsignaturelanguagecalledN-Code,isopenallowingcustomerstomodifyexistingsignaturesorwritetheirownsignatures.SmartDefense研究中心DedicatedteamofseasonedsecurityresearchexpertswhomonitortheInternetfornewexploitsandvulnerabilitiesonacontinuousbasisandproviderapidsolutions.总结:精确而细致的攻击防护MissionCriticalProtectionIn-line,ApplicationLayerIntrusionPreventionSystem“0-day”AttackPreventionfor30+ApplicationLayerProtocolsSuperioraccuracy,resistancetoIDS/IPSevasionTheHybridDetectionEngine:Right-fitsolutionsforyourprice/performanceneeds- Verdict:NetworkSanitization&WormDefenseActiveDynamicNetworkProtectionCriticalcomponentofCheckPoint’slong-termIPSvisionAutomaticallyimport,correlate,andadapttovulnerabilitydataThemostaccuratereportspossibleonbreachesandchangesCheckPointIPS-1SmartDefenseServicesSecurityResponseTeam(SRT):consistentlyfasterthanthecompetitionEveryIPS-1customerowns

SRT’sextensiveknowledgebase总结:中央管理InstallationinMinutes,NOTHoursorDays“Lights-out”IPS-1SmartSensorappliancescanbedrop-shippedExtensivese