Table of Contents
Advertisement
BlueProtect
Optional. Enable BlueProtect Endpoint Scanning support as described in Appendix C,
Endpoint
"Endpoint Scanning." BlueProtect cannot be disabled if existing roles require BlueProtect.
Scanning
Saving the
Click Save to save the HTTP server settings to the BSC database. You may be prompted to
settings
restart the BSC. We recommend that you do not restart the BSC until you have completely
finished configuring the BSC for use in your network.
Intrusion Detection System
The BSC provides an administrator-configurable Intrusion Detection System (IDS) to
defend itself and the network it is protecting from intruders, worms, and other targeted
attacks.
By using the BSC IDS, you can:
•
monitor all traffic into and through the BSC for possible intrusion
•
isolate and classify the type of an intrusion
•
alert, log, and report an intrusion
•
configure and monitor the IDS using the standard BSC administrator console
The BSC IDS detects and protects your network against many forms of intrusion,
including:
•
a flood of packets on one or more ports using one or more IP addresses
•
sniffing, network mapping, ping flooding, port scanning, tcp-session oriented attacks.
•
noise generators
•
users infected with Internet worms that scan or flood the network, and impact network
performance negatively
The BSC IDS functions by examining all packets passing through it from the managed
side of the network and determining if this traffic falls within the boundaries of normal
traffic. These boundaries of normal traffic are defined and configured by BSC
administrators.
As the BSC IDS examines user traffic, it deducts any signature of an attack to identify the
type of attack and then takes appropriate action. Based on incoming traffic and
configured traffic boundaries, the IDS transitions user hosts on the managed side using
the state model represented in the following figure.
The possible IDS host states shown in the preceding figure are described as follows.
BlueSecure™ Controller Setup and Administration Guide
Intrusion Detection System
10-5
Advertisement
Table of Contents
