Maintaining Idp; Creating Idp-Only Administrators; Simplifying Management - Juniper NETWORK AND SECURITY MANAGER 2010.2 - ADMINISTRATION GUIDE REV1 Administration Manual

Network and Security Manager Administration Guide

Maintaining IDP

Creating IDP-Only Administrators

Simplifying Management

54
Attackers are constantly devising new and better ways to infiltrate your network. Juniper
Networks actively discovers these new attacks and creates new attack objects to detect
them—so you can prevent the attacks from entering your network. To ensure that the
IDP security module and security policies remain highly effective against all emerging
and evolving threats, we highly recommend that you perform frequent updates to the
attack object database and to the IDP detection engine, described in "Managing the
Attack Object Database" on page 287.
You can use NSM's role-based administration (RBA) to create a custom role for
administrators working with IDP functionality on a device. For example, if your
organization's IDS or IDP administrators do not configure firewall/VPN security devices,
you can restrict administrative privileges for those administrators within the NSM system
to IDP tasks only.
NOTE: The NSM "super" administrator automatically has all IDP-related permissions.
A custom role for IDP administrators might include the following permissions:
Attack Update
Create/View/Edit/Delete Policies
Create/View/Edit/Delete Backdoor and IDP Rulebases
View Firewall Rulebases
Create/Edit/Delete Shared Objects and Groups
For details on RBA in NSM, see "Configuring Role-Based Administration" on page 66; for
an example that shows how to create an IDP-only administrator, see "Creating
Administrators" on page 67.
When you add devices to NSM, you are creating the network organization that you use
to manage your security system. Before you begin the device creation or device import
process however, first review your network topology and decide how you want it to appear
in NSM. This is particularly important when you are creating a new network, but is also
helpful when you are importing networks, because you might want to edit your network
design to take advantage of key NSM management features.
These features include:
Using Device Groups on page 55
Using Device Templates on page 55
Using Configuration Groups on page 55
Copyright © 2010, Juniper Networks, Inc.