Symantec™ Security Gateways Reference Guide - Sawmill

Chapter 9Preventing attacksThis chapter includes the following topics:■■■■■Antivirus (appliance only)Intrusion detection and prevention (appliance only)Logical network interfacesAddress transformsAnti-spam measuresAntivirus (appliance only)Understanding antivirusViruses are a leading cause of concern to the enterprise. Viruses can easily spread and pose major threats tocritical business operations and financial investment. Implementing antivirus protection at the securitygateway is a critical step in protecting your network against viruses and other related threats. The securitygateway provides comprehensive virus protection and lets you control scanning by individual services soyou can configure virus protection specific to your needs.The security gateway implements Symantec antivirus technology using a scan engine that detects viruses,worms, and Trojan horses in all major file types. The scan engine also detects mobile code, such as Java,ActiveX, and standalone script-based threats. The security gateway uses Symantec’s key antivirus enginetechnologies, including Bloodhound for heuristic detection of new or unknown viruses and Symantec’sNorton AntiVirus Extension (NAVEX), which provides protection from new classes of viruses automaticallyby means of LiveUpdate.The security gateway’s antivirus component includes a decomposer that handles compressed file formatsand nested levels of files. For embedded files, scanning is limited to certain file types based on extension.The scan server handles the following archival and encoded file types:.amg .arj .cab .exe .gz .hqx.lha .lz MIME .rar .rtf .ss.tar .txt .tnef /uue .z .zipSymantec antivirus technology is fully supported by the Symantec Security Response Team. Symantec’sSecurity Response engineers work 24 hours per day, 7 days per week, tracking new virus outbreaks andidentifying new virus threats.