Symantec™ Security Gateways Reference Guide - Sawmill

Preventing attacksIntrusion detection and prevention (appliance only)117The IDS/IPS component consists of two major pieces:■■State machinesSignature engineState machinesSignature engineOne piece of the IDS/IPS component is the state machines. State machines are faster than signature-basedattack detection mechanisms, as each state machine focuses on only one protocol, and generally requiresfewer updates. State machines are updated when the agreed upon behavior of a protocol is changed (a newRFC, for example), or if a well-known signature-based method is to be incorporated into the state engine.The core detection methodology used by the state machines is protocol anomaly detection (PAD). The statemachines perform attack detection at the application layer, focusing on the structure and the content ofthe communications. The state machines then compare observed behavior during network protocolexchange and note deviations from expected behavior; deviations are considered in context, and potentiallywith data from other sources. Unlike misuse detection which searches for patterns of known behavior, PADcan detect zero-day attacks of unknown patterns because of the deny all approach to protocol irregularity;if a connection doesn’t adhere exactly to definition in the state machine, it’s flagged as suspicious.The signature engine provides a detection mechanism for non-anomalous attacks. As robust as the statemachines are for detecting attacks, there are some attacks that are dealt with more effectively through asignature engine. The signatures included with the appliance are not modifiable. The IDS/IPS componentcompares events to its included signatures, and responds if it finds a match. Because the signatures arehard-coded and unmodifiable, the comparison is done at a high rate of speed.Global gatingThe global gating switch decides if the security gateway is going to wait for an answer from the IDS/IPScomponent before sending a packet up the stack. If global gating is on, the driver does not process thepacket until it hears back from the intrusion detection component. If global gating is off, the call is stillmade to the IDS/IPS component, but the packet is not held waiting for a response; if an event is triggeredbecause of the packet, it is logged only. Global gating is off by default. Gating is applied on a per event basis.Table 9-1 shows the effects of enabling or disabling the various gating options.Table 9-1Event filteringGlobalgatingEventenabledEventgatedPassed upthe stackReportedCommentsOff Yes No Yes Yes When global gating is off, you cannot selectivelygate attacks.Off No No Yes No When global gating is off, you cannot selectivelygate attacks.On Yes Yes No Yes None.On No No Yes No If an attack is disabled when global gating is on, itis automatically ungated.On Yes No Yes Yes You can selectively ungate attacks.