Symantec™ Security Gateways Reference Guide - Sawmill

14 Introducing Symantec security gatewaysWhere to get more informationTraditionally, network intrusion detection systems (NIDS) consist of one or more sensors deployed acrossan enterprise and a console to aggregate and analyze the collected data. The majority of commercial IDSproducts are based on a system that examines network traffic for special patterns of attack. This method ofdetection is called signature-based detection. Some NIDS miss attacks because they cannot keep pace withthe high traffic volumes, or generate unmanageable numbers of alerts due to false positives.Symantec’s intrusion detection and prevention component provides a common, highly coordinatedapproach to detect attacks at very high speeds within the network environment. Using an array ofdetection methodologies to enhance attack identification, the intrusion detection and preventioncomponent collects evidence of malicious activity with a combination of protocol anomaly detection (PAD),traffic rate monitoring, protocol state tracking, and IP packet reassembly. The intrusion detection andprevention component does not rely on signatures to detect attack, giving administrators hours, if notdays, to respond to the threat and helping to close the window of vulnerability inherent in other detectionsolutions.Where to get more informationYou can find additional information concerning this product in:■■■■■■■■■■■■Symantec Gateway Security 5400 Series Installation GuideSymantec Gateway Security 5400 Series Administrator’s GuideSymantec Gateway Security 5400 Series Release NotesSymantec Enterprise Firewall Installation GuideSymantec Enterprise Firewall Administrator’s GuideSymantec Enterprise Firewall Release NotesSymantec Advanced Manager for Security Gateways (Group 1), Symantec Event Manager for SecurityGateways (Group 1) Integration GuideSymantec Advanced Manager for Security Gateways (Group 1), Symantec Event Manager for SecurityGateways (Group 1) Administrator’s GuideSymantec Advanced Manager for Security Gateways (Group 1), Symantec Event Manager for SecurityGateways (Group 1) Release NotesSymantec Client VPN User’s GuideSymantec Client VPN Quick Start CardSymantec Client VPN Release NotesYou can find additional information on TCP/IP, networking, and Internet security in:■■■■DNS and Bind, Paul Albitz and Cricket Liu. 3rd ed. Sebastopol, California: O’Reilly & Associates, Inc.,1998. ISBN 1-56592-512-2.Internetworking with TCP/IP, Vol. 1, Principles, Protocols, and Architecture, Douglas E. Comer. 4th ed.Upper Saddle River, New Jersey: Prentice Hall, 1995. ISBN 0-130-18380-6.Firewalls and Internet Security: Repelling the Wiley Hacker, William R. Cheswick, Steven M. Bellovin,and Aviel D. Rubin. 2nd ed. Boston, Massachusetts: Pearson Education, Inc., 2003. ISBN 0-201-63466-XTCP/IP Illustrated. Vol. 1, The Protocols, W. Richard Stevens. Reading, Massachusetts: Addison WesleyPublishing Co., 1994. ISBN 0-201-63346-9