Résumé du contenu de la page N° 1
TM
Desktop Protector
User Guide
Version 3.5
Résumé du contenu de la page N° 2
Internet Security Systems, Inc. 6303 Barfield Road Atlanta, Georgia 30328-4233 United States (404) 236-2600 http://www.iss.net © Internet Security Systems, Inc. 1999-2002. All rights reserved worldwide. Customers may make reasonable numbers of copies of this publication for internal use only. This publication may not otherwise be copied or reproduced, in whole or in part, by any other person or entity without the express prior written consent of Internet Security Systems, Inc. Patents pending
Résumé du contenu de la page N° 3
Contents Preface. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v Conventions Used in this Guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . vii Getting Technical Support . . . . . . . . . . . . . . . . . . . . .
Résumé du contenu de la page N° 4
Contents Appendix A: Operating Tabs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 The Events Tab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62 The Intruders Tab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Résumé du contenu de la page N° 5
Preface Overview Introduction This guide is designed to help you use RealSecure Desktop Protector to protect your local system and your network from unwanted intrusions. Scope This guide describes the features of RealSecure Desktop Protector and shows you how to use them. Chapter 1 explains how Desktop Protector protects your local system from attacks and unwanted intrusions. Chapter 2 provides information about using Desktop Protector to help ICEcap Manager manage network-wide security.
Résumé du contenu de la page N° 6
Preface Related publications The following documents are available for download from the Internet Security Systems Web site at www.iss.net. For information about working with RealSecure Desktop Protector on a corporate network, see the RealSecure ICEcap Manager User Guide. For answers to questions about Desktop Protector, see RealSecure Desktop Protector Frequently Asked Questions. For system requirements for Desktop Protector, see System Requirements. For general information about De
Résumé du contenu de la page N° 7
Conventions Used in this Guide Conventions Used in this Guide Introduction This topic explains the typographic conventions used in this guide to make information in procedures and commands easier to recognize. In procedures The typographic conventions used in procedures are shown in the following table: Convention What it Indicates Examples An element on the graphical Bold Type the computer’s user interface. address in the IP Address box. Select the Print check box. Click OK. A key on the
Résumé du contenu de la page N° 8
Preface Getting Technical Support Introduction ISS provides technical support through its Web site and by email or telephone. The ISS Web site The Internet Security Systems (ISS) Resource Center Web site (http://www.iss.net/ support/) provides direct access to much of the information you need. You can find frequently asked questions (FAQs), white papers, online documentation, current versions listings, detailed product literature, and the Technical Support Knowledgebase (http:// www.iss.net/s
Résumé du contenu de la page N° 9
Chapter 1 Introduction to RealSecure Desktop Protector Overview Introduction RealSecure Desktop Protector is a comprehensive security solution that helps you protect your system and your network from the following: theft of passwords, credit card information, personal files and more computer downtime and system crashes hackers using your system to start attacks against other systems This chapter describes the basic concepts of RealSecure Desktop Protector. In this chapter This chapter co
Résumé du contenu de la page N° 10
Chapter 1: Introduction to RealSecure Desktop Protector inbound and outbound traffic on your system for suspicious activity. Desktop Protector blocks unauthorized activity without affecting normal traffic. Intrusion detection RealSecure Desktop Protector contains an intrusion detection system that alerts you to attacks and blocks threats to your system. Desktop Protector captures information about the attacker and logs suspicious activity, which preserves evidence of the attack. Application R
Résumé du contenu de la page N° 11
Protection Levels Protection Levels Introduction Protection levels are pre-designed sets of security settings developed for different types of Web use. You can choose to have Desktop Protector block all communications with your system, some communications with your system, or no communications with your system. You can change protection levels at any time. How protection Protection levels modify your firewall by closing some of the software links, or ports, that levels work your system uses
Résumé du contenu de la page N° 12
Chapter 1: Introduction to RealSecure Desktop Protector Adaptive Protection Introduction Adaptive Protection automatically adapts each agent's security level according to the type of network connection it is using. For example, you can set Adaptive Protection to use a more restrictive security level when users are logged on over a VPN, and a less restrictive security level when users are logged directly onto the network. When to use You may need to connect to your corporate network from insi
Résumé du contenu de la page N° 13
The Desktop Protector Firewall The Desktop Protector Firewall Introduction Desktop Protector automatically stops most intrusions according to the protection level you have chosen, but you still may notice activity that isn't explicitly blocked. You can configure the Desktop Protector firewall to increase your protection. You can block intrusions from a particular address, or you can block intrusions that use a particular protocol. Protocol analysis The Desktop Protector firewall works by rec
Résumé du contenu de la page N° 14
Chapter 1: Introduction to RealSecure Desktop Protector Application Protection Introduction BlackICE protects your computer from unknown applications and from applications connecting to a network, such as the Internet. How the baseline First, BlackICE creates a baseline record (also known as a checksum) of the applications works installed on your computer. Then it compares that baseline with any application that attempts to launch or to communicate with a network. If the application does not
Résumé du contenu de la page N° 15
Application Control Application Control Introduction RealSecure Desktop Protector lets you control which applications and related processes can run on your system. Sometimes a program may be installed on your system without your knowledge. Many of these programs are useful or harmless. However, some of these programs can present security risks. They may allow an intruder to locate password information, make the system more vulnerable to future entry, or destroy programs or data on the hard
Résumé du contenu de la page N° 16
Chapter 1: Introduction to RealSecure Desktop Protector Communications Control Introduction To reduce security risks from potential “Trojan horse” applications on your system, RealSecure Desktop Protector lets you choose which applications or processes can access a network, such as the Internet or a local area network. How Desktop Protector tracks all the applications (and related processes) that you authorize to Communications access a network from your system. If any software installed on
Résumé du contenu de la page N° 17
Desktop Protector Alerts Desktop Protector Alerts Introduction Your dynamic firewall handles most alerts for you, but you can take additional steps to make its responses even more effective. The information in this topic may help you determine which events merit your attention. Severity levels Some network events are more dangerous than others. Desktop Protector assigns each event a numerical rank that reflects the event’s potential risk level, and reports that rank with an icon on the Event
Résumé du contenu de la page N° 18
Chapter 1: Introduction to RealSecure Desktop Protector Response levels Desktop Protector reports how it responded to each event by showing a symbol. The symbol for a response can appear two ways: as an icon beside the event as a mark over the severity level icon This table describes Desktop Protector response level icons and overlays: Icon Overlay Description Attack Blocked: Desktop Protector successfully blocked the attack. Depending on the severity of the event, Desktop Protector may a
Résumé du contenu de la page N° 19
Collecting Information Collecting Information Introduction When an intruder attempts to break into your system, RealSecure Desktop Protector can track the intruder’s activities. You can use this information to determine what an intruder did to your computer. This section explains how to gather and use this information. Back Tracing Desktop Protector can back trace each intrusion to determine where it originated. You can tell Desktop Protector to seek information from the originating computer
Résumé du contenu de la page N° 20
Chapter 1: Introduction to RealSecure Desktop Protector Filtering Information Introduction You probably won't need to inspect all the information RealSecure Desktop Protector gathers about the Internet traffic that reaches your system. You can use the configuration tabs to control how much information appears on the information tabs and how often Desktop Protector alerts you to potential risks. You can instruct Desktop Protector to show only events that present risks over a given level. For
