How intrusion prevention works
| Article:HOWTO81344 | | | Created: 2012-10-25 | | | Updated: 2012-10-27 | | | Article URL http://www.symantec.com/docs/HOWTO81344 |
Intrusion prevention is part of Network Threat Protection.
Intrusion prevention automatically detects and blocks network attacks and attacks on browsers. Intrusion prevention is the second layer of defense after the firewall to protect client computers. Intrusion prevention is sometimes called the intrusion prevention system (IPS).
Intrusion prevention intercepts data at the network layer. It uses signatures to scan packets or streams of packets. It scans each packet individually by looking for the patterns that correspond to network attacks or browser attacks. Intrusion prevention detects attacks on operating system components and the application layer.
Intrusion prevention provides two types of protection.
Table: Types of intrusion prevention
Type | Description |
|---|---|
Network intrusion prevention | Network intrusion prevention uses signatures to identify attacks on client computers. For known attacks, intrusion prevention automatically discards the packets that match the signatures. |
Browser intrusion prevention | Browser intrusion prevention monitors attacks on Internet Explorer and Firefox. Browser intrusion prevention is not supported on any other browsers. Firefox might disable the Symantec Endpoint Protection plug-in, but you can re-enable it. This type of intrusion prevention uses attack signatures as well as heuristics to identify attacks on browsers. For some browser attacks, intrusion prevention requires that the client terminate the browser. A notification appears on the client computer. See the following knowledge base article for the latest information about the browsers that browser intrusion prevention protects: Supported browser versions for browser intrusion prevention. |
|
|
Legacy ID
v36814179_v81626097
Article URL http://www.symantec.com/docs/HOWTO81344
Terms of use for this information are found in Legal Notices
Thank you.