How intrusion prevention works

Article:HOWTO81344  |  Created: 2012-10-25  |  Updated: 2014-09-21  |  Article URL http://www.symantec.com/docs/HOWTO81344
Article Type
How To


Subject


How intrusion prevention works

Intrusion prevention is part of Network Threat Protection.

Intrusion prevention automatically detects and blocks network attacks. On Windows computers, intrusion prevention also detects and blocks browser attacks on supported browsers. Intrusion prevention is the second layer of defense after the firewall to protect client computers. Intrusion prevention is sometimes called the intrusion prevention system (IPS).

Intrusion prevention intercepts data at the network layer. It uses signatures to scan packets or streams of packets. It scans each packet individually by looking for the patterns that correspond to network attacks or browser attacks. Intrusion prevention detects attacks on operating system components and the application layer.

Table: Types of intrusion prevention

Type

Description

Network intrusion prevention

Network intrusion prevention uses signatures to identify attacks on client computers. For known attacks, intrusion prevention automatically discards the packets that match the signatures.

Browser intrusion prevention (Windows only)

Browser intrusion prevention monitors attacks on Internet Explorer and Firefox. Browser intrusion prevention is not supported on any other browsers.

Firefox might disable the Symantec Endpoint Protection plug-in, but you can turn it back on.

This type of intrusion prevention uses attack signatures as well as heuristics to identify attacks on browsers.

For some browser attacks, intrusion prevention requires that the client terminate the browser. A notification appears on the client computer.

See the following knowledge base article for the latest information about the browsers that browser intrusion prevention protects: Supported browser versions for browser intrusion prevention.

See Managing intrusion prevention on your client computers


Legacy ID



v36814179_v81626097


Article URL http://www.symantec.com/docs/HOWTO81344


Terms of use for this information are found in Legal Notices