思科IPS产品介绍.pptVIP

新一代可感知上下文（Context Aware）的IPS;Internet;Internet;;What Policy Do I Apply to this Flow?;;;;;;;;Only Cisco has pulled together all the components necessary to secure your network based assets.;;;;;Gartner;State of the art hardware for superior performance ;;;ASA 5515-X;; ;;*Source: 2012 Infonetics Network Security– 4Q11 Assumed PAN, Checkpoint, Juniper, and Other Revenue entirely Integrated; Everything else Standalone ;Borderless Network;Borderless Network;Standalone Customer Roles/Responsibilities Dedicated SecOps wants control over device Customer preferences for dedicated devices. Deployment Promiscuous (SPAN) or Inline Deploy in front of firewall for auditing Price performance Better IPS price/performance because not paying for firewall ;IPS 4500/4300 Standalone ASA 5585-X ASA 5500-X ;Software Architecture supporting next generation IPS Features;Solution Strategy;Innovations in Threat Management;Current Controls: IPPort Protocol VLANs User Identity Promiscuous / Inline ;;;;Innovations in Threat Management;Traffic Normalization Evasion ID;;Innovations in Threat Management;Unparalleled Context Parameters Create Accurate Business Risk Rating;;;Innovations in Threat Management;Innovations in Threat Management;;What are Virtual Sensors? A Virtual Sensor allows for multiple instances of a sensor to exist on one IPS device Up to 4 virtual sensors are supported ;;Cisco IPS Reputation Filter: Drops packets from a known malicious source before signature based inspection. Reputation Filter Database is continuously updated Protects against attacks from known botnets Mitigation based on Context (Source), not just content Faster than traditional signature-only methods;;Additional inspection function designed to: Prevent abnormal traffic from passing the sensor Prevent obfuscation of attacks (anti-evasion) “Backup” the other signature actions during prolonged attacks;How does the Normalizer achieve this ? Strict tracking of TCP state Strict tracking of sequence numbers Track