DOCSLIB.ORG

Sourcefire Fireamp User Guide

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Sourcefire Fireamp User Guide Sourcefire FireAMP User Guide Version 4.5 Terms of Use Applicable to the User Documentation The legal notices, disclaimers, terms of use, and other information contained herein (the "terms") apply only to the information discussed in this documentation (the "Documentation") and your use of it. These terms do not apply to or govern the use of websites controlled by Sourcefire, Inc. or its subsidiaries (collectively, "Sourcefire") or any Sourcefire-provided products. Sourcefire products are available for purchase and subject to a separate license agreement and/or terms of use containing very different terms and conditions. Terms of Use and Copyright and Trademark Notices The copyright in the Documentation is owned by Sourcefire and is protected by copyright and other intellectual property laws of the United States and other countries. You may use, print out, save on a retrieval system, and otherwise copy and distribute the Documentation solely for non-commercial use, provided that you (i) do not modify the Documentation in any way and (ii) always include Sourcefire's copyright, trademark, and other proprietary notices, as well as a link to, or print out of, the full contents of this page and its terms. No part of the Documentation may be used in a compilation or otherwise incorporated into another work or with or into any other documentation or user manuals, or be used to create derivative works, without the express prior written permission of Sourcefire. Sourcefire reserves the right to change the terms at any time, and your continued use of the Documentation shall be deemed an acceptance of those terms. Sourcefire, the Sourcefire logo, Snort, the Snort and Pig logo, Immunet, ClamAV and certain other trademarks and logos are trademarks or registered trademarks of Sourcefire, Inc. in the United States and other countries. Other company, product and service names may be trademarks or service marks of others. © 2004 - 2013 Cisco and/or its affiliates. All rights reserved. Disclaimers THE DOCUMENTATION AND ANY INFORMATION AVAILABLE FROM IT MAY INCLUDE INACCURACIES OR TYPOGRAPHICAL ERRORS. SOURCEFIRE MAY CHANGE THE DOCUMENTATION FROM TIME TO TIME. SOURCEFIRE MAKES NO REPRESENTATIONS OR WARRANTIES ABOUT THE ACCURACY OR SUITABILITY OF ANY SOURCEFIRE-CONTROLLED WEBSITE, THE DOCUMENTATION AND/OR ANY PRODUCT INFORMATION. SOURCEFIRE-CONTROLLED WEBSITES, THE DOCUMENTATION AND ALL PRODUCT INFORMATION ARE PROVIDED "AS IS" AND SOURCEFIRE DISCLAIMS ANY AND ALL EXPRESS AND IMPLIED WARRANTIES, INCLUDING BUT NOT LIMITED TO WARRANTIES OF TITLE AND THE IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL SOURCEFIRE BE LIABLE TO YOU FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, PUNITIVE, OR CONSEQUENTIAL DAMAGES (INCLUDING BUT NOT LIMITED TO PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES, LOSS OF DATA, LOSS OF PROFITS, AND/OR BUSINESS INTERRUPTIONS), ARISING OUT OF OR IN ANY WAY RELATED TO SOURCEFIRE-CONTROLLED WEBSITES OR THE DOCUMENTATION, NO MATTER HOW CAUSED AND/OR WHETHER BASED ON CONTRACT, STRICT LIABILITY, NEGLIGENCE OR OTHER TORTUOUS ACTIVITY, OR ANY OTHER THEORY OF LIABILITY, EVEN IF SOURCEFIRE IS ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. BECAUSE SOME STATES/JURISDICTIONS DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES, THE ABOVE LIMITATIONS MAY NOT APPLY TO YOU. The Documentation may contain "links" to websites that are not created by, or under the control of Sourcefire. Sourcefire provides such links solely for your convenience, and assumes no responsibility for the availability or content of such other sites. 2014-Mar-05 11:44 Table of Contents Table of Contents Chapter 1: Introduction .................................................................................. 6 Chapter 2: Dashboard..................................................................................... 7 System Requirements .......................................................................................... 7 Menu .................................................................................................................... 8 Dashboard................................................................................................ 8 Analysis.................................................................................................... 8 Outbreak Control ..................................................................................... 9 Reports .................................................................................................... 9 Management ......................................................................................... 10 Accounts................................................................................................ 11 Overview Tab...................................................................................................... 11 Indications of Compromise.................................................................... 12 Malware and Network Threat Detections.............................................. 13 Events Tab .......................................................................................................... 13 Filters and Subscriptions........................................................................ 13 SHA-256 File Info Context Menu........................................................... 14 List View ................................................................................................ 15 Heat Map Tab ..................................................................................................... 15 Chapter 3: Outbreak Control........................................................................ 17 Simple Custom Detections................................................................................. 17 Application Blocking............................................................................................ 19 Advanced Custom Signatures............................................................................. 20 Custom Whitelists .............................................................................................. 22 IP Black / White Lists.......................................................................................... 23 IP Black Lists.......................................................................................... 23 IP White Lists ........................................................................................ 24 Editing IP Black / White Lists ................................................................. 25 Custom Exclusion Sets....................................................................................... 25 Creating and Managing Custom Exclusion Sets.................................... 26 Antivirus Compatibility Using Exclusions............................................... 26 Android Custom Detections ............................................................................... 30 Version 4.5 Sourcefire FireAMP User Guide 1 Table of Contents Chapter 4: Policies ........................................................................................ 32 Policy Contents................................................................................................... 33 Name, Lists, and Description................................................................. 33 FireAMP Windows Connector............................................................................ 34 General Tab............................................................................................ 35 File Tab................................................................................................... 40 Network Tab........................................................................................... 46 FireAMP Mac Connector .................................................................................... 47 General Tab............................................................................................ 47 File Tab................................................................................................... 51 Network Tab........................................................................................... 54 FireAMP Mobile Policy........................................................................................ 54 Connector > Administrative Features .................................................... 55 Policy Summary .................................................................................................. 55 Chapter 5: Groups ......................................................................................... 56 Configuring the Group ........................................................................................ 56 Name and Description ........................................................................... 57 Parent Menu .......................................................................................... 57 Policy Menu ........................................................................................... 57 Adding Computers................................................................................. 58 Moving Computers ................................................................................ 58 Chapter 6: Deploying the FireAMP Windows Connector ....................... 59 Direct Download ................................................................................................. 59 Email..................................................................................................................
Load more

Recommended publications
  • Hostscan 4.8.01064 Antimalware and Firewall Support Charts
    HostScan 4.8.01064 Antimalware and Firewall Support Charts 10/1/19 © 2019 Cisco and/or its affiliates. All rights reserved. This document is Cisco public. Page 1 of 76 Contents HostScan Version 4.8.01064 Antimalware and Firewall Support Charts ............................................................................... 3 Antimalware and Firewall Attributes Supported by HostScan .................................................................................................. 3 OPSWAT Version Information ................................................................................................................................................. 5 Cisco AnyConnect HostScan Antimalware Compliance Module v4.3.890.0 for Windows .................................................. 5 Cisco AnyConnect HostScan Firewall Compliance Module v4.3.890.0 for Windows ........................................................ 44 Cisco AnyConnect HostScan Antimalware Compliance Module v4.3.824.0 for macos .................................................... 65 Cisco AnyConnect HostScan Firewall Compliance Module v4.3.824.0 for macOS ........................................................... 71 Cisco AnyConnect HostScan Antimalware Compliance Module v4.3.730.0 for Linux ...................................................... 73 Cisco AnyConnect HostScan Firewall Compliance Module v4.3.730.0 for Linux .............................................................. 76 ©201 9 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public.
    [Show full text]
  • 2016 SIEM Content and Parsing Updates Table of Contents
    2016 SIEM Content and Parsing Updates Table of Contents Table of Contents 2 SIEM Data Sources 5 January 21, 2016 5 February 10, 2016 5 February 16, 2016 5 February 26, 2016 5 March 25, 2016 5 June 2, 2016 6 June 8, 2016 6 July 19, 2016 6 August 04, 2016 6 August 11, 2016 6 August 15, 2016 6 September 1, 2016 6 September 2, 2016 7 September 26, 2016 7 October 12, 2016 7 October 13, 2016 7 November 7, 2016 7 November 10, 2016 8 November 11, 2016 8 December 2, 2016 8 SIEM Custom Types 9 October 13, 2016 9 October 25, 2016 9 SIEM Parsing Rules 10 January 8, 2015 10 January 12, 2016 10 January 13, 2016 10 January 21, 2016 10 January 22, 2016 11 January 25, 2016 11 January 29, 2016 11 January 29, 2016 11 February 4, 2016 11 February 8, 2016 12 February 10, 2016 12 February 11, 2016 12 February 16, 2016 12 February 17, 2016 12 February 19, 2016 13 February 23, 2016 13 February 24, 2016 13 February 25, 2016 13 February 26, 2016 13 February 29, 2016 14 March 2, 2016 14 March 3, 2016 14 March 7, 2016 15 March 8, 2016 15 March 9, 2016 15 March 11, 2016 15 March 14, 2016 15 March 16, 2016 15 March 17, 2016 16 March 18, 2016 16 March 21, 2016 16 March 24, 2016 17 March 25, 2016 17 March 29, 2016 17 March 30, 2016 18 March 31, 2016 18 April 01, 2016 18 April 04, 2016 18 April 07, 2016 18 April 08, 2016 18 April 21, 2016 18 2 April 26, 2016 19 May 3, 2016 19 May 5, 2016 19 May 5, 2016 19 May 9, 2016 19 May 11, 2016 19 May 16, 2016 19 May 18, 2016 19 May 23, 2016 19 May 24, 2016 20 May 25, 2016 20 May 26, 2016 21 May 27, 2016 21 June 2, 2016 21 June 06,
    [Show full text]
  • Accomplished and Certified IT Security Professional with Experience Assisting Organizations Successfully Complete Enterprise-Wide Security Projects
    ROHIT BANKOTI Accomplished and certified IT security professional with experience assisting organizations successfully complete enterprise-wide security projects. Experience in finance, technology, healthcare, telecom industries and a proven track record of streamlining security processes, design and implement efficient security solutions, lead and assist multi-disciplined, multi-national teams in achieving security efficiency. Professional Qualifications: • Degree Bachelor of Technology (Computer Science ) • CGPA 6.36/10 • Institute University Institute of Engg. & Tech. (MDU), Rohtak Academic Qualifications: • Completed XII standard from Hamdard Public School (CBSE) in with 79% • Completed X standard from Amrita Public School (CBSE) in with 81% CERTIFICATIONS • Sophos Certified Architect for UTM by RED Education. • Sophos Certified Engineer for Endpoint, MDM, Email protection, Encryption. • GFI (Languard, FAX maker, Mail essential & Cloud, Endpoint security • CEH version 7 training from net hub. • ECSA (E-council) 412-79 complete training from net hub. • Smooth Wall Certified engineer and Operator Certified. • McAfee certified for McAfee VSE, EPO, Mobile Management, HIPS and Mail. • Symantec Partner certification and Advanced Threat Protection. • Certified Information Security and Ethical hacking (C.I.S.E) from innobuzz. • Infowatch (DLP) training on endpoint and network level. • Qualys Vulnerability Expert. • C++ and .NET certification from Aptech, South Extension (Delhi) Professional Synopsis: Currently:- Working with Mckinsey & Company, Gurgaon, India as Security Engineer. - Mainly working with ATP projects. - Anti-phishing program - Other Operations 2015 to 2016 with CSC (Computer Science & Corporation), Noida - Sandboxing and Malware clean-up process - Identify Malware Domain and Phishing Attack vector. • Dec 2014 to Aug 2015 with ASIT, Delhi as Security Consultant. Working as UTM, SIEM, MDM and DLP architect.
    [Show full text]
  • MRG Effitas Real Time Protection Test Project, First Quarter (Q2 2013)
    MRG Effitas Real Time Protection Test Project, First Quarter – Q2 2013 MRG Effitas Real Time Protection Test Project, First Quarter (Q2 2013) Copyright 2013 MRG Effitas Ltd. This article or any part of it must not be published or reproduced without the consent of the copyright holder. 1 MRG Effitas Real Time Protection Test Project, First Quarter – Q2 2013 Contents: Introduction 3 Security Applications Tested 3 Methodology used in the Test 4 Samples Used 5 Test Results 6 Conclusions 7 Copyright 2013 MRG Effitas Ltd. This article or any part of it must not be published or reproduced without the consent of the copyright holder. 2 MRG Effitas Real Time Protection Test Project, First Quarter – Q2 2013 Introduction: The MRG Effitas Real Time Protection Testing Project is a replacement for and an evolution of the “Flash Tests” conducted to date. For those unfamiliar with the Flash Tests, their purpose was to give an indication of product efficacy against live, ITW threats applied to the System Under Test (SUT) using a valid, real world infection vector and process. Despite using live ITW malware and realistic infection vectors, we always added the caveat that due to the small malware sample size used, the individual Flash Tests should not be used as a rigorous assessment of product efficacy and that their purpose was to give an indication of efficacy over time. The MRG Effitas Real Time Protection Testing Project is designed to overcome the limitation of the Flash Tests by using greatly increased number of malware samples and higher testing frequency. The project will run for twelve months commencing at the start of Q2 2013 and finishing at the end of Q1 2014 – in line with all our other projects.
    [Show full text]
  • Windows Antivirus Support Chart for Hostscan 3.1.06073 Product Name
    Windows Antivirus Support Chart for HostScan 3.1.06073 Marketing Product Data File Engine Live Version Check RTP Set RTP Language Alias Name Time Version Update Names 360Safe.co m 360 1.x ✔ ✔ ✔ ✔ ✔ English 360杀毒 Antivirus 360 3.x ✔ ✘ ✔ ✘ ✘ English Antivirus 360 Total 4.x ✔ ✔ ✔ ✘ ✘ English Security Chinese 360 360杀毒 1.x ✔ ✔ ✔ ✘ ✘ Simplified Antivirus Chinese 360 360杀毒 2.x ✔ ✔ ✔ ✘ ✘ Simplified Antivirus Chinese 360杀毒 3.x ✘ ✘ ✔ ✘ ✘ Simplified Chinese 360 360杀毒 4.x ✘ ✘ ✔ ✘ ✘ Simplified Antivirus Chinese 360 360杀毒 5.x ✘ ✘ ✔ ✘ ✘ Simplified Antivirus Other 360Safe.co x ✘ ✘ ✘ ✘ ✘ English m Antivirus AEC, spol. s r.o. TrustPort 2.x ✘ ✘ ✔ ✔ ✘ English Antivirus Other AEC, spol. s r.o. x ✘ ✘ ✘ ✘ ✘ English Antivirus Agnitum Ltd. Outpost Antivirus 7.x ✔ ✔ ✔ ✔ ✘ English Pro Outpost Antivirus 8.x ✔ ✔ ✔ ✔ ✘ English Pro Outpost Antivirus 9.x ✔ ✔ ✔ ✔ ✔ English Pro Outpost Outpost Security Antivirus 6.x ✔ ✔ ✔ ✔ ✘ English Suite Pro Pro 2009 2009 Outpost Security 7.x ✘ ✘ ✔ ✘ ✘ English Suite Free Outpost Security 7.x ✔ ✔ ✔ ✔ ✘ English Suite Pro Outpost Security 8.x ✔ ✔ ✔ ✔ ✔ English Suite Pro Outpost Security 9.x ✔ ✔ ✔ ✔ ✔ English Suite Pro Other Agnitum x ✘ ✘ ✘ ✘ ✘ English Ltd. Antivirus AhnLab, Inc. AhnLab Security 2.x ✔ ✔ ✘ ✔ ✘ English Pack AhnLab V3 Internet 7.x ✔ ✔ ✔ ✔ ✘ English Security 2007 AhnLab V3 Internet Security 7.x ✔ ✔ ✔ ✔ ✘ English 2007 Platinum AhnLab V3 Internet Security 7.x ✔ ✔ ✔ ✔ ✘ English 2008 Platinum AhnLab V3 Internet Security 7.x ✔ ✔ ✔ ✔ ✔ English 2009 Platinum AhnLab V3 Internet Security 7.0 7.x ✔ ✔ ✔ ✔ ✘ English Platinum Enterprise AhnLab V3 Internet 8.x ✔ ✔ ✔ ✔ ✔ English Security 8.0 AhnLab V3 Internet 9.x ✔ ✔ ✔ ✔ ✔ English Security 9.0 AhnLab V3 VirusBlock Internet 7.x ✔ ✔ ✘ ✔ ✘ English Security 2007 AhnLab V3 VirusBlock Internet Security 7.x ✔ ✔ ✔ ✘ ✔ English 2007 Platinum Enterprise V3 Click 1.x ✔ ✘ ✘ ✘ ✘ English V3 Lite 1.x ✔ ✔ ✔ ✔ ✔ Korean V3 Lite 3.x ✔ ✔ ✔ ✘ ✘ Korean V3 VirusBlock 6.x ✔ ✔ ✘ ✘ ✘ English 2005 V3 ウイルスブ NA ✔ ✔ ✘ ✔ ✘ Japanese ロック V3Pro 2004 6.x ✔ ✔ ✔ ✔ ✘ English Other AhnLab, x ✘ ✘ ✘ ✘ ✘ English Inc.
    [Show full text]
  • Mssp Advanced Threat Protection Service
    SOLUTION BRIEF SOLUTION BRIEF: MSSP ADVANCED THREAT PROTECTION SERVICE MSSP Advanced Threat Protection Service Fortinet Empowers MSSP Delivery of Complete ATP Managed Security Service The Need For ATP Managed Security Service FIGURE 1: ADVANCED PRESISTANT THREAT LIFECYCLE According to Frost & Sullivan, the global Managed Security Services (MSS) market will grow from $9B in 2013 to $15B by 2015. This business opportunity is driven by two main factors - the growing acceptance of cloud-based, Security-as-a- Service delivery and the need for enterprises and SMBs alike to reduce security related CAPEX and OPEX costs. As the threat landscape continues to evolve and grow in both volume and sophistication, MSSPs need to evolve their MSS offerings to address this growing threat and provide Advanced Threat Protection (ATP) services. Advanced Persistent Threats are well thought, multi stage processes as outlines in figure 1. Protecting against these APTs requires an equally well thought, multi stage framework that will deploy the largest number of weapons available in the MSSP’s security arsenal to provide a meaningful response for its customers’ concerns. 1 1 SOLUTION BRIEF: MSSP ADVANCED THREAT PROTECTION SERVICE Fortinet’s Advanced Threat Protection Framework for MSSPs Fortinet arms MSSPs with a structured Advanced Threat Protection Framework – to provide organizations a comprehensive solution to address this new class of advanced targeted attacks. There is no one component or technology that will guarantee protection from a sufficiently targeted and sophisticated attack. Each technology has inherent strengths and weaknesses, which, even when deployed together but independently from other technologies, may leave exploitable gaps in the network’s defense architecture.
    [Show full text]
  • Cisco Identity Services Engine Supported Windows AV/AS/PM/DE
    Cisco Identity Services Engine Supported Windows AS/AV, Patch Management and Disk Encryption Products Compliance Module Version 3.6.10363.2 This document provides Windows AS/AV, Patch Management and Disk Encryption support information on the the Cisco AnyConnect Agent Version 4.2. Supported Windows Antispyware Products Vendor_Name Product_Version Product_Name Check_FSRTP Set_FSRTP VirDef_Signature VirDef_Time VirDef_Version 360Safe.com 10.x 360安全卫士 vX X v v 360Safe.com 4.x 360安全卫士 vX X v v 360Safe.com 5.x 360安全卫士 vX X v v 360Safe.com 6.x 360安全卫士 vX X v v 360Safe.com 7.x 360安全卫士 vX X v v 360Safe.com 8.x 360安全卫士 vX X v v 360Safe.com 9.x 360安全卫士 vX X v v 360Safe.com x Other 360Safe.com Antispyware Z X X Z X Agnitum Ltd. 7.x Outpost Firewall Pro vX X X O Agnitum Ltd. 6.x Outpost Firewall Pro 2008 [AntiSpyware] v X X v O Agnitum Ltd. x Other Agnitum Ltd. Antispyware Z X X Z X AhnLab, Inc. 2.x AhnLab SpyZero 2.0 vv O v O AhnLab, Inc. 3.x AhnLab SpyZero 2007 X X O v O AhnLab, Inc. 7.x AhnLab V3 Internet Security 2007 Platinum AntiSpyware v X O v O AhnLab, Inc. 7.x AhnLab V3 Internet Security 2008 Platinum AntiSpyware v X O v O AhnLab, Inc. 7.x AhnLab V3 Internet Security 2009 Platinum AntiSpyware v v O v O AhnLab, Inc. 7.x AhnLab V3 Internet Security 7.0 Platinum Enterprise AntiSpyware v X O v O AhnLab, Inc. 8.x AhnLab V3 Internet Security 8.0 AntiSpyware v v O v O AhnLab, Inc.
    [Show full text]
  • Cisco Identity Services Engine Release 1.2 Supported Windows
    Cisco Identity Services Engine Supported Windows AV/AS Products Compliance Module Version 3.5.6317.2 This document provides Windows 8/7/Vista/XP AV/AS support information on the Cisco NAC Agent version 4.9.0.x and later. For other support information and complete release updates, refer to the Release Notes for Cisco Identity Services Engine corresponding to your Cisco Identity Services Engine release version. Supported Windows AV/AS Product Summary Added New AV Definition Support: COMODO Antivirus 5.x COMODO Internet Security 3.5.x COMODO Internet Security 3.x COMODO Internet Security 4.x Kingsoft Internet Security 2013.x Added New AV Products Support: V3 Click 1.x avast! Internet Security 8.x avast! Premier 8.x avast! Pro Antivirus 8.x Gen-X Total Security 1.x K7UltimateSecurity 13.x Kaspersky Endpoint Security 10.x Kaspersky PURE 13.x Norman Security Suite 10.x Supported Windows AntiVirus Products Product Name Product Version Installation Virus Definition Live Update 360Safe.com 360 Antivirus 1.x 4.9.0.28 / 3.4.21.1 4.9.0.28 / 3.4.21.1 yes 360 Antivirus 3.x 4.9.0.29 / 3.5.5767.2 4.9.0.29 / 3.5.5767.2 - 360杀毒 1.x 4.9.0.28 / 3.4.21.1 4.9.0.28 / 3.4.21.1 - 360杀毒 2.x 4.9.0.29 / 3.4.25.1 4.9.0.29 / 3.4.25.1 - 360杀毒 3.x 4.9.0.29 / 3.5.2101.2 - Other 360Safe.com Antivirus x 4.9.0.29 / 3.5.2101.2 - AEC, spol.
    [Show full text]
  • Research Lab
    SKYBOX SECURITY RESEARCH LAB Technology Brief From targeted, highly sophisticated attacks to distributed cybercrime– as–a–service, the tools used to carry out cyberattacks change constantly. In malware alone, tens of thousands of variants emerge each year, making it difficult for traditional anti-virus solutions to recognize each strain. But rather than chasing each variant, Skybox takes a fundamental approach to proactively combat cyberthreats, cutting off attacks at the source — prioritizing exploitable vulnerabilities for immediate remediation. Using this threat–centric approach to vulnerability management, even if an attacker is able to infiltrate an organization’s network, the vulnerabilities they looked to exploit would already be neutralized. The Skybox® Research Lab is the force behind this threat–centric vulnera- bility intelligence. The team of security analysts scours data from dozens of security data sources and investigates sites in the dark web. The result is the most accurate vulnerability assessments based on Skybox–certified intelligence of the current threat landscape — delivered to you daily. The work of the Skybox Research Lab tracks tens of thousands of vulner- abilities on more than 8,000 products including: • Server and desktop operating systems • Business and desktop applications • Networking and security technologies • Developer tools • Internet and mobile applications • IoT devices • Industrial control system (ICS) and supervisory control and data acquisition (SCADA) devices Total visibility. Focused Protection.™ Research Lab | Technology Brief KEY FEATURES While many tasks of the Research Lab are automated, the human element is key. Security analysts validate and enhance data through manual • Aggregated intelligence analysis, bringing their knowledge of attack trends, cyber events and from dozens of security tactics, techniques and procedures of today’s cyberattackers.
    [Show full text]
  • An Innovative Custom Cyber Security Solution for Protecting Enterprises and Corporates’ Assets
    An Innovative Custom Cyber Security Solution for Protecting Enterprises and Corporates’ Assets Karim Ouazzane*, Markson Aigbodi, Daniel Mitchell, Vassil Vassilev School of Computing, London Metropolitan University E-mail: [email protected], [email protected], [email protected], [email protected] Jun Li Department of Oncology, University of Oxford E-mail: [email protected] Abstract Anti-virus software has been the main defense against malicious application and will remain so in the future. However the strength of an anti-virus product will depend on having an updated virus signature and the heuristic engine to detect future and unknown virus. The time gap between an exploit appearing on the internet and the user receiving an update for their anti-virus signature database on their machine is very crucial. Having a diverse multi-Engine anti-virus scanner in the infrastructure with the capability for custom signature definition as part of a defence in-depth strategy will help to close that gap. This paper presents a technique of deploying more than one anti-virus solution at different layers and using custom anti-virus signature which is deployed in a custom proxy solution as part of a defence in-depth strategy. Keywords: Anti-virus, ClamAV, Malware, defence in-depth, Portable Executable (PE), Cyber security. Introduction Malicious applications like virus, worm, Trojan, Spamming and phishing tools can infect and destroy information in a user’s computer through means that the user utilizes in communicating on the internet. Email, File attachment, web surfing or file transfer on the internet either with a desktop or a smart phone are just a few of the many ways that potential harmful applications called Malware (Norton, 2012) can be introduced into the network.
    [Show full text]
  • Fireamp Private Cloud Console User Guide.Book
    Sourcefire FireAMP Private Cloud User Guide Version 4.5 Legal Notices Cisco, the Cisco logo, Sourcefire, the Sourcefire logo, Snort, the Snort and Pig logo, and certain other trademarks and logos are trademarks or registered trademarks of Cisco and/or its affiliates in the United States and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. The legal notices, disclaimers, terms of use, and other information contained herein (the "terms") apply only to the information discussed in this documentation (the "Documentation") and your use of it. These terms do not apply to or govern the use of websites controlled by Cisco or its subsidiaries (collectively, "Cisco") or any Sourcefire-provided or Cisco-provided products. Sourcefire and Cisco products are available for purchase and subject to a separate license agreement and/or terms of use containing very different terms and conditions. The copyright in the Documentation is owned by Cisco and is protected by copyright and other intellectual property laws of the United States and other countries. You may use, print out, save on a retrieval system, and otherwise copy and distribute the Documentation solely for non-commercial use, provided that you (i) do not modify the Documentation in any way and (ii) always include Cisco’s copyright, trademark, and other proprietary notices, as well as a link to, or print out of, the full contents of this page and its terms.
    [Show full text]
  • Fireamp Private Cloud Quick Start Guide.Book
    Private Cloud Quick Start Last Updated: March 26, 2018 Cisco Systems, Inc. www.cisco.com 2 Chapter 1: Introduction ............................................................... 2 First Use Wizard......................................................................................................... 3 Dashboard ................................................................................................................. 3 Creating Exclusions for Antivirus Products ................................................................. 4 Creating Antivirus Exclusions in the FireAMP Connector............................... 4 Creating Exclusions for the FireAMP Connector in Antivirus Software........... 6 Configuring a Policy................................................................................................... 8 Creating Groups ........................................................................................................ 9 Deploying a Connector .............................................................................................. 9 Downloading the Connector Installer .......................................................... 10 Installing the Connector.............................................................................. 10 Firewall Connectivity................................................................................................ 15 Firewall Exceptions..................................................................................... 15 European Union Firewall Exceptions ..........................................................
    [Show full text]