Document ID: RDWR-DP-V0602_UG1201
117
Chapter 5 – Security Configuration
A security policy in an organization is a set of rules and regulations that defines what constitutes a
secure network and how it reacts to security violations. You implement a security policy for your
organization by using the global security settings, network-protection policy, and server-protection
policy. You can adjust a security policy to suit the security needs of different network segments
down to a single server, providing comprehensive protection for your organization.
Each policy consists of multiple rules. Each rule in a policy defines a network segment or server, one
or more protection profiles to be applied, and the action to be taken when the device detects an
attack.
Each protection profile defines the security defenses that provide protection against a specific
network threat. For example, the Signature Protection profile prevents intrusion attempts, and the
Behavioral DoS profile prevents flood attacks aimed at creating denial of service.
Note:
All the configuration procedures in this section assume that the relevant device is
selected in the Configuration perspective navigation pane.
This chapter contains the following sections:
•
Security Protections, page 117
•
Selecting a Device for Security Configuration, page 118
•
Configuring Global Security Settings, page 118
•
Managing the Network Protection Policy, page 144
•
Managing the Server Protection Policy, page 187
•
Configuring White Lists, page 195
•
Configuring Black Lists, page 198
•
Managing the ACL Policy, page 202
Security Protections
DefensePro’s multi-layer security approach combines features for detecting and mitigating a wide
range of network and server attacks.
DefensePro supports three types of security protections: Network-wide protections, Server
protections, and Access-control policies.
Network-wide protections comprise the following:
•
Behavioral DoS—Protects against zero-day flood attacks, including SYN Floods, TCP Floods,
UDP floods, ICMP and IGMP floods.
•
SYN-flood protection—Protects against any type of SYN flood attack using SYN cookies. A
SYN flood attack is usually aimed at specific servers with the intention of consuming the server’s
resources. However, you configure SYN Protection as a Network Protection to allow easier
protection of multiple network elements.
•
Signature-based protection—Protects against known application vulnerabilities, and common
malware, such as worms, trojans, spyware, and DoS.
•
Fraud protection using RSA feeds.
•
Packet-anomaly protections.
Summary of Contents for DefensePro 6.02
Page 1: ...DefensePro User Guide Software Version 6 02 Document ID RDWR DP V0602_UG1201 January 2012 ...
Page 2: ...DefensePro User Guide 2 Document ID RDWR DP V0602_UG1201 ...
Page 20: ...DefensePro User Guide 20 Document ID RDWR DP V0602_UG1201 ...
Page 28: ...DefensePro User Guide Table of Contents 28 Document ID RDWR DP V0602_UG1201 ...
Page 116: ...DefensePro User Guide Device Network Configuration 116 Document ID RDWR DP V0602_UG1201 ...
Page 302: ...DefensePro User Guide Real Time Security Reporting 302 Document ID RDWR DP V0602_UG1201 ...
Page 308: ...DefensePro User Guide Administering DefensePro 308 Document ID RDWR DP V0602_UG1201 ...
Page 324: ...DefensePro User Guide Troubleshooting 324 Document ID RDWR DP V0602_UG1201 ...
