|
Extensive
Detection Rules
BayBiz Security utilizes a database of over 1,500 rules to detect
patterns indicating:
- Hostile probing, port scans,
backdoor probes, illegitimate interrogations, host sweeps
and other activities.
- Denial of service (DoS) attacks
like SYN flood.
- Protocol exploitations, leveraging
weaknesses in DNS, FTP, ICMP, IMAP, POP3, RPC, SNMP, x11
and other network protocols
- Application attacks, exploiting
programming errors in internally developed software and
CGI scripts, and in popular applications and databases
such as Oracle, MySQL server, Coldfusion and Frontpage.
- Targeted attacks that exploit the
vulnerability of messaging and chat traffic and
Peer-2-Peer (P2P) networking.
-
- Intrusion Detection and
Prevention
BayBiz
Security performs intrusion detection by identifying suspicious
behavior and notifying the system administrator about
incidents.
The software can also provide intrusion prevention by working
with the firewall to immediately block incoming traffic
associated with intrusions.
Intrusion detection and prevention can be employed
simultaneously.
New threat patterns are installed frequently through the BayBiz
Up2Date service. BayBiz monitors and adopts new threat
patterns posted to the database of the Snort project, the
largest open source intrusion detection project.
Performance and Control
By putting intrusion
protection in-line with the firewall, BayBiz Security
ensures that all Internet and VPN traffic is inspected, and
that there are no delays as traffic is routed to a separate
sensor.
The administrator can also tailor testing to each network and
server by:
- Enabling or disabling any of the
over 1,500 rules.
- Customizing existing rules or
creating new ones.
- Performing certain classes of
tests only on specific networks or traffic from specific
servers (for example, executing email-related tests only
on traffic to and from email servers).
-
- Selected Classes of Intrusion
Detection Rules
Probes and Attacks
- Backdoor software
- Denial of service
- Distributed denial of service
- Network scanning
- Unwanted traffic
Applications and
Services
- Messaging and chat
- MySQL Server database
- Oracle database
- CGI scripts
- P2P networks (Napster, Kazaa)
- Coldfusion
- FrontPage
- Microsoft IIS
- Multimedia streaming software
Protocols
- DNS
- FTP
- ICMP
- IMAP
- NetBIOS
- NNTP
- P2P
- POP2
- POP3
- RPC
- SMTP
- SQL
- TFTP
- X11
|