思科入侵保护及安全监控响应解决方案.ppt

思科安全入侵防护及监控响应解决方案 客户的问题在哪里？ 思科的安全入侵防护无处不在 思科IPS 产品线分布 思科安全入侵防护及监控响应的优势分析 智能化检测 Vulnerability and Exploit specific Signatures Traffic and Protocol Anomaly Detection Heuristics (Statistical based algorithms) Knowledge base Anomaly Detection 专家级的响应机制 Risk Management-based Policy On-box Correlation through Meta Event Generator “Trustworthiness” Linkages with the Endpoint 灵活的部署方式 Passive and/or Inline with Flexible Response (IDS/IPS) Sensor Virtualization Physical and logical (VLAN) interface support Software and Hardware bypass Cisco IPS 的工作流程分析 Cisco IPS 可以阻止大量的攻击行为 利用风险评估机制控制IPS的防护行为 先进的威胁评估机制 针对零日攻击的实时异常检测机制 IPS对终端设备的安全状态感知 IPS与终端防护系统的联动 IPS的虚拟化部署 CS-MARS: “命令与控制” CS-MARS “联合防御” 利用网络设备的控制能力进行攻击防护 提供可视化的L2/L3攻击路径标识 防御设备的选择 提供准确的防护配置命令 CS-MARS: 策略报告 IPS的竞争对手及策略分析 Major IPS/IDS Competitor Local Vendor 启明星辰Venustech 安氏领信ISOne 绿盟科技NSFocus Non-Local Vendor 3Com-Tipping Point Juniper IBM-ISS McAfee Cisco IPS/MARS SWOT分析 IPS产品的价格对比（一） 思科IPS/MARS的竞争对比 项目竞争策略 一定要以IPS/MARS的整体方案进行竞争!!! 突出IPS与MARS的整体攻击确认、可以迅速定位响应及统计报表功能 突出IPS的混合部署IDS或IPS的能力，配合虚拟设备的能力，VLAN接口，更好地适应各种网络的需求 突出思科IPS的异常流量学习检测功能，有效防护各种未知攻击 突出思科IPS与终端防护系统CSA的联动，完成全网防护体系的构架 Cisco Systems has created the most complete intrusion prevention solution, offering comprehensive protection with unified management. Simply put, we have raised the bar in which prevention is measured. From the perimeter to the core, from the server to the endpoint, Cisco provides a unique and comprehensive protection solution all easily managed through scalable, unified management, built to fit your organizational needs. A key component to this Prevention Solution is the Cisco Intrusion Prevention System 4200 Series appliance family…. ? 2006 Cisco Systems, Inc. All rights reserved. Cisco Confidential Presentation_ID * ? 2006 Cisco Systems, Inc. All rights reserved. Cisco Confidential Presentation_ID * 安全问题影响生产率 (the CIO Problem) Employee Disruption and Application Outages Business Process Downtime 安全问题造成大量损失 (the CFO Problem) Risk and Liabil