McAfee HISCDE-AB-IA - Host Intrusion Prevention User manual

McAfee Host Intrusion Prevention 8.0
Product Guide for use with ePolicy Orchestrator 4.5

COPYRIGHT
Copyright ©2010 McAfee, Inc. All Rights Reserved.
No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language in any form
or by any means without the written permission of McAfee, Inc., or its suppliers or affiliate companies.
TRADEMARK ATTRIBUTIONS
AVERT, EPO, EPOLICY ORCHESTRATOR, FOUNDSTONE, GROUPSHIELD, INTRUSHIELD, LINUXSHIELD, MAX (MCAFEE SECURITYALLIANCE
EXCHANGE), MCAFEE, NETSHIELD, PORTALSHIELD, PREVENTSYS, SECURITYALLIANCE, SITEADVISOR, TOTAL PROTECTION, VIRUSSCAN,
WEBSHIELD are registered trademarks or trademarks of McAfee, Inc. and/or its affiliates in the US and/or other countries. McAfee Red in
connection with security is distinctive of McAfee brand products. All other registered and unregistered trademarks herein are the sole property
of their respective owners.
LICENSE INFORMATION
License Agreement
NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED,
WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH
TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS
THAT ACCOMPANY YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET,
A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU
DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN
THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND.
McAfee Host Intrusion Prevention 8.0 Product Guide for ePolicy Orchestrator 4.52

Contents
Introducing Host Intrusion Prevention..................................................7
Host IPS protection.........................................................................7
Host IPS policies...........................................................................8
Host IPS policy management.................................................................9
HostIPSpolicytrackingandtuning...........................................................10
Managing Your Protection...............................................................12
Information management...................................................................12
Host IPS dashboards...............................................................12
Host IPS queries...................................................................13
Policy management........................................................................16
Where to find policies...............................................................16
Configuring polices.................................................................17
Default protection and tuning........................................................18
Host IPS policy migration............................................................22
System management......................................................................23
Host IPS permission sets............................................................23
Host IPS server tasks...............................................................25
HostIPSeventresponses............................................................26
Host IPS protection updates .........................................................27
Configuring IPS Policies..................................................................29
Overview of IPS policies....................................................................29
Methodsfordelivery of IPS protection.................................................30
Signatures........................................................................31
Behavioralrules....................................................................32
Reactions.........................................................................32
Exceptions........................................................................32
Application protection rules..........................................................33
Events...........................................................................33
Enable IPS protection......................................................................33
Configuring the IPS Options policy....................................................34
Set the reaction for IPS signatures...........................................................35
3McAfee Host Intrusion Prevention 8.0 Product Guide for ePolicy Orchestrator 4.5

Configuring the IPS Protection policy..................................................36
Define IPS protection......................................................................36
Configuring the IPS Rules policy......................................................37
Assigningmultiple instances of thepolicy...............................................37
FAQ — Multiple-instance policies......................................................38
How IPS signatures work............................................................39
How IPS application protection rules work..............................................43
HowIPS exceptions work............................................................46
MonitorIPSevents........................................................................47
Managing IPS events...............................................................48
Creating an exception from an event..................................................49
Creating a trusted application from an event............................................50
MonitorIPSclientrules.....................................................................50
Managing IPS client rules............................................................50
Configuring Firewall Policies............................................................52
Overview of Firewall policies................................................................52
How firewall rules work.............................................................53
How firewall rule groups work .......................................................55
How the Host IPS catalog works......................................................58
Firewall stateful packet filtering and inspection. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
How learn and adaptive modes affect the firewall. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
Firewall client rules.................................................................64
Enable firewall protection...................................................................64
Configuring the Firewall Options policy ................................................65
FAQ—McAfeeTrustedSourceandthefirewall...........................................66
Define firewall protection...................................................................67
ConfiguringtheFirewallRulespolicy...................................................68
Creating and editing firewall rules ....................................................69
Creating and editing firewall rule groups...............................................69
Creatingconnectionisolationgroups...................................................70
Blocking DNS traffic................................................................70
Usingthe HostIPScatalog...........................................................70
Managingfirewallclient rules.........................................................71
FAQ— Useof wildcards inFirewall Rules...............................................72
Configuring General Policies ............................................................73
Overview of General policies................................................................73
Define client functionality...................................................................74
McAfee Host Intrusion Prevention 8.0 Product Guide for ePolicy Orchestrator 4.54
Contents

ConfiguringaClientUIpolicy.........................................................74
Setting Client UI general options......................................................75
Setting Client UI advanced options and passwords. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
Setting Client UI troubleshooting options...............................................76
Define trusted networks....................................................................77
Configuring a Trusted Networks policy.................................................78
Define trusted applications..................................................................78
Configuring a Trusted Applications policy...............................................79
Creating and editing Trusted Application rules. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79
Assigningmultiple instances of thepolicy...............................................80
Working with Host Intrusion Prevention Clients .....................................81
OverviewoftheWindowsclient..............................................................81
System tray icon menu..............................................................81
ClientconsoleforWindowsclients.....................................................83
UnlockingtheWindowsclientinterface.................................................83
Setting client UI options.............................................................83
Troubleshooting the Windows client...................................................84
Windows client alerts...............................................................86
AbouttheIPS Policy tab.............................................................88
About the Firewall Policy tab.........................................................89
About the Blocked Hosts tab.........................................................91
EditingtheBlocked Hosts list.........................................................92
About the Application Protection List tab...............................................92
About the Activity Log tab...........................................................93
Overview of the Solaris client ...............................................................94
Policy enforcementwiththeSolarisclient...............................................94
Troubleshooting the Solaris client.....................................................95
Overview of the Linux client ................................................................97
Policy enforcementwith the Linuxclient................................................97
Notes about the Linux client.........................................................97
Troubleshooting the Linux client......................................................98
Appendix A — Writing Custom Signatures and Exceptions.........................101
Rule structure...........................................................................101
Common sections.................................................................102
Optional common sections..........................................................104
Wildcards and variables............................................................104
Windowscustomsignatures................................................................107
5McAfee Host Intrusion Prevention 8.0 Product Guide for ePolicy Orchestrator 4.5
Contents

Windows class Buffer Overflow......................................................107
Windows class Files...............................................................108
Windows class Hook...............................................................111
Windows class Illegal Host IPS API Use...............................................112
Windows class Illegal Use..........................................................113
WindowsclassIsapi (HTTP).........................................................113
Windows class Program............................................................116
Windows class Registry............................................................117
Windows class Services............................................................120
Windows class SQL................................................................122
Classesanddirectivesper Windowsplatform...........................................123
Non-Windowscustomsignatures............................................................127
Solaris/Linux class UNIX_file........................................................127
Solaris/Linux class UNIX_apache (HTTP)..............................................130
Solaris/Linux class UNIX_Misc.......................................................131
Solaris class UNIX_bo..............................................................132
Solaris class UNIX_map............................................................133
Solaris class UNIX_GUID...........................................................133
Classes and directives per UNIX platform..............................................134
Appendix B — Troubleshooting........................................................136
General issues...........................................................................136
Host IPS logs............................................................................141
Clientcontrol.exe utility....................................................................144
McAfee Host Intrusion Prevention 8.0 Product Guide for ePolicy Orchestrator 4.56
Contents

Introducing Host Intrusion Prevention
McAfee®Host Intrusion Prevention is a host-based intrusion detection and prevention system
that protects system resources and applications from external and internal attacks. It provides
a manageable and scalable intrusion prevention solution for workstations, notebooks, and critical
servers, including web and database servers. Its patented technology blocks zero-day and
known attacks.
Host Intrusion Prevention (sometimes abbreviated in the product as Host IPS or HIP) can protect
information and prevent the compromising of system and network resources and applications
that store and deliver information. It accomplishes this with an end-point firewall feature and
an intrusion prevention system (IPS) feature. The IPS feature has monthly content updates,
which reduces the urgency of patches for new threats. The Host Intrusion Prevention firewall
feature is purchased separately or in combination with the Host Intrusion Prevention IPS feature.
Host Intrusion Prevention is fully integrated with ePolicy Orchestrator and uses its framework
to deliver and enforce policies. This approach provides a single management solution that allows
for mass deployment of up to 100,000 systems in multiple languages across an entire enterprise
for true global coverage.
Contents
Host IPS protection
Host IPS policies
Host IPS policy management
Host IPS policy tracking and tuning
Host IPS protection
After all the required components for Host Intrusion Prevention are installed and communicating,
you are ready to apply protection, monitor events, and update policies and content as needed.
Basic protection
Host Intrusion Prevention ships with a set of default settings that provide basic protection for
your environment. These settings include:
• For IPS protection:
• High severity signatures are prevented and all other signatures are ignored
•McAfee applications are listed as trusted applications for all rules except IPS self-protection
rules
• Predefined applications and processes are protected
• For firewall protection:
7McAfee Host Intrusion Prevention 8.0 Product Guide for ePolicy Orchestrator 4.5

Basic network connectivity is allowed•
NOTE: When Host Intrusion Prevention 8.0 is first installed no protection is enabled. You must
enable protection in the IPS Options or Firewall Options policy and apply the policy to the client.
Advanced protection
For advanced protection, switch from the default settings to stronger preset settings, or create
custom settings.
Start with a sample deployment to monitor and tune the new settings. Tuning involves balancing
intrusion prevention protection and access to required information and applications per group
type.
Host IPS policies
A policy is a collection of settings that you configure and enforce through the ePolicy Orchestrator
console. Applying policies ensures that your security needs on managed systems are met. Host
Intrusion Prevention provides three policy features, each with a set of security options. These
are: IPS,Firewall, and General. IPS and firewall features contain a “rules” policy with rules
that define behavior, and an “options” policy that enables or disables the rules.
Ownership of policies is assigned in the Policy Catalog. After a policy is created, it can be
edited or deleted only by the creator of the policy, the person associated as an owner of the
policy, or the global administrator. Deleting a policy can be done only in the Policy Catalog.
IPS policies
The IPS feature contains three policies that protect both Windows and non-Windows computers.
It details exceptions, signatures, application protection rules, events, and client-generated
exceptions.
•IPS Options (All platforms). Turns on or off IPS protection and application of adaptive
mode for tuning.
•IPS Protection (All platforms). Defines the protection reaction to events that signatures
generate.
•IPS Rules (All platforms). Defines signatures, exceptions, and application protection rules.
This policy is a multiple instance policy, which allows for several IPS Rules policies, instead
of a single policy, to be assigned to a system. The effective policy is then the result of the
merged contents of the policies. If there are conflicting settings, the most protective explicit
setting is applied.
Firewall policies
The Firewall feature contains three policies that protect Windows computers only. It filters
network traffic, allowing legitimate traffic through the firewall and blocking the rest.
•Firewall Options (Windows only). Turns on or off firewall protection and application of
adaptive or learn mode for tuning.
•Firewall Rules (Windows only). Defines firewall rules.
•Firewall DNS Blocking (Windows only). Defines the domain name servers that are to be
blocked.
Introducing Host Intrusion Prevention
Host IPS policies
McAfee Host Intrusion Prevention 8.0 Product Guide for ePolicy Orchestrator 4.58

General policies
The General feature contains three policies that can apply to both the IPS and Firewall features.
•Client UI (Windows only). Defines access to the Host Intrusion Prevention user interface
on Windows client systems, including troubleshooting options. Also provides
password-protection on all non-Windows client systems.
•Trusted Networks (Windows only). Lists IP addresses and networks that are safe for
communication. Used with the IPS and Firewall features.
•Trusted Applications (All platforms). Lists applications that are trusted to perform most
operations. Used with the IPS feature. This policy is also a multiple instance policy, which
allows for several Trusted Applications policies, instead of a single policy, to be assigned to
a system. The effective policy is the result of the merged contents of the policies. If there
are conflicting settings, the most protective setting is applied.
Host IPS policy management
The ePolicy Orchestrator console allows you to configure Host Intrusion Prevention policies
from a central location.
How policies are enforced
When you change Host Intrusion Prevention policies in the ePolicy Orchestrator console, the
changes take effect on the managed systems at the next agent-server communication. This
interval is set to occur once every 60 minutes by default. To enforce policies immediately, you
can send an agent wake-up call from the ePolicy Orchestrator console.
Policies and their categories
Policy information for Host Intrusion Prevention is grouped by feature and category . Each policy
category refers to a specific subset of policies.
A policy is a configured group of settings for a specific purpose. You can create, modify, or
delete as many policies as needed.
Each policy has a preconfigured McAfee Default policy, which cannot be edited or deleted.
Except for IPS Rules and Trusted Applications, all policies also have an editable My Default
policy based on the default policy. Some policy categories include several read-only preconfigured
policies. If these preconfigured policies meet your needs, you can apply any one of them. These
read-only policies, like all policies, can be duplicated and the duplicate customized, if needed.
IPS Rules and Trusted Applications policies are multiple-instance policies because you can assign
multiple policy instances under a single policy. The policy instances are automatically combined
into one effective policy.
TIP: The McAfee Default policies for IPS Rules and Trusted Applications are automatically
updated as part of the content update process. McAfee recommends always assigning these
policies to all clients and creating additional policy instances to customize the behavior of these
two policies.
How policies are applied
Policies are applied to any System Tree group or system by inheritance or assignment.
Inheritance determines whether the policy settings for any system are taken from its parent.
By default, inheritance is enabled throughout the System Tree. You can break inheritance by
Introducing Host Intrusion Prevention
Host IPS policy management
9McAfee Host Intrusion Prevention 8.0 Product Guide for ePolicy Orchestrator 4.5

direct policy assignment . Host Intrusion Prevention, as managed by ePolicy Orchestrator, enables
you to create policies and assign them without regard to inheritance. When you break this
inheritance by assigning a new policy, all groups and systems below inherit the new policy.
Policy ownership
Each policy is required to have an assigned owner. Ownership ensures that no one can modify
the policy other than the global administrator, the creator of the policy, or the person associated
as the policy owner. Any administrator can use any policy that exists in the catalog, but only
the creator, owner, or global administrator can modify it.
TIP: Rather than use a policy owned by a different administrator, we recommend that you
duplicate the policy, then assign the duplicate. Otherwise, if you assign a policy that you do
not own to System Tree groups that you administer, and the owner of the policy modifies it,
all systems to which this policy is assigned receive these modifications.
Host IPS policy tracking and tuning
The deployment and management of Host Intrusion Prevention clients are handled from ePolicy
Orchestrator. In the ePO System Tree you can group systems hierarchically by attributes. For
example, you might group a first level by geographic location and a second level by operating
system platform or IP address. McAfee recommends grouping systems by Host Intrusion
Preventionn configuration criteria, including system type (server or desktop), use of major
applications (web, database, or mail server), and strategic locations (DMZ or intranet). You can
place systems that fit a common usage profile into a common group on the System Tree. In
fact, you might name a group after its usage profile, for example, Web Servers .
With computers grouped in the System Tree according to type, function, or geographic location,
you can easily divide administrative functions along the same lines. With Host Intrusion
Prevention you can divide administrative duties based on product features, such as IPS or
firewall.
Deploying Host Intrusion Prevention to thousands of computers is easily managed because
most computers fit into a few usage profiles. Managing a large deployment is reduced to
maintaining a few policy rules. As a deployment grows, newly added systems should fit one or
more existing profiles, and be placed under the correct group on the System Tree.
Preset protection
Host Intrusion Prevention offers two types of protection:
• Basic protection is available through the McAfee Default policy settings. This protection
requires little or no tuning and generates few events. For many environments this basic
protection might be sufficient.
• Advanced protection is also available from some preconfigured IPS and firewall policies or
by creating custom policies. Servers, for example, need stronger protection than that offered
in basic protection.
Both scenarios require some tuning of protection settings for actual working environments is
required.
Adaptive mode
To help tune protection settings, Host Intrusion Prevention clients can create client-side rules
to server-mandated policies that block legitimate activity. The automatic creation of client rules
Introducing Host Intrusion Prevention
Host IPS policy tracking and tuning
McAfee Host Intrusion Prevention 8.0 Product Guide for ePolicy Orchestrator 4.510