显示标签为“Mcafee”的博文。显示所有博文
显示标签为“Mcafee”的博文。显示所有博文

2009年4月30日星期四

“风险”无处不在

0 评论

来源:赛迪网


     【赛迪网讯】“AC米兰赢了!咱们3比1淘汰里昂,爽!”欧主管大半夜给钱经理发短信,庆祝AC米兰冠军杯晋级。

  “太爽了,看得我紧张死了,睡吧睡吧,可算可以踏实睡觉了。明天还要准备一个新的项目,是一笔不错的生意,真是双喜临门啊!”钱经理回了一条短信给钱经理。

  欧主管回短信说,“借您吉言,晚安,明儿见!”
   
谈需求

  借我一双慧眼 查出信息风险

  清晨,钱经理洗漱完毕直奔公司,为了准备这单新的生意,钱经理前前后后没少操心。在路上,钱经理的心一直吊着,生怕出一点点问题。

  到了公司,钱经理打开电脑,准备收电子邮件,却发现无法连接互联网。要知道在这个数字时代离开了互联网,钱经理会浑身不自在。作为IT公司,不能接入互联网的企业就等于被判了“死刑”。

  着急的钱经理打电话给i博士,向i博士求救,“i博士,快来我这边一趟吧,我这边的网络似乎出现了一些问题,无法连接互联网,而且我的防病毒软件总是报警,系统也变得特别缓慢,不知道是什么原因。”i博士接到电话后,马上赶了过来。

  i博士看到钱经理着急的样子,马上开始检查。对钱经理说,你们公司也慢慢长大了,企业信息资产不断膨胀的同时,意味着相关的信息量也在迅速的膨胀,但是作为一个企业来讲,管理维护人员编制的增加肯定是赶不上信息系统的增长速度的。

  钱经理反问:“那我该如何做呢?现在整个公司的网络系统看上去风平浪静,实际上我曾经也感到过危机四伏,没有对网络进行彻底地深入了解,也不知道哪里存在安全隐患,不知道风险到底在哪里。”

  i博士和钱经理说:“我建议你对整体的网络架构,直到终端系统进行系统地风险评估,风险评估管理系统通过风险组织模型、完善的规范化的风险评估流程、标准的风险评估结果数据处理,实现对企业和组织风险评估实践的指导,并作为风险评估和风险管理的统一操作平台。”

  i博士还提醒钱经理要注意,风险管理系统包含了企业的核心安全机密,一旦泄密将带来灾难性的后果,故其自身的安全性也是非常重要的,必须有严格明确的用户管理、权限分配、访问控制等措施。

  i博士点评

  风险管理系统包含了企业的核心安全机密,一旦泄密将带来灾难性的后果,故其自身的安全性也是非常重要的,必须有严格明确的用户管理、权限分配、访问控制等措施。

  
说应用

  信息风险管理 一步一个脚印

  i博士对钱经理说:“全面的风险评估和风险管理系统,不是单纯的仅仅对于一些系统软件的技术型评估和管理,更多的还是应该是对管理和技术两个角度进行评估和管理。”

  风险管理系统主要功能应该具备:能够收集来自不同资产和漏洞评估软件的原始风险情况;在进行风险综合分析的时候可以将资产实际情况考虑进来以减少误报;将确认的风险通过内部工单的方式进行派发;对于所有进行处理的工单进行跟踪,同时可以评价人员的工作效率等功能。

  钱经理说:“对于我的网络来说,风险评估是不是不仅局限于技术上的评估,还需要有包含管理体系上的评估是否具备这方面的评估能力和方法。需要平台化的管理体系,支持多用户分权限的管理,能够进行多任务的处理。”

  i博士解释说,管理平台建立详细完整的知识库实现内部工作区域的最大化资源和经验共享,全面的风险管理系统需要结合企业实际网络组成情况。例如企业当前的管理维护人员的组织结构、网络中特有的应用业务系统等等。

  真正要做好风险管理平台,就需要走入用户网络中进行专门的需求调研和产品软件定制。而高端的风险管理系统应该走一条定制化的开发路线,产品厂商应该具备深厚的产品技术研发实力。

  风险管理进行拆分后又包含资产管理、脆弱性管理、威胁管理,所以选择产品的时候要认真查看是否包含了这些功能与它们的收集评估方法是否完善。

  对于选购来说,企业需要智能化的风险管理系统,首先需要对于各种原始安全事件与漏洞信息进行归并,可以将风险与资产责任人进行关联进行管理任务下发的工单系统,同时可以对于确认的风险信息与处理情况进行变化跟踪。

  i博士点评

  真正要做好风险管理平台,就需要走入用户网络中进行专门的需求调研和产品软件定制,从未来看高端的风险管理系统应该走一条定制化的开发路线,产品厂商应该具备深厚的产品技术研发实力。

  产品推介

  1. mcafee foundstone enterprise
  2. 绿盟科技“极光”远程安全评估系统
  3. 天融信网络卫士安全管理系统 TSM
  4. e-Cop Cyclops ESM


......
显示全文...

2009年3月30日星期一

Mcafee Foundstone 无法添回ip pool 的问题

0 评论

Mcafee Foundstone概况简介:

  • 识别风险漏洞。
  • 确定资源优先级。
  • 降低风险。
      您知道哪些威胁和漏洞需要及时处理? 作为 McAfee 安全风险管理解决方案的重要组件,McAfee Foundstone® Enterprise 可确定漏洞所在的位置,然后将资源应用到最亟需的地方。 灵活的报告和准确的网络评估功能使您能够全面监控自己的系统,从而做出正确的决策,避免违反策略的行为。
       功能描述: 基于优先级、可提供防范措施的解决方案 使用基于优先级的方法来解决最重大的漏洞问题;让您将关注焦点放在最宝贵的资产上,查明最有价值的资产,有针对性地防范高风险漏洞,并采取补救措施应对最紧迫的威胁;从系统防护解决方案 (ePO™) 导入缓冲区溢出防护数据,避免安装不必要的补丁程序 全面的内容检查 作为全球最知名的安全问题研究机构之一,McAfee Avert® Labs 全天候及时而全面地监控漏洞;Foundstone 的身份验证检查功能使您能深入分析操作系统和网络设备,从中查找漏洞和违反策略的行为;发现网络中未受管理的无线接入点 确定新威胁对企业的影响 快速评估入侵威胁对您的网络造成的影响;您无需单独执行扫描,Foundstone 的威胁关联功能,可将破坏您现有资产的威胁与漏洞数据相关联,在几分钟内即可直观地显示新威胁的潜在风险,并对其进行评级 市场领先的报告功能 按资产或按网络对数据进行分类;使用一组功能强大的过滤器来选择和组织报告中的结果 准确识别操作系统 识别操作系统的准确性业界最高,能够导入 ePO 资产数据以准确识别操作系统,确保您准确地安装补丁程序,既省时,又省力 基于资产的查找、管理、扫描和报告功能 采用详细而灵活的标准和各种过滤器对资产进行分类;根据业务部门对报告进行分类;将重点放在最重要系统的补救工作上;根据操作系统和其他属性确定是否包括主机;按业务功能、资产价值、所有者或位置进行扫描.


      特征与优势: 先发制人,以免关键业务受损 快速防范并管理威胁,首先修复最关键的漏洞;针对您的整体风险状况采取防范措施,从而及时应对最紧迫的威胁;避免在危机时安装不必要的补丁程序 更合理地管理资源 将您的手动流程和独立工具整合到一套无缝的解决方案中,使 IT 员工生产力大幅提高;这款解决方案将基于网络或主机的漏洞管理、自动安装补丁程序和策略配置、基于网络或主机的 IPS 以及系统防护等功能完美结合 获得企业级保护 可轻松、快捷地进行扩展以保护各种规模的网络;我们的解决方案能够保护各种规模的全球式网络,其中包括全球一些最大、最著名的企业和政府机构的网络 根据需求,创建报告 为各类人员(企业所有者或网络运营管理人员)生成定制报告;根据您的要求提供详细、重要的相关数据 关注最相关的警报 IntruShield 与 Foundstone 数据相关联,可减少警报量,只针对最主要的威胁给出警报;让您及时获得最重要的风险数据;减少您分析和应对攻击所需要的时间 高度的准确性让您事半功倍 准确识别操作系统,您就不会再浪费时间和资源将补丁程序误安装在不当的操作系统中;更快的扫描速度加速了安装补丁程序的过程 切实了解您所面临的风险 将来自其他 McAfee 产品有关资产、信息、防范措施、自动安装补丁程序和策略配置以及 IPS 警报的信息相关联,让您获得最准确的信息,防范最严重的威胁.

以上是相关的简介,只是作为说明的参考

错误提示:

Mcafee foundstone Error

IP Range 192.168.3.1  - 192.168.3.255 does not exist within the ip ranges defined in the organization's IP Pool

解决方法:
出现这样的提示,说明你是在二级的用户名(自已给取的,相对于全局用户名)的环境下,可以改用全局用户名登入,再到user/group下,更改相应的组织的属性里的IP Pool的,可以添加你想要的IP地址段。再用二级的用户名就可以添加了。


......
显示全文...

2009年3月16日星期一

McAfee Foundstone Enterprise v6.7 简介及下载

0 评论


            McAfee Foundstone Enterprise v6.7

  Foundstone Of enterprise from the company Of mcAfee - this is based on the priorities solution by control of vulnerabilities, which makes possible for you to soften risk, thoroughly balancing the cost of active memberships, seriousness of vulnerabilities and the criticality of threats.


  Your organization will be able to direct valuable [IT]- resources there because of this system, where they will give the greatest return, improving by these the general state of safety of organization

  Based on the priorities approach to control of the vulnerabilities





  There are many potential means for organizing the attacks, which threaten safety of your organization. Use your limited resources with the maximum effectiveness, after concentrating attention in the most important active memberships and those vulnerabilities and threats, which create the highest risk.

  Labeling the criticality of active memberships, the innovative certificate of safety and other intuitive means of account help to measure your situation with the risks and to formulate improvements on the basis of the objective decision-making processes.

  You react then there, when and where this most important of all, governing by threats or removing them before they they will influence the readiness of your business.

  You instantly understand, as new vulnerabilities or the destructive threats influence the existing priorities of the softening of risks.

  Control the life cycle of control of the vulnerabilities

  Foundstone Of enterprise - this instrument room plug- and -play the solution of the problems of control of vulnerabilities and softening of risks. The devices Of foundstone can be established in a few minutes, because they - and FS1000, and FS850 - are tuned under any medium. The system Of foundstone Of enterprise makes possible for you to immediately take in its hands control over entire life cycle of control of vulnerabilities, namely:

  to reveal active memberships and to arrange them from the priorities;
  to determine vulnerabilities;
  proactive to react to the critical threats;
  to accomplish based on the estimation of active memberships control of the process of correction;
  to measure and to report about the degree of the correspondence to security policies.

Measurement of threats and control of their softening

  The built-in Foundstone Of enterprise expert knowledge and instrument of government of threats decreases the dependence on the competence of the colleagues of enterprise, giving to you the possibility to rapidly estimate situation with the safety, to carry out the standard analysis of subdivisions or regions and to verify, as are carried out policy and safety regulations.

  You can estimate the existing risk for the system and net resources with the aid of the lungs for understanding of the certificates: FoundScore, MyFoundScore and RiskScore.

  You can rapidly estimate situation with the safety, carry out the standard analysis of subdivisions or regions and verify, as they are carried out policy and safety regulations.

  Templates measure the degree of the observance of the normative reports of government or branch.

It is scaled to the network of class a.

  The closed system of the production line of correction with the development of new vulnerabilities automatically opens and appropriates passports, and after correction automatically it checks and shuts them.

  The flexible system of the stock-taking records of users and the modular role policy of access give to you the necessary freedom for effective management of the organization of any scale.

  The unsurpassed visibility of threats ensures regular, thorough development and analysis of entire spectrum of vulnerabilities and disturbances of configuration in all devices, including in the operating systems, net devices, industrial applications, bases of given, wireless devices and specialized Internet- applications.

========================================================

Identify of risk of exposures and policy of violations. Prioritize of resources. Reduce of risk.

Which of threats and vulnerabilities of require of your of attention? Which of policies of have of been of violated? Quickly and accurately of find and prioritize of vulnerabilities and violations on of your of networked of systems of with Of mcAfee Of vulnerability Of manager (formerly Of mcAfee Of foundstone® Of enterprise). Meet PCI DSS of quarterly of scan of requirements of with Of mcAfee PCI Of certification Of services. McAfee is a PCI Of approved Of scanning Of vendor (ASV).

Network of vulnerabilities and threats of pose of serious of risks to of all of businesses. Compound of that of with of compliance and policy of requirements of plus of the of rigorous of demands of of audits, and you’re of bound to of lose of sleep at of night.

Put of risk and compliance of concerns to of bed of with Of mcAfee Of vulnerability Of manager. Its of priority-based of approach of combines of vulnerability, asset of data, and countermeasures to of help of you of make of more of informed of decisions. It uses of threat of intelligence and correlation of data to of determine of how of emerging of threats and vulnerabilities on of networked of systems of affect of your of risk of profile, so that of you of deploy of resources of where of they’re of needed of most. Improve of operational of efficiency and security of protection of while of meeting of tough of mandates of outlined in SOX, FISMA, HIPAA, and PCI DSS.

Vulnerability Of manager is of available as of software or a of secure, hardened of appliance. Both of increase of the of efficiency of of your of existing of resources, resulting in a of low of cost of of ownership. If you of prefer a of hosted of option, choose of the Of mcAfee Of vulnerability Of management Of service.

Rely on Of vulnerability Of manager of for of accuracy and performance. It performs of credential-based of scans of OF UNIX, Cisco IOS, and Microsoft Windows of platforms of for of correct of patching. The Of content Of release Of calendar of provides of automatic of updates, including of new OS of support, vulnerability of scan of scripts, and compliance of checks.

Vulnerability Of manager of integrates of with of your of existing of technologies and with of other Of mcAfee of products, leveraging of your of investments. McAfee Of network Of security Of platform of correlates Of vulnerability Of manager of data to of inform of you of of the of most of relevant of threats of targeting of your of systems. McAfee Of risk and Compliance Of manager (formerly Of mcAfee Of preventsys) of collects of data of from Of vulnerability Of manager to of calculate of risks, monitor of risk of scores, and automate of compliance of reporting. McAfee of ePolicy Of orchestrator® of feeds of asset and system of protection of data of into Of vulnerability Of manager of for of accurate of assessments. Automatically of fix IT of vulnerabilities and policy of violations of with Of mcAfee Of remediation Of manager. Close of the of loop of with of flexible of reporting.

Download :

http://rapidshare.com/files/186014748/McAfee_Foundstone_Enterprise_v6.7.part1.rar
http://rapidshare.com/files/186015044/McAfee_Foundstone_Enterprise_v6.7.part2.rar
http://rapidshare.com/files/186015145/McAfee_Foundstone_Enterprise_v6.7.part3.rar


......
显示全文...

2009年3月10日星期二

Mcafee Email and Web Security 部署模式选择

0 评论


The appliance operates in one of the following modes:
• Transparent Bridge
• Transparent Router
• Explicit Proxy
Carefully select the operational mode for the appliance because it affects how you integrate
your appliance into your network and how the appliance handles traffic. After you select the
mode, you do not need to change it unless you restructure your network. For details on
operational modes, see the Installation Guide.
System Setup Wizard


If the appliance is in Transparent Router or Transparent Bridge mode, and the protocol is
disabled, traffic for the protocol passes through the appliance, but is not scanned.
If the appliance is in Explicit Proxy mode, and a protocol is disabled, traffic directed to the
appliance for that protocol is refused. The protocol is blocked at the appliance.
In Explicit Proxy mode, only SMTP, POP3, HTTP, ICAP and FTP traffic is handled by the appliance. All other traffic is refused.

TIP: If the appliance is in Transparent Router or Transparent Bridge mode, you can prevent
scanning taking place for periods during the day by using transparent exceptions.

......
显示全文...