The Cisco Security Agent consists of a management console resident on a Microsoft Windows 2000 server and host-based agents that are deployed on mission-critical desktops and servers. The agents use the HTTP and Secure Sockets Layer (SSL) protocols (128-bit SSL) for the management interface, and for the communications between agents and the management console.

The Cisco Security Agent resides between the applications and the kernel, enabling maximum application visibility with minimal effect on the stability and performance of the underlying operating system. The agent's unique architecture intercepts all system calls to file, network, and registry sources, as well as to dynamic, run-time resources such as memory pages, shared library modules, and Component Object Model (COM) objects. The agent applies unique intelligence to correlate behaviors of these system calls, based on rules that define appropriate or acceptable behavior for a specific application. This correlation and subsequent understanding of an application's behavior is what allows the software, as directed by the security staff, to prevent new intrusions.

When an application attempts an operation, the agent checks the operation against the application's security policy making a real-time allow or deny decision on its continuation, and determining if logging of the request is appropriate. Security policies are collections of rules that IT and/or security administrators assign to protected servers and desktops on an enterprise-wide basis, or individually. These rules provide safe application access to required resources. By combining security policies implementing distributed firewall, operating system lockdown, integrity assurance, malicious mobile code protection, and audit event collection capabilities in default policies for servers and desktops, the Cisco Security Agent provides defense-in-depth protection for exposed corporate systems.

Because protection is based on blocking malicious behavior, the default policies stop both known and unknown attacks without needing updates. Correlation is performed both on the agent and on the manager. Agent-based correlation results in dramatically increased accuracy, identifying actual attacks or misuse without blocking legitimate activity; correlation on the manager identifies global attacks like network worms or distributed scans.

General

Details

	Category Network management tool Subcategory Internet - firewalls, network - monitoring