IBM Internet Security Systems (ISS)

Intrusion Prevention and Detection

Protection Features

ISS’ Preemptive Protection

• Multi-faceted Protection
  Proventia’s multi-faceted protection engine combines multiple analysis and detection methodologies for optimum accuracy. A 2005 Information Security Magazine review rated Proventia Network IPS first place in attack detection and blocking.
• Automatic Security Content Updates
  Updated security content can be automatically activated and applied to Proventia Network IPS. Security content with a recommended action “set to block” is certified to be free of false positives.
• Virtual Patch Technology
  ISS’ Virtual Patch technology allows you to regain control over ad-hoc and emergency patching by shielding vulnerabilities at the network level.
• Spyware Installation Blocking
  Proventia automatically blocks spyware applications at the network level, preventing installation and download to clients.
• Spyware Communicaion Blocking
  For clients already infected with spyware applications, Proventia prevents spyware intelligence reporting by automatically blocking active spyware application communication.
• VoIP Security
  Proventia parses and analyzes the family of VoIP protocols to identify anomalous traffic. This unique type of analysis allows Proventia to block threats targeting your VoIP services.
• Quarantine Capabilities
  Proventia enables an immediate and reliable quarantine of traffic from infected hosts and network segments, while allowing legitimate traffic to pass unhindered.
• Corporate Network Access Control
  The Proventia Network IPS is part of the Proventia Access Control solution to assure that computer systems connecting to the corporate network through a Virtual Private Network, wireless access point, or from another network segment are protected by up-to-date desktop security agents.

Performance Features

Proventia Network IPS Lineup
• Line-speed Performance
  Deployed in-line and operating at line speeds of up to 2 Gigabits per second, Proventia maintains network performance without requiring network reconfiguration.
• In-line Simulation Mode
  Proventia is the only intrusion prevention system available with an inline simulation mode, giving you the ability to determine blocking behavior before activating blocking.
• Active/Active Stateful High Availability (HA)
  In addition to redundant internal components, multiple Proventia appliances deployed in an active/active HA configuration provide the highest redundancy possible while maintaining full session state between devices.
• Flexible Deployment Options
  Proventia can be deployed at the gateway/perimeter as well as within the core of your high-speed networking infrastructure to secure network assets.
• Operating Modes
  Proventia is capable of operating in three modes:
  • Prevention: inline, active blocking
  • Simulation: inline, no blocking
  • Monitoring: passive, no blocking

Management Features

• Flexible Policy Management
  Proventia supports diverse usage scenarios, allowing policy control at the device, port, VLAN and IP address levels.
• Web-based Local Management
  Proventia’s web-based local management interface (LMI) simplifies device management and monitoring.
• Front Panel Management
  Proventia’s LCD controller on the front of the unit simplifies initial device configuration and allows convenient restart and shutdown options.
• SNMP Management
  Proventia integrates with 3rd-party network management products to provide key operational status indicators to network operations and security operations groups.
• Centralized Management System Integration
  Proventia can be centrally managed using the SiteProtector security management system. SiteProtector is a scalable system that allows your staff to control, monitor and analyze events efficiently.