Understanding Security Situation Awareness
This section describes the functions and application scenarios of security situation awareness.
Enterprise network administrators need to learn about enterprise asset information and configure intrusion prevention to protect assets against intrusion. However, there are many types and quantities of assets in large enterprises. The service applications and operating systems of assets are diversified. The efficiency and accuracy of manual asset information collection and intrusion prevention are very low. Security situation awareness dynamically detects asset information in enterprises. Administrators can configure intrusion prevention profiles based on the asset information.
The FW can obtain asset information in the following ways:
- Manual adding if there are a few assets
- Asset scanning: The FW sends detection packets to the network segment where assets reside to obtain online asset information.
As shown in Figure 1, after the FW obtains asset information, the administrator converts asset information into an intrusion prevention profile and applies the profile to security policies to defend against intrusion on assets.
