Sangfor Network Secure V8.0.95 User Manual

1 Overview

1.1 Introduction

Sangfor Network Secure has the capabilities of risk prediction, deep security protection, and detection response, forming an integrated security system with whole-process protection and visibility.

Integration is not a simple function superposition, but integration of technical security means provided for the risks encountered in the service development process. It gives whole-process protection to the service. Integrated security includes asset risk discovery, policy detection, various security defense methods that should be available during the incident, continuous detection, and rapid response mechanisms after the incident.

1.2 Key Features

I. Preparation & Prediction: Asset/Vulnerability/Policy Effectiveness

Network Secure can automatically identify risks such as open ports, vulnerabilities, and weak passwords on internal servers in advance and judge whether the identified assets have corresponding security protection policies and are in effect.

II. Real-Time Defense: Complete Defense System + Security Correlation + Threat Intelligence

Network Secure integrates several security technologies for effective defense during an event. It provides a complete security defense system (L2-L7) to ensure no weaknesses in security protection. At the same time, Network Secure can also improve the timeliness and effectiveness of the defense system through security integration, including integrating cloud and endpoint security solutions and coordinating different modules. In addition, Network Secure also cooperates with third-party security agencies and utilizes threat intelligence from multiple sources, such as the Chinese National Vulnerability Database, VirusTotal, and malicious URL databases, to help users prepare for defense before security events occur.

III. Post-event Detection & Response: Continuous Detection of Threatening Behaviors and Rapid Response

Traditional security work mainly focuses on border security defense and cannot detect and respond when attackers bypass security measures. If there are mature post-event detection and response measures, the impact of security events can be greatly reduced. Network Secure integrates post-event detection and rapid response technologies, which help users timely discover malicious behaviors even after hacking, such as detecting malicious behaviors initiated by zombie computers, webpage tampering, website backlink embedment, and Webshell backdoor, and quickly push alarm events to assist users in responding and handling.

2 Installation and Deployment