HP Sygate Security Agent User Guide

antivirus: Software and technology that is used to detect malicious computer applications, prevent them from infecting a system, and clean files or applications that are infected with computer viruses. Sygate software works together with, but does not include, antivirus software.

application authentication: Authenticating an application that is running on a network is accomplished by taking the entire binary of an application and performing an MD5 hash and then comparing it with the application fingerprint stored on an Agent. If the application was changed, it may not be authenticated depending on the rules that an Agent is using. See also application control, application fingerprint, DLL authentication, MD5 hash.

application control: Applications and what versions of the particular application can either be allowed or disallowed via security policies.

application fingerprint: A 128-bit number that is generated by performing an MD5 hash of an entire application packet. It is unique for each application. If the application is changed in any way, the application fingerprint changes. See also application authentication.

authentication: The process by which a system identifies an individual or a computer to make sure that the user or computer is who they claim to be.

authorization: The process of granting or denying access to a specific network resource or domain based on the user’s identity.

B

backtrace: A way of using ICMP to determine all the hops between your computer and an intruder on another computer. See also Internet Control Message Protocol (ICMP).

broadcast: Sending a packet to everybody on the network. See also multicast, unicast.

buffer overflow: Applications set aside areas of memory, or buffers, for use as storage, frequently setting aside a finite amount of memory for a buffer. A buffer overflow exists when an application attempts to store more data than can fit in a fixed-size buffer. Buffer overflow attacks occur when an intruder is able to send data in excess of a fixed-size application buffer and the application does not check to ensure this doesn’t happen. By overflowing a buffer with executable code, an intruder can cause an application to perform unexpected and often malicious actions using the same privileges the application has been granted.

52