ATP Flashcards
What is ATP?
ATP analyses content from an enterprise and decides howto respond based off of the file reputation, rules and reputation thresholds. Optional module.
What are the benefits of implementing ATP in your organization?
- Fast detection and protection against security threats and malware.
- The ability to know which systems or devices are compromised, and how the threat spread through your
environment. - The ability to immediately contain, block, or clean specific files and certificates based on their threat
reputations and your risk criteria. - Integration with Real Protect scanning to perform automated reputation analysis in the cloud and on client
systems. - Real-time integration with McAfee® Advanced Threat Defense and McAfee GTI to provide detailed
assessment and data on malware classification. This integration allows you to respond to threats and share
the information throughout your environment.
What McAfee Products can optionally integrate with ATP?
- TIE server — A server that stores information about file and certificate reputations, then passes that
information to other systems. - Data Exchange Layer — Clients and brokers that enable bidirectional communication between the
Adaptive Threat Protection module on the managed system and the TIE server.
What McAfee Products can optionally integrate with ATP?
- TIE server — A server that stores information about file and certificate reputations, then passes that
information to other systems. - Data Exchange Layer — Clients and brokers that enable bidirectional communication between the
Adaptive Threat Protection module on the managed system and the TIE server.
What ATP features fall under “Protect”?
Reputation-based file handling
Integration with the TIE server
Dynamic Application Containment
What ATP features fall under “Protect”?
Reputation-based file handling
Integration with the TIE server
Dynamic Application Containment
What ATP features fall under “Detect”
Real Protect scanning
What ATP features fall under “Correct”
File cleaning
Custom file exclusions
McAfee ePO Dashboards and reports
Give a brief overview of what Reputation-based file handling means in regards to ATP?
ATP - alerts when an unknown file enters the
environment.
Instead of sending the file information to McAfee for analysis, Adaptive Threat Protection can block the file
immediately.
Give a brief overview of Dynamic Application Containment
Allows unknown files to run in a container, limiting the actions they can take.
When a company first uses a file whose reputation is not known, Adaptive Threat Protection can run it a
container. Containment rules define which actions the contained application can’t perform. Dynamic
Application Containment also contains processes when they load PE files (Portable Executables) and DLLs
(Dynamic Link Libraries) that downgrade the process reputation.
Give a brief overview of Real Protect scanning
Performs automated reputation analysis.
Real Protect inspects suspicious files and activities on a client system and detects malicious patterns using
machine-learning techniques. Real Protect client-based and cloud-based scans include DLL scanning to keep
trusted processes from loading untrusted PE and DLL files.
T/F: ATP can flag a file as malicious based on it’s reputation, but Threat Prevention takes over the blocking/cleaning function.
False, ATP can both block and clean a file based on it’s reputation
What is the protection workflow for ATP like?
- A file is opened on a client system
2.ATP checks the local reputation cache for the file: if the file is not in the local reputation cache: ATP will query the TIE Server - If the TIE server is not available or the file is not in the TIE server database, ATP queries McAfee GTI for the reputation
- Depending on the file’s reputation and ATP settings:
-The file is allowed to open
-The file is blocked
-The file is allowed to run in a container
-The user is prompted for the action to take - GTI returns the latest file reputation information to the TIE server, and the TIE server updates the database and sends the updated reputation information to all ATP-enabled systems to immediately protect your environment
What is the difference in ATP’s functionality when TIE and DXL are present versus when they are not?
-If TIE and DXL are present, ATP uses DXL to share file and threat info instantly across the whole enterprise. Also, through TIE you can control file reputation at the local level in your environment. You decide which files can run, and which are blocked, and the DXL shares the information immediately throughout your environment. ATP reaches out to the TIE server for threat information
-If TIE and DXL are not present, ATP communicates with McAfee GTI for file reputation information
What are the three security levels for ATP?
Productivity - For systems that change frequently, often installing and uninstalling trusted programs and receiving frequent updates.
Balanced - Typical business systems where new programs and changes are installed infrequently. More rules are used with this setting, thus users experience more blocking and prompting
Security - IT-managed systems with tight control and little change. Examples are systems that access critical or sensitive information in a financial or government environment. This setting is also used for servers. The maximum number of rules are used with this setting, thus Users experience even more blocking and prompting
