Summary

The Cisco ICS is created by the partnership between Cisco and Trend Micro. Cisco ICS provides an additional layer of self-defense that can contain network incidents with a focus on preventing networkwide virus and worm outbreaks. Cisco ICS works in concert with a subscription service from Trend Micro where Trend Micro monitors and identifies new network threats. Trend Micro first creates a broad access list, or OPACL, to stop the network outbreak. Trend Micro further investigates the new network threat and then creates an IPS signature, or OPSig, as a very specific mechanism to stop the outbreak or worm.

Cisco ICS can deploy OPACLs and OPSigs either automatically, without user intervention, or manually, with user approval. OPACLs and OPSigs can also be applied automatically or manually, based upon classes of events, as designated by the red and yellow alert levels. Cisco ICS complements the base level of access lists and IPS protection as described in Chapter 3. In addition to the ASA platform, Cisco ICS can also apply OPACLs to routers and switches and OPSigs to IPS devices, including routers, appliances, and Catalyst 6500/7600 IPS service modules.