what is Krypton anyway?
At the end of January, some of you may have seen a notification from us about a new IPS engine that we released for Symantec Endpoint Protection. So what’s special about it, and why do you need it anyway? Firstly, let’s take a high level overview at how IPS works. The Intrusion Prevention Signature engine in SEP looks at all the network traffic as it flows through your computers network card. It’s looking for strange occurrences, both in individual packets and also in the reassembled stream (all the packets combined). Typically, we tell the IPS engine what to look for with signatures but with SEP you can also write your own custom signatures (more on that in a later article). These signatures are updated every few weeks in response to things like the Microsoft security vulnerability and patch announcements. By writing clever signatures, we are able to look at actually preventing a malicious piece of code from exploiting the VULNERABILITY, rather than blocking the malicious code itself
