Tracking Outgoing Information

[DKanzler]

I have an ASA 5510 and was wondering if someone could shed some light on this. If someone internally would install a producted (keylogger or something of that nature) that gathered information and then sent it to a remote location could the ASA detect this traffic and/or prevent the leak of information.

Thanks in advance

[John Blakley]

The ASA has an IPS module that may help you with what you want. I'm not aware of any device that will log when a keylogger is installed because that type of activity, local to the workstation, would be restricted by antivirus software. Anything traversing the network, i.e. buffer overflows, DoS attacks, MITM attacks, etc, can be seen with an IPS.

HTH,

John