Technically Secure

This week I was at a partner event talking about security and a person in the audience asked me, "so how do I sell security"? On first blush, this seemed to be like a question that is so general, it cannot be answered! Ask me an easier one, "why is the sky blue"?

Then I got to thinking, selling green is easy, consolidation is cake, virtualization sells itself. Why? Because they have a demonstrable and predictable cost savings. Selling security is like selling insurance. It's hard to quantify, until the unthinkable happens.

As I mentioned in a previous post security has changed...so much that this unthinkable is becoming more of a reality.  I felt so strongly about it, that I recorded a 3 minute video to talk more about the changing security landscape and how that insurance policy is not a luxury, but a necessity to every high performing business.

Check it out and let me know what you think!

There are an increasing number of access control products in the typical corporate network.  This includes SSL VPN products for remote access control, and Network Access Control (NAC) for local access control.  The mission of these offerings is to provide access to the network only for authenticated users on secure machines.  At the same time, security products ranging from firewalls to IPS/IDP systems are monitoring the traffic on these same networks, ensuring that network assets are protected from unwanted behavior.  Future security solutions will begin to blend these concepts of access control with end user behavior.  These offerings will leverage not only user identity and posture assessment, but actual traffic on the network, to ensure that authorized users are staying within the confines of corporate security policies.  Coordination of this sort will allow these systems to react dynamically to user behavior.  For example, if an authorized user launched an attack against the corporate data center, an IPS might drop that traffic, providing the protection it was design for.  At the same time, it would feed information related to the attack into the corporate access control infrastructure, so that action can be taken on that end user's session - quarantine, or session termination, for example. The result is end-to-end threat control and prevention - coordination of network and security elements that ensures that all of the relevant information that these devices are collecting can be used to make the best possible decisions on user access.  With this type of system, the days of silo'd security devices are numbered.

Managing a distributed service deployment in a data center network is a big challenge for organizations. Traditionally, data center networks are built upon three tiers of routing and switching:

 

• the server access tier, connecting LAN ports to the network;
• the network aggregation tier, which aggregates FE and GbE from the access tier up to the core network; and
• the data center core network tier, which interconnects the data center network to the external network and to other data centers.

 

Network services such as stateful firewalls, intrusion prevention, load balancing & caching are typically deployed at the aggregation tier, since it is best to place services close to the servers and applications they serve. However, this poses a big challenge as businesses deploy these services at scale due to the difficult nature of managing a distributed service deployment. Organizations need to make sure the services are configured uniformly throughout the network and figure out how to redeploy a service to an application while the application moves between physical locations. To date network and security organizations are drowning under the workload of keeping up with the ever changing requirements from the applications and need a way to simplify their data center network.

 

One approach is to implement a two-tier, high density, high-performance data center network - in which the access tier is solely responsible for connecting the servers to the core network and the core network is responsible for directing traffic the right way. Ideally, an organization would use a large enough firewall that can virtually connect to all the data center networks, while supporting full line-rate forwarding of multi 10GbE and be able to intelligently participate in the network routing protocols.

 

By taking the core based firewall and service approach, organizations will manage to reduce two of their biggest challenges: 1) application mobility and 2) distributed service deployment.  By having all the intelligence at the core of the network you decouple the physical placement of the server from the logical attributes that are associated to it allowing you to manage from a single unified service element.

 

Since we are right in the midst of the presidential race where everyone is talking about "change", it looks like I too have been influenced and have spoken about change; specifically the changes in security threats that organizations must come to terms with. I would be remiss in not discussing in this installment the quantum changes that we have seen in the financial markets and what this means from a security perspective.

 

The financial turmoil that has seemed to envelop the world's economy can be seen clearly on the faces of financial services employees as I pass them on the street down in New York's financial district. As the stock market swoons and dips (and dips again) once mighty financial giants are unsure of their short term viability let alone long term viability.

 

And while these wild market gyrations continue to unfold, the CIO is also faced with the monumental task of continuing to ensure security of the network, applications and users while it appears that Rome is indeed beginning to burn.

 

The security threat is not from where you may think. As workers at the financial institutions begin to lose faith in their organization and feel that their job may be at risk, the time that is ripe for confidential data to leave the organization. Moreover, for an entire industry in "meltdown mode," the insider threat is gaining new attention as the incidents of employees committing a security breach are on the rise.

 

While most employees may not intend to create a security breach, there are always those few "bad apples" that find this to be the best time to harvest information (maybe for their next job or for retribution against a perceived injustice that the organization committed).

 

Whatever the motivations, CIOs must realize that given the current economic crisis, they must turn to comprehensive security that is able to look at potential threats inside their perimeter. They must be able to root out sophisticated and stealthy attacks that are designed to evade traditional security solutions, because who knows the organization's security better than one's own employee?

 

All financial investing have some inherent risk (as we are painfully aware), but in this unsure economic situation it is essential for the CIO to recognize the security risks and plan a careful strategy for maximum protection.

In my last post we discussed a shift in the types of attack vectors that organizations have experienced and thus what results in a major security gap that organizations must come to terms with.  But this is not the only change that makes organizations more vulnerable to a potential security breach Regardless of an organization's charter, its greatest asset is its information. Whether it is a patented idea, customer data, or confidential roadmap, information is the single most important asset which determines if a company will prosper, eek by, or fade into oblivion. So if information is our greatest asset, why don't we better protect it?

 

When I go to on customer calls, one of the first things I do is open my laptop and do a networks scan. Most of the time, I can hop onto the network and gain full access without being challenged. I have full rights, full reign and the proverbial carte blanche to do as I wish. But don't think that this is an aberration. TJMaxx, UBS and Best Western all share the common bond and they are just a few organizations on a very long list of companies whose data has been stolen.

 

Hackers today can do more damage with a keyboard than a gun. Whether they sell confidential corporate information on the black market or commit identity theft, the motivation is financially based and can be highly lucrative.

 

Beyond soft targets, we also have sleeping sentries. A recent Verizon study noted that 63% of the organizations studied took MONTHS to find that a breach has occurred.  This is long after the damage has been done and is too late to mount a meaningful defense.

 

The motivation for hacking has evolved from breaking into websites to gain notoriety to a potential financial windfall for using or reselling confidential information. The sooner we mount the right defense to address this new reality, the better chance we have for ensuring that our organization is not on the front page of the Wall Street Journal for all the wrong reasons.

With our morning coffee, most of us have grown accustomed to opening the paper and reading about yet another gargantuan organization that suffered a devastating loss due to a security breach. The question that begs to be asked is whether we are any better off than we were 10 years ago? Are our organizations any safer from the evil that looks to sneak into our networks and do damage?

For certain, the types of attacks have grown in sophistication, and have changed in methodology, purpose and operation. At the same time, our networks have changed. Because interconnected networks are a prerequisite for doing business, our networks have become porous.  We allow a multitude of people onto our networks including partners, subcontractors, and guests. How is it possible to have perimeter-based protection if we don’t really know where the perimeter starts or ends? Do we need to re-evaluate our security posture because perimeter protection is dead?

Over the past five years, the sheer number of security incidents has decreased dramatically. While we have not eradicated bad things from finding their way to our network, perimeter protection plays a key role in this precipitous drop.

Security will undoubtedly remain a cat and mouse game between the hacker and security professional. Some hacking attempts will work and many will be stopped.  There is no silver bullet when it comes to security; it takes a multi-faceted approach that leverages information and collaborates to root out the newest threats that are just over the horizon.

No need to initiate CPR on the perimeter-based approach just yet, for it is just another weapon in our arsenal that effectively stops the bad guys from compromising our network and our business.

Stay tuned for our next discussion where we will discuss the evolution of the attack and what the hacker is after in your network; your greatest asset may be at risk. 

Security threats are as prevalent as ever, but not only that, interconnected networks are a prerequisite for doing business - this means your networks are now porous. No longer are people working purely inside the company, they are leveraging their contacts and colleagues at other companies, industry associations and in their social networks.  But what does this mean for your network integrity?

For the next few weeks, my colleague Michael Rothschild is going to be taking a look at perimeter security, intrusion prevention and internal threats. I hope you find the topic useful.

The latest buzz in the high-tech industry is around virtualization. Like the days of the optical networking blitz, it appears that venture capitalists are ready to fund any business plan that incorporates some aspect of virtualization!  Solutions range from having consolidated data centers to cloud computing to virtualized mobile phones. There are numerous sources highlighting the benefits and potential use cases for virtualization. I was surprised by the last one – why would anyone want to run multiple operating systems on a cell phone? Apparently to separate the core functions of the phone from other applications especially open source software. Definitely sounds like a perfect use case for virtualization. Interesting article: www.linuxplanet.com/linuxplanet/reports/6490/1/.

But what about security in these virtualized environments like the consolidated data center for example? There are multiple users with different profiles shared amongst common resources that need to be protected from one another. You also need to provision the right set of services for each user based on administrative policy. It is quite obvious that it  is difficult to predict the type of security services and the performance that would be required for these datacenters given their ever changing requirements. Because of this many businesses are considering the solutions that can deliver multiple services that can simply be turned on or off as required.

So what would you want – a system that can be dynamically provisioned and scaled to run different services using a common hardware platform or a system to keep inventory of service specific appliances/cards that can be manually provisioned as needed?

The demise of the legacy phone network (PSTN) has been a topic of discussion in many forums. For example, I recently came across a blog titled Heralding the death of the PSTN. 

VOIP deployments are gaining momentum at the expense of the plain old telephone service and we are witnessing the emergence of IPTV as a viable alternative for delivering video compared to the legacy cable and satellite media. These are highlighting a trend where IP is becoming the de-facto communication protocol for not only data but for voice and video as well.

Service providers are faced with the challenges of building a single network to offer multiple services such as VOIP. The service infrastructures for delivering voice and video have become targets of attack just like publicly accessible web servers. If a VOIP server is compromised or comes under a DOS attack, the subscriber will not be able to get a call through.  Similarly in an IPTV deployment, an attack on the video server would result in the subscriber being unable to change channels – which undoubtedly would be quite frustrating!

In order to roll out successful IP based voice and video services, it is vital to incorporate high-performance security mechanisms into your network design especially since these converged services are not too far in the future.

Is your security gear ready to turn on the lights for VOIP and IPTV?

As a long distance runner, completing a marathon felt like a formidable task. Assigning a time target for the 26.2 mile race seemed almost impossible. The strategy that has worked for me is to break the race into 5 parts of 5 miles each (last one being 6.2 miles) and assign time targets that would collectively help me reach my time goal.  A similar approach can work with securing the network – divide and conquer.

 

In security parlance this is referred to as layered defense, where each part is a layer targeting specific threats. The first and most important layer is the network edge protection – deployed at the perimeter or in a data center.

 

I believe the essential technologies that form the network edge and protect your networks include FW, VPN, DoS Protection and Content validation.

 

• Firewall – Flexible access control all the way from Layer 2 (datalink layer) to Layer 7 (application layer) is very important. Access control based on users and roles rather than IP addresses is becoming more relevant these days with the huge amount of mobility options out there. On this front, integration with a Network Access Control (NAC) framework is necessary, and the good news is there is a standardization effort in this space. You can read more about this in my colleague Steve Hanna’s blog: Got the NAC
• Virtual Private Networks (VPN) – The perimeter security solution should provide options for secure tunneling of data (VPN) between sites and telecommuting clients from the Internet.
• Denial of Service (DoS) Protection  – DoS and DDoS (Distributed Denial of Service) continue to be a vector of attack against publicly hosted services with botnets as the most common sources.  You need a solution that can signal into the cloud to filter the attack traffic at the ISP network edge or earlier, thereby freeing the final hop for the clean traffic. Check out additional efforts standardization at  Dissemination of flow specification rules
• Protocol/Content validation – The capability to inspect application data for protocol anomalies and attacks is necessary as software vulnerabilities are constantly popping up and it is difficult to keep all the systems patched up to date. The solution must be dynamically updated with the latest protection pack without requiring any downtime in order to secure your network.

 

Let me know if you have any additional thoughts and/or questions about securing the network edge!

The recent 2008 Beijing Olympics witnessed one of the broadest uses of the Internet of any public event to date. In fact, Internet traffic has been pretty much doubling year over year and with it the increase of viruses, identity theft, spam, etc.  According to the 2007 CSI-FBI Security Report financial fraud, virus losses and system penetration by outsiders are some of the major causes for financial loss.

 

Over the past 19 years that I've been working with networking and security technologies the world has seen many advances in firewall (FW) technology starting from ACL to Stateful FW to Application Aware FW that performs DPI to validate application data and enforce application level access control. Now with Enterprise and Service Provider networks proliferating at all levels and rapidly growing due to more users and higher requirements for advanced applications and services, many businesses can no longer afford the performance and security tradeoffs and complexities associated with maintaining their legacy network infrastructure. They need to integrate security into their network infrastructure to ensure fast, reliable and secure access to applications and services in an efficient and effective manner.

 

Network and Security administrators need to secure their networks in a layered defense - with the firewall as the cornerstone of their security strategy. Today more than ever businesses require a high-performance network with a FW that can deliver high throughput and high-performance.

 

Here's a shortlist of what businesses should consider when looking for a FW solution to secure their networks:

 

• Scale to more than 100 Gbps of throughput and performance.
• Provide granular access control based on the user and service requested.
• Integrate protocol/content validation to ensure that the data will not harm the integrity and availability of the services.
• Provide all of the above in a form factor that optimizes on space, power and heat.
• Is operationally simple to manage and deploy.

 

Check out a new video post by Juniper's GM and senior executive VP on their take of the FW market: http://www.juniper.net/srx