Slashdot Mirror
Multi-Layer Security Platforms
An anonymous reader writes "ITO has published a comprehensive article on the new meaning of unified security management: 'In the not too distant past, the information security needs for most organizations were fairly straightforward. From a technology perspective, core defenses included a handful of perimeter-based firewalls to policing traffic originating from the Internet, along with software at desktops, and perhaps email gateways, to counter the emerging threat from viruses.'"
Considering I'm planning to go into the network security field, any other interesting/fact-filled articles or websites I should check out?
Sorry; I wasn't that impressed... the entire article read like a hard-sell pitch for all-in-one security appliances. And it turns out one of the authors is the V.P. of marketing for a company selling a range of all-in-one security appliances.
I'd actually think that everyone going the recommended route would end up in the same boat as the current monoculture of point product that they complain about. Now, instead of being compromised because we're all running the same code, we get compromised because we're all running the same security appliance, with the same flaws.
I'd actually rather see a diverse and heterogeneous set of defenses to prevent large scale compromises working against everyone, and the economy of throwing everything into a box, rather than loading a bunch of diverse software strikes me as a false one.
The same arguments that make me want to run a MacOS X box or a FreeBSD box or a Linux box instead of some other platform with well known vulnerabilities make me *not* want to run the same appliance box in front of my network that everyone else is running, too.
Maybe I'm just jaded, and have heard "best of breed" one too many times. 8-(.
-- Terry
... is still there, as it was in the good ol' times: Unplug the damn thing
--
2 cores, 2 monitors, 2 hands!
When are those duble-dick body upgrades coming out?
We've been testing a BUNCH of 'all in one' security appliances, and most are clearly running Linux, and at least one of the VERY LARGE, WELL KNOWN appliances is even missing stability updates (yes, that's right, off the shelf bugtraq code can DoS it).
There's a time and place for security appliances, but they're not a cure-all. Some of the brands (I'm actually a fan of Watchguard for small businesses) do great work blocking malicious web and email traffic, but the stability and security are still far from perfect.
Mooniacs for iOS and Android
4 pages to say defense in depth? Any person who's spent a little time reading about security on the internet could tell you that. Heck, with a touch of extrapolation, combined forces has been used for how long? A couple thousand years?
I agree with the poster above who said like it sounded like an ad for an all in one appliance. It spends the first page putting down best of breed security means, then says we need to use best of breed ones, only under this new definition. It ignores that these all in one solutions generally have the cost of integration factored into the cost of the very expensive product. It talks about the changing security environment, trying to pump up your fear, but it totally ignores insider threat, which constitute the larger chunk of threat.
Essentially, this is a document for security managers, not for anyone on the ground, so to speak. The language is unnecessarily obtuse and ornate.
-- Who is the bigger fool? The fool or the fool who follows him? --
When you install software, it tells you its installing, and goes into the installed directory so you can browse every piece of software installed on your computer... Instead of letting software designers put their software everywhere they feel like hiding it on your harddrive and registry. Yes I'm looking in your direction windows. Power to the user, less abusive power to the developer.
God spoke to me.
Usually, there's not enough to read, but at 10 PM on a weeknight, the last thing I want to do is read something that long. Thanks for telling me that I don't need to read it.
Don't thank God, thank a doctor!
That install would come with a VMWare player image of the user's standard install with full admin rights to the user. The VMWare image would be for special dev tools or just for those times when a user "has to have admin".
I can't see how making the user suffer the performance overhead of VMware is a security measure. If this is an attempt to provide a quick way to re-image a workstation after a user has bollocksed it up, why not just use a hard drive imaging tool?
The desktop should include a firewall. Only 80 and 443 should be open for outgoing.
So, no SMB/CIFS/NFS to allow them to actually work with their data on the SAN/NAS? No DNS so they can actually resolve the address of the SAN? No ICMP so that the host actually has a clue when it tries to connect to something that is unreachable?
Incoming should have RDP or VNC open for admins to get in.
Don't forget hackers...
On the e-mail side. Attachments should not be allowed.
That would destroy the reason most people use email these days. Can you imagine how effectively a salesperson or manager is going to be able to do their job, if they can't easily send markting material such as PDF's or PPT's to customers?
HTML e-mail would be allowed, but images would be stripped.
Why? What makes an image any more of a threat to security than a rich-text email (especially when read with certain well known mail clients... *cough* Outlook *cough*) ?
Have good backups and at least try to keep a virus on the user's desktop from raping your SAN/NAS.
That usually comes down to implementing sensible file/directory permissions, and the challenging task of educating users to actually save stuff in the right place.
I could make the most secure airline in the world. But no one would ever want to fly completely naked and cuffed to their seats.
I don't see how your sexual kinks play a role in this discussion.
The trade-off is what kills most real admins.
I work for an advertising agency. They live and die on "easy" communication with every client possible, and most would be surprised just what kind of crap marketting firms will send in professional emails.
Strip an image? They just lost contact info for a potential client. Kill a zipfile because it's password protected? Oops, that was a 7 figure proposal. It just gets worse and worse.
Start by having 2 NAS systems. One for real users, one for idiots who must be attached to the network. Then, separate them so there's no communication between them. Create multiple login systems, and protect your real work (financials, C-levels, etc) from the sales staff and receptionists who open everything, every time.
It's extra work up front, but eventually, those super-complex ACLs preventing the receptionist from deleting any file she doesn't own will save your ass.
Video for Online Dating Profiles
Not that I have anything in principle against the concept of unified security management, except for the little matter that security is an emergent property of the entire system under consideration and not something that can be separated out into an external appliance, no matter how nice and easy that might seem. For example, the "emerging threat from viruses" represented in the article is due to choices in system design which egregiously ignore the problems that might result from installing any random blob of data as system software.
Indeed, perimeter security has never been regarded as sufficient, merely convenient. Many uses of networks have no natural perimeter, university campuses for example. The alternative concept of defense in depth has been the subject of ongoing discussion for at least a decade now, but it does require some effort to model what is allowed to communicate with what, and that in turn forces the question of identity. All of that is sort of hard. Not impossible, but you have to think about what you're doing, and maybe stop doing some of the bad stuff. You can't just take a pill to make it go away.
Parity: What to do when the weekend comes.
So this says people should put all their eggs in one basket and that is the proper way to protect the network. It mentions protection at the edge only as being bad, which it is. Then doesn't really come back to that and tries to sell a box that brings to mind a wan,lan,dmz port.
This is lame. Sure it may be running some kind of magical software that knows in advance all of the 0 day stuff better than tipping point. Really though, layered multi-vendor approaches are best. I've had a virus make it through the IPS, mail gateway, the mail server, all the way to the desktop before geting caught by AV. I've had the same thing happen but it wasn't caught by the desktop AV until a day later once the defs updated. That kind-of sucked but it did no real damage running as an unprivileged user and the mail server and gateway probably wouldn't have seen it again, though I assume their defs would find it at that point.
This is for small businesses with no open source knowledge and bad IT. Nothing to see here, move along.
So, why not use a VMWare image connecting to an external Outlook server for "risky" communications? Run a tight internal network for everyday stuff and then an open netowrk for easy access for those special occasions.
I'd rather you do it wrong, than for me to have to do it at all.
Hi, I'm Tom.
>>So, no SMB/CIFS/NFS to allow them to actually work with their data on the SAN/NAS? No DNS so they can actually resolve the address of the SAN? No ICMP so that the host actually has a clue when it tries to connect to something that is unreachable?
Sorry, I wasn't layout out the whole plan. Sure, some of that'd be open. But ICMP? Users don't usually need to ping. If they do, an admin can RDP in and do it for him.
>>Don't forget hackers...
I think that if you run the protocols on nonstandard ports and close those on your external firewall, you should be OK. Admins need a remote desktop app to troubleshoot. Nothing is more useless than having a user describe a problem. If they can show you the prob, it can be cleared quickly.
>>That would destroy the reason most people use email these days. Can you imagine how effectively a salesperson or manager is going to be able to do their job, if they can't easily send markting material such as PDF's or PPT's to customers?
Not everyone needs to communicate with a customer. If so, make special arrangements. And no one should be getting ZIPs, RARs, EXEs, and the like. The smart ones begin renaming the extension. So now, no attachments == some security.
>>Why? What makes an image any more of a threat to security than a rich-text email (especially when read with certain well known mail clients... *cough* Outlook *cough*) ?
Images can link to external servers and be used to verify good IP and e-mail addresses. They can also exploit unpatched systems.
>>That usually comes down to implementing sensible file/directory permissions, and the challenging task of educating users to actually save stuff in the right place.
Still, you have to give users read/write to their group folders. That's where the real damage can happen.
I'd rather you do it wrong, than for me to have to do it at all.
But ICMP? Users don't usually need to ping.
ICMP entails quite a bit more than just ping. If the PC is unable to receive "network/host/protocol/port unreachable", they'll just sit there stupidly until the connection times out. "TTL expired" and "needs fragment" are also fairly important.
I think that if you run the protocols on nonstandard ports and close those on your external firewall, you should be OK. Admins need a remote desktop app to troubleshoot. Nothing is more useless than having a user describe a problem. If they can show you the prob, it can be cleared quickly.
If you run services on nonstandard ports, you're only going to stop the dumbest of hackers. Anyone with a clue will portscan your box, to see what's open. From there, it's relatively easy to identify the protocol bound to a particular port. Security through obscurity is not really security. As for blocking ports on a firewall, of course, that is standard practice. But often the threat these days is within an organisation. Most LAN's have very little network security, once inside the perimeter. Crunchy on the outside, soft and chewy on the inside.
I agree however, it's useful to be able to take remote control of a user's desktop. Citrix has such a feature built in, called "shadowing a session". Of course, that's in a Citrix environment, not an XP desktop environment.
And no one should be getting ZIPs, RARs, EXEs, and the like. The smart ones begin renaming the extension.
Even open source mail scanning gateways such as Amavisd-new support banned filename extensions. Couple that with ClamAV, and scan all attachments not yet banned, including recursive scanning of compressed archives, and you get quite a bit of security for very little cost. I've seen this solution fare better than commercial ones, which failed because the virus was a ZIP inside a ZIP.
Images can link to external servers and be used to verify good IP and e-mail addresses.
True... which is why most email clients these days do not display images (and thus invoke the HTTP connection to retrieve that invisible 1px image) by default. This kind of thing can also be prevented by having a web proxy that only allows access to whitelisted sites.
Still, you have to give users read/write to their group folders.
Yes you do, there is no way around that. All you can do is give people access to the minimum amount possible. Beyond that, backups are really your only safety net.
>>Crunchy on the outside, soft and chewy on the inside.
.com/net/org. Once I pointed out that someone in Russia can buy a .com, they relaxed a bit.
So true. Hence the need for good control of the software they run. Good network baselines and port-level switch security are a must also. If you notice something is up, you can investigate. We get PMs when SNMP reports high utilization on a switch. From there, we open the switch's graphs and determine who is doing what. If a user's port is screaming, we disconnect them and go over to see what's up.
>>I agree however, it's useful to be able to take remote control of a user's desktop. Citrix has such a feature built in, called "shadowing a session". Of course, that's in a Citrix environment, not an XP desktop environment.
Most of the VNC systems have this. I can connect using TinyVNC and watch a user.
>>Even open source mail scanning gateways such as Amavisd-new support banned filename extensions. Couple that with ClamAV, and scan all attachments not yet banned, including recursive scanning of compressed archives, and you get quite a bit of security for very little cost. I've seen this solution fare better than commercial ones, which failed because the virus was a ZIP inside a ZIP.
Or they password the ZIP and include the pass in the email. If you allow it, it will be exploited.
>>True... which is why most email clients these days do not display images (and thus invoke the HTTP connection to retrieve that invisible 1px image) by default. This kind of thing can also be prevented by having a web proxy that only allows access to whitelisted sites.
That's crazy. Even I wouldn't reccomend whitelisting. I did some work for a company a while back that blocked everything not in the US. Users would get blocked from everything that didn't end in a
>>Yes you do, there is no way around that. All you can do is give people access to the minimum amount possible. Beyond that, backups are really your only safety net.
Agreed. Which is why I say no user can write to his own hard drive outside of the "temp" folders and desktop. We get hundreds of calls at first from people not being able to save a doc, but once they understand how to use their mapped "personal" drive (mapped under P:\) and their group's drive (mapped to G:\), they understand.
I'd rather you do it wrong, than for me to have to do it at all.
We get PMs when SNMP reports high utilization on a switch. From there, we open the switch's graphs and determine who is doing what. If a user's port is screaming, we disconnect them and go over to see what's up.
.com/net/org.
In a graphic design house, or anywhere that routinely works on large files, that's going to inconvenience and maybe even infuriate a lot of people. A large file copy is going to make a port "scream", that is, up until you disconnect it. Do you strap on a bulletproof vest and riot helmet before confronting the user of that port?
You should possibly consider taking a look at Cisco NAC.
Or they password the ZIP and include the pass in the email. If you allow it, it will be exploited.
So you quarantine anything that is not scannable. I'd rather do that, than make email virtually useless by blocking all attachments outright. Unless your job title is BOFH, that's just gonna piss people off, and some of those people may be the ones who write your paychecks.
I did some work for a company a while back that blocked everything not in the US. Users would get blocked from everything that didn't end in a
The domain TLD has nothing to do with the geographic location of a server. It might have been a rough guide, once upon a time. Anyway, I was thinking more along the lines of whitelisting sites you trust, regardless whether they're US, German, Chinese... sites that your users have a legitimate reason to connect to.
My security solution that handles 95% of what I need is OpenBSD (plus a couple of ports) The documenation is awesome as is the community, and it is built to be proactively secure. Give it a try: http://www.openbsd.org/
Live Free
Ahh, a comprehensive article on security structure written by someone out to sell something. Only one good tag for this story - "markitechture".
"There is more worth loving than we have strength to love." - Brian Jay Stanley
I thought the network was supposed to facilitate business and personal communication. One configured like this looks more like 'walking through a minefield'. How do you ever get a distributed application (think funds transfer between banks) working ? Cash on a motorcycle ?
What's the difference if the virused attachements arrive to the mail client and user opens them versus user opens all attachements in the "dump directory" ? Besides, deleting the dump directory every night makes it practically unusable for legitimate purposes. How should one associate the text mails with the files in home folders (copied over from ever deleting dump folder) ?!? The whole proposal looks nice in PowerPoint, and hopefully will never get deployed
http://revj.sourceforge.net
What email side? You've blocked everything but http and https. POP, IMAP, SMB, NFS etc etc etc etc etc are all blocked.
Deleted
Trite, insipid and banal. I agree that a holistic approach is needed and because of that a 'platform' is only part of the remedy. Apart from stating the obvious, the approach advocated here actually amounts to a view of information security which is curiously not holistic. As is usual, there is no mention of any process involved in information security simply a thinly veiled entreat to buy the snake oil and all will be well. Reader beware if devices are all that is mentioned then question the writers motives.
I would urge investigation of ISO27001 for any organisation. This will give you a framework. The risk analysis process will tell you what you are trying to protect and from what. The business owns the risk and if they accept it your job is done. If mitigation is mandated then you can look for 'platforms' and processes that fulfil your requirement. If your approach is rigourous then you will reduce the risk to an acceptable level for all parties concerned.
Of course, the success of the above relies heavily on skilled technical security professionals capable of acurately identifying threats, vulnerabilities and effective mitigation tactics.
In short, I would rather "blend" the above solution than concentrate on a bunch of boxes stitched together like 'Buffalo Bill' on a Saturday night.
So now, no attachments == some security
I assume you are also stating to not allow any removable media. If you don't allow attachments then users will find some other way to get some file that they need (or "think" they need) and there is no better method than floppy/USB Key/CD for that.
it was generated by http://pdos.csail.mit.edu/scigen/.
Except in fake papers and speeches by our college president have I heard something simple ( and trivial ) said in so many words.
This article is nothing but crap marketing words designed to confuse the ignorant.
Translation with missinformation: Hackers are now attacking vulnerabilities in applications.
The trueth: Script Kiddies are learning how to attack vulnerabilities in applications thanks to frontend applications like Metasploit.
What they don't know: Hackers designed layers 1-7.
Having to work for a living is the root of all evil.
Build plywood forms around the computer and pour concrete.
Anyone who doesn't know about Bruce Schneier should check out his writings (he has several books out). He thinks to the bottom of things, recursively asking "what's the *real* problem?" until he gets to a real solution. I've tried to follow his example in my security blog for normal people.
It's not even enough to be a security generalist.
After you've studied every facet of security, remember that some attacks come from backhoes and hurricanes. Learn about business continuity. Then instead of getting frustrated when security measures don't work, learn systems safety engineering to understand why. Study finance and risk management so you can have common ground for discussion with C-level managers. Maybe insurance is better than prevention in some cases.
At a very rough guess, I'd say that between the two of us, we could produce a text at least 20-30 (maybe 40) volumes long on what a security expert would need to know. Dunno how much you could add, but I could certainly manage the chapter titles and maybe even a little of the content we've listed so far.
Of course, that does beg another question. Other than manufacturing portable Black Holes, what would anyone do with such a book even if written? It would be unlikely anyone would even try to read it, and I seriously doubt many people - even very bright people - could completely digest a text up to twice the size of the entire Oxford English Dictionary. On the other hand, if something like that were not written, data security won't noticeably improve and ignorance of the scope of the problem will remain.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
Yeah, the article is clearly marketing hype. All broad brush, loaded with scary terms couched in small technical-sounding (but relatively non-technical paragraphs by some VP of Marketing. Note the use of hanging "and,"s as paragraph breaks, lest some poor, ignorant exec's eyes glaze over at uninterrupted technobabble.
I was rather amused at how the writer(s) sort of lost it, style wise. I found the fact that threat-scape was unquoted the first time it was used (at the end of a paragraph) while it was quoted as if it was a new term the second time it was used, in a short paragraph with yet another awkward transition at the end.
All in all, what impressed me most about the authors is how they must have tried really, REALLY hard to sound knowledgeable but came across looking like wannabes as far as security expertise goes. We all know how well maintaining the appearance of being knowledgable works as far as actually securing systems goes.
*SIGH* Time to reset the BS detector...
FLASH!: I just remembered the image that came to mind when I was reading the article, trying to figure out what the basic message the authors were trying to convey is. Remember the Talking Barbie ads that got the jockey shorts of a few feminists in a bunch several years ago? If so, imagine Barbie whining, "Security is hard!"
"You're young, you're drunk, you're in bed, you have knives; shit happens." -- Angelina Jolie
Nothing!!! Absolutely nothing to see here! This post like http://www.google.com/search?&q=network+security
http://www.michel.eti.br