The Critical Importance of Three Dimensional Protection (3DP) in an Intrusion Prevention System

The Critical Importance of Three Dimensional Protection (3DP) in an Intrusion Prevention System By Adam Hils Top Layer Networks, Inc. Enterprises without a sound intrusion prevention strategy across the three threat dimensions - undesired access, malicious content, and rate-based attacks - open the door to unacceptable risks and costs, especially from hybrid attacks. Top Layer’s unique Three Dimensional Protection (3DP) approach provides the most comprehensive IPS protection for clients, servers, and network infrastructure, while maximizing bandwidth for mission-critical traffic. © 2006 Top Layer Networks, Inc. All rights reserved. Table of Contents INTRODUCTION.............................................................................................................. 3 ONE APPROACH............................................................................................................ 4 THE INTEGRATED SOLUTION: TOP LAYER’S IPS 5500 ..................................... 5 PROTECTING AGAINST UNDESIRED ACCESS WITH STATEFUL FIREWALL TECHNOLOGY .. 6 STOPPING MALICIOUS CONTENT ...................................................................................... 6 DENYING DISTRIBUTED DENIAL OF SERVICE (DDOS) AND OTHER RATE-BASED ATTACKS ......................................................................................................................... 7 THE TOP LAYER DELIVERY APPROACH ............................................................... 8 WHY TOP LAYER?......................................................................................................... 9 © 2006 Top Layer Networks, Inc. All rights reserved. Introduction When organizations first began experiencing the insecurity of networking, they placed barriers to entry on their networks – firewalls. Firewalls completely bar those entrances through which no traffic should be allowed to pass. In addition, they enforce access control over the ports they leave open, so that only traffic from desired IP addresses gets through. For these reasons, firewalls have proven effective against many types of intrusions. Of course, organizations can’t use a firewall to block everything from passing through, as the organization would not remain in business for very long. We have learned that attackers will learn to exploit any entry left open. Because they attack in multiple ways against which the firewall - with its access control emphasis - are not built to protect, hybrid attacks, Denial-of-Service (DoS) attacks, application level attacks and protocol anomalies get through most firewall deployments. Many companies also employ network intrusion detection systems, which inspect the network traffic and report their findings to log files and databases. IDS tools have been instrumental in providing forensics about attacks and in determining over time what areas of the network become compromised. While IDSs enable record-keeping, an alarm function, and eventual analysis and remediation, they do not stop or mitigate damage from malicious attacks in real time. An increasing number of organizations, therefore, are using network intrusion prevention systems in addition to other network security measures to mitigate information security risks. This is a generally positive development, as inline intrusion prevention systems with deep packet inspection capabilities are critical to protecting corporate networks. However, even among those forward-looking companies that have adopted IPS, too many are doing so in an incomplete fashion, focusing only on certain risks that have top-of-mind currency, thereby exposing them to serious varieties of risks they had not considered. Enterprises must have a sound intrusion prevention strategy across the three threat dimensions: Undesired access, wherein intruders gain access to such invaluable assets as proprietary intellectual property or customer identity/credit information, as we have seen in several high profile financial services attacks over the last eighteen months; malicious content, including viruses, spyware and other types, which can cause troubles that range from mild annoyances to cost-prohibitive extended network downtime and loss of stored material; and rate-based attacks, which intentionally overload computers or networks with garbage traffic for the purpose of preventing legitimate traffic from reaching its destination, resulting in lost revenue and brand © 2006 Top Layer Networks, Inc. All rights reserved. damage for the attacked. A three-dimensional approach which addresses all three of these attack techniques is critical to prevent being hurt by complex hybrid attacks that use multiple techniques to quickly spread malicious executables, techniques that can beat traditional security point measures. Some of the most damaging attacks ever orchestrated, such as Nimda, which infected over 2.2 million PCs and servers in 24 hours after its release in September 2001 (Computer Economics), causing an estimated $530M or more in damages because of downtime and clean-up costs, have been hybrids. Code Red, even more significantly, was responsible for an estimated $2.6 billion of damage. Other well-known cases of intelligent hybrid attacks that traditional security approaches were unable to prevent include SQL Slammer (which exploited a vulnerability and caused a DoS condition), and MyDoom (which contained elements of a virus, a DoS attack, and a backdoor Trojan). More recently, the Zotob worm and its variants took advantage of a vulnerability in Microsoft’s plug-and-play architecture by gaining undesired access to Windows desktops and servers through Port 445. Once the worm found a vulnerable system, it made an FTP connection to download a malicious content payload from an attacking computer. The worm also modified the host's files to prevent access to Web sites, including many antivirus and security sites. Finally, it created a backdoor that allowed for full remote command and control, adding to the potential for costly exploits. One Approach Such high-profile attacks have imprinted themselves in the enterprise’s security worldview, and for good reason. According to Gartner’s “Hype Cycle for Cyberthreats, 2005”, “the majority of new attacks will use hybrid techniques.” These hybrid attacks are proving themselves increasingly capable of propagating across an inadequately-protected network infrastructure. What typical security administrators consider as risks to protect against are what have been the traditional threats, usually malicious content. This is not all there is to worry about, however. Mass attacks such as worms and viruses – and universally visible, time consuming, potentially dangerous annoyances like spyware - get headlines because of widespread enterprise and consumer exposure. Targeted attacks, which aim to achieve a specific negative impact against specific enterprises and are often executed through such means as undesired access to proprietary systems/files and SYN floods, which receive very little publicity because enterprises do not want to expose the nature and extent of the damage an attack may have caused, are more malicious and can be more harmful and cost even more money to redress. Enterprises, when they address only part of © 2006 Top Layer Networks, Inc. All rights reserved. the threat spectrum illustrated below, leave themselves open to these sophisticated, targeted attacks. The challenge that the enterprise has faced is that employing point solutions to address these threat varieties across multiple fronts has proven costly, ineffective, difficult to manage, and reactive rather than proactive, remediating at great cost instead of preventing the damage from occurring. Figure 1: The Three Dimensions of Threat Activity The Integrated Solution: Top Layer’s IPS 5500 In order to best combat the threats posed by undesired access, malicious content, and rate- based attacks (and complex hybrid attacks that use multiple elements of these to circumvent static, one-dimensional security tools), enterprises should select and deploy a network IPS solution that addresses all three in an integrated, mutually-reinforcing fashion – as Top Layer Networks does with its “Three Dimensional Protection” approach. Figure 2: Top Layer Networks’ 3DP Architecture © 2006 Top Layer Networks, Inc. All rights reserved.