Protect Network Security Proactively.

Today's modern, high-performance network demands a security system that prevents potentially damaging attacks before they invade corporate networks and files. Twenty-first century business processes require corporations to open their networks to a range of suppliers, partners, customers, and organizations. In this environment it is more important than ever that organizations keep their networks up and running. Downtime is not only a deterrent to business, but costly. Due to the time and cost of getting a network back online, recovering data, investigating the attack, and making the necessary reparations it's clear that keeping a system functioning in the presence of new and evolving security threats is vital.

Traditional reactive security solutions, such as firewalls, intrusion detection, and anti-virus products, have limitations. These tools scan for configuration weaknesses and detect attacks but do not necessarily prevent them. Most are dependent on the end user to download updates. Often produced daily, these updates are difficult to keep up with and can also impede system performance. While one might assume that a combination of these products would offer highly secure solutions, in reality most products do not integrate well. As a result, enterprise security management has become an administrative nightmare.

This article discusses the new common sense, proactive approach to security required to effectively protect critical network systems. It outlines the traditional reactive security solutions currently available on the market and explains how to make a smooth transition from a reactive security approach to a proactive defense. It also demonstrates how to effectively and efficiently change corporate mindset so that management will consider security not merely as overhead, but as a vital investment that is essential to the successful operation of the enterprise.

The Evolution Of Attacks

Despite the best efforts of security officers, internal corporate computing resources are being penetrated every day, with attacks spreading at the speed of communications, to paralyze other resources on the network. The work of a hacker is never done; as a result, Denial of Service (DoS), defacement attacks and malicious code surround and reside in enterprise networks, proliferating ad infinitum. Recent events surrounding Microsoft's admission that their corporate network--and ultimately their product development source code--was hacked provides further evidence of the need for a new approach to security. DoS attacks also have disrupted corporate giants such as Yahoo, eBay, and Amazon, as well as government entities including the FBI.

Increased Internet use, mobile computing, intranets and extranets, and e-commerce initiatives are integral to business communications. As enterprises open up their networks to enable these vital e-business processes, points of entry for cyber attacks emerge. These attacks mutate and sneak past traditional static defenses to corrupt file systems, and can spread to thousands of computers in a matter of minutes, opening multiple electronic entrances to internal network resources.

With so many new, sophisticated, and deliberate attacks facing traditionally reliable security measures, today's enterprise can no longer afford to adjust reactively. Today's enterprise demands a proactive security solution for protecting network resources.

Virtually every attack follows a natural evolution. The table indicates the anatomy of how an attack progresses, from inception to infection and resulting damage. Protection in any one area is simply not enough defense against current attacks. Attacks must be identified and repelled before they can evolve.

Reactive Security Approach

The security market has grown reactively over the years in an effort to keep pace with the evolving security needs of an increasingly distributed computing environment. Consequently, today's security market is segmented, with many different vendors selling a wide range of security products. And yet, despite the continued reliance on firewalls, anti-viral scanners, vulnerability scanners, and intrusion detectors, a whopping 90% of organizations have been breached with reported losses totaling a staggering $265M in the last year, according to a recent Computer Security Institute poll.

A traditional reactive security strategy relies primarily on perimeter defenses, which, once compromised, pass the security burden onto subsequent layers of reactive scanning and detection technologies. While certain point products do address relatively elementary tasks associated with enterprise operations, very few have actually evolved to manage highly sophisticated attacks and the sheer volume of evolving, ever-changing threats in today's business environment. Following are three examples of existing security point products and their inherent limitations.

Firewalls. Considered a "perimeter" security solution, a firewall typically sits at the primary connection point to an outside network or the Internet. Network connections are forced to pass through a firewall for examination--accepted or rejected based on network access policy rules. Firewalls are widely used to give users access to the Internet in a secure fashion as well as to separate a company's public Web server from its internal network. They are also used to keep internal network segments secure.

While firewalls remain a critical component of virtually every organization's security strategy, traditional firewall technologies are simply not equipped to deal with the volumes of traffic flowing in and out of networks today. Users require more and more services on their desktops, including multimedia, streaming audio, database applications. And with remote and wireless computing, internal users "look" and operate just like external users. All of these services require the corporate firewall to be opened up more and more, rendering it less operative to stopping attacks. In fact, IT professionals need to be concerned that a firewall doesn't become a "bottleneck" to network performance.

Once an attacker gets past the firewall, the firewall becomes an inefficient means of protecting a corporation's network. In addition, it has been recognized that the majority of all computer attacks come from within an enterprise, another testament to the limitation of firewalls. Designed years ago to serve as an initial defense against brute force attacks, firewalls are now more suited to managing and monitoring network traffic bandwidth. The firewall cannot be relied upon solely to support a variety of network protocols, including a growing list of Internet and intranet applications, and be equally adept at controlling network access between internal resources.

Intrusion Detection. Intrusion detection systems (IDS) monitor network activity for attacks. These systems collect and analyze data from network sources to determine if attacks have been initiated against a network from outside or within an organization. They then proceed to report any suspicious activity to network/security administration. They also audit those activities that have violated established network parameters, providing forensic evidence that may prove helpful in prosecution activities. The downside of this approach is that a high volume of network traffic can overload a system, and as a result not all packets are analyzed. Also, an administrative staff is required to monitor the activity of IDS, sometimes requiring the increase of a company's security administration requirements and subsequent overhead. Like most scanning products, intrusion detection products typically search for configuration weaknesses and detect attacks after they occur. They do not prevent attacks. Due to their focus on a s ingle element--the network--IDS products also have a tendency to produce false positives (or false alarms) or even fail to alarm in certain instances, which can trigger unnecessary downtime.

While one might assume that a combination of these products might offer highly secure solutions, product integration is a challenge. In addition, many are dependent on the end user to download updates, which can impede system performance. As a result, when a virus hits, managers must rush in response for the latest upgrades--turning enterprise security management into an administrative nightmare.

Anti-Virus Products. Virus protection products are designed to recognize and eliminate file infections caused by untrustworthy files arriving in networks from outside resources. Typical antivirus products rely on scanning and pattern matching technology to identify known viruses, and therein lie their weakness. Antiviral products cannot recognize and deter new viruses. When a new virus emerges, a system remains unprotected until such time as anti-virus product manufacturers are able to develop an antidote, which might take days. Even then, most solutions are dependent on an end user's willingness and ability to download updates from the vendor's Web site or else the anti-virus protection is inadequate.

Proactive Security

While firewalls, intrusion detection systems and anti-virus software remain important tools for organizations seeking to secure their networks, IT managers are considering a new approach to security--one that is focused on "uptime." Where reactive tools fail in detecting new and unknown threats, causing downtime, this new breed of security solution is emerging to proactively address attacks before they strike to keep business running.

Ideally, this new software would involve a central management console and an intelligent agent embedded within every computing device in the enterprise. The management console would provide secure rule sets to agents, maintain agent event logs, generate comprehensive reports, and correlate an overall view of enterprise health based on the data that is pushed out and subsequent information that is taken in. This method of security is likened to application behavior enforcement, with IT departments and security administrators defining behavior characteristics, customizing and administering rules to work within the parameters of the enterprise's unique environment and security sensitivities. Intelligent agents would reside on all servers, desktops, and remote computing devices to ensure that the client machine is conforming to the corporate security policy at all times, no matter where it's located. Management consoles and intelligent agents would communicate automatically in real-time to eliminate the need to e ver shut down a network to stop an attack.

If set up in this way, proactive security will restrict the behavior of potentially malicious code without impeding business operations, providing a record of attack operations to notify enterprise security personnel when an attack is occurring. It would function at a high performance level to repel network-based attacks, such as DoS, probes, malformed packets, and hostile connection attacks. With architecture such as this in place, all network and computing resources would be protected against the complete lifecycle of an attack, while simplifying administration throughout the network. And an enterprise would finally be able to proactively control the outcome of an attack, rather than just trying to stay ahead of events beyond its control.

Changing Corporate Mindset

All too often, corporate IT professionals and business managers consider security to be overhead rather than an investment; that security threats are a necessary evil of doing business in the electronic information age and all that one can expect from security is that it reduces the risk of problems to what one might consider "acceptable levels." Others may put off implementing security tactics until after a major security incident occurs and they have suffered serious losses.

This attitude is risky as the costs involved with an attack can be quite high--usually resulting in significant downtime. Enormous amounts of time and energy go into pattern definitions, matches, and scans. When the network, or systems within the network, is down, an organization is not operating at maximum efficiency. Downtime also can mean loss of productivity, poor business practices, and loss of revenue, profitability and customer satisfaction. While there are different degrees of severity associated with downtime, the results can cause a paralyzing ripple throughout the enterprise. A particularly malicious attack can destroy vital, confidential, sometimes irreplaceable information, such as trade secrets, customer lists, and financial records. The cost to purchase reactive security technologies also can be considerable, with the dedicated man-hours usually needed to integrate and manage the technology within the organization adding to it exponentially.

By nature of their title and responsibilities, business managers must be bottom-line oriented, so persuasive arguments for becoming proactive about security must include an education on the risks, subsequent costs, and potential liability involved with not investing in network security. With every attack, the public trust in your company will falter and the emotional cost to employees and customers is high. For this reason, CIOs and security managers need to think about security in new ways. It is certain that new attacks are evolving and everchanging. To actively fight these threats that plague today's businesses, attitudes toward security must begin to evolve, too. Proactive security is a realistic way of improving uptime throughout the enterprise.

Eric Ogren is vice president of marketing at OKENA (Waltham, MA).

Attack Lifecycle
OKENA Intrinsic Security
PROBE              PENETRATE         PERSIST
Ping server addrs  Mail attachment   Create new life
Guess passwords    Javascript        Modify existing life
Guess mail users   ActiveX controls  Weaken Registry
                                     security settings
                   Network installs  Install new services
                   Compressed        Register trap doors
                   messages
                   Backdoors
PROBE              PROPAGATE            PARALYZE
Ping server addrs  Mail copy of attack  Format disk
Guess passwords    Web connection       Delete files
Guess mail users   IRC                  Modify Files
                   FTP                  Drill security hole
                   Infect file shares   Crash computer
                                        Denial of Service
                                        Steal secrets