Using a layered security approach to achieve network integrity

February 12, 2004 (Computerworld) It's becoming increasingly clear that the current model for network security -- defend the perimeter and patch, patch, patch -- has some serious shortcomings.
First, relying on signature files and patches doesn't provide the absolute protection that some vendors promise. Even if your perimeter systems are fully up to date, new attacks that signature files don't recognize will still get through. That was the case in January 2003 when the Slammer worm struck, spreading so quickly around the world that it slipped right past signature-based defenses and reached most vulnerable hosts within 18 minutes.
Fast worms such as Slammer and new blended attacks that combine worms and viruses will likely become more common this year. Because only their authors know what forms these attacks will take, IT teams have no way of blocking them with signature files. For all the investment being made in perimeter defenses, enterprise networks remain vulnerable.
Second, this maintenance-heavy approach to network security is expensive -- too expensive. A recent study by The Yankee Group found that the largest area of enterprise IT spending, 25%, is allocated to staffing costs. Why are IT organizations spending so much on staffing? In part, because today's security model is so labor-intensive. IT organizations need staffers for a growing list of low-level security tasks, such as reading the latest pile of security bulletins, tracking down patches, reprogramming firewalls and so on. When you consider that all this security work still leaves networks vulnerable to fast worms and blended attacks, perhaps it's time to put down the patch CDs, sit back and rethink our approach to network security.
For enterprises today, the network is where business takes place. Every department in an organization relies on the network for applications and for a growing share of communications, not only e-mail and instant messaging, but soon telephony as well. The mission of network security is to ensure that applications can do their jobs and that applications have the network bandwidth and the availability needed to support the operations of the company.
There's also a broader perspective on network requirements. It's a holistic view that encompasses security as well as availability, bandwidth and control. We call it network integrity. This is the real goal behind securing a network. When the network is functioning properly, providing applications with the bandwidth and availability they need, then the network has integrity, and security is doing its job, even when the network is under attack.
Instead of investing primarily at the perimeter, network managers would do well to adopt this broader approach, recognizing the unique vulnerabilities and requirements of each area of the network and deploying a layered security architecture designed to coordinate network operations overall and achieve network integrity.
The Yankee Group recommends that enterprises make network integrity an essential element of their application security architectures and invest in these four layers:

	Eric Ogren is a senior analyst in the Security Solutions & Services practice at The Yankee Group in Boston.

1. Perimeter defenses. Keep your perimeter security, including firewalls, intrusion-detection systems and antivirus filters and use these defenses to keep bad traffic off the network. But don't fool yourself into thinking that a secure perimeter equals a secure network. Make sure you still have resources for the next three layers of security.


2. The network integrity systems layer. This is a critical area between your perimeter and your application defense systems. Security here relies on automated, policy-driven traffic management systems that recognize traffic anomalies and react in real time to block, redirect and throttle problematic traffic, ensuring that bandwidth is available for mission-critical applications.
   By applying intelligent traffic management in this layer, companies can not only minimize the effects of attacks that get through the perimeter; they can also intelligently manage surges of legitimate traffic and surges from problematic applications such as instant messaging and peer-to-peer file-sharing. Vendors delivering network integrity system features include Arbor Networks Inc., Captus Networks Corp., DeepNines Inc., ForeScout Technologies Inc., Lancope Inc., Mazu Networks Inc., NetScreen Technologies Inc., Network Associates Inc., Radware Ltd., Riverhead Networks Inc., Symantec Corp., TippingPoint Technologies Inc. and TopLayer Networks. Enterprise security architects are familiar with the concepts of network integrity and should evaluate the vendors against network integrity requirements.


3. The application gateway layer. Security at this layer focuses on the contents of traffic reaching applications. Web application gateways, e-mail spam filters, XML security systems and Secure Sockets Layer virtual private networks help ensure that application traffic is clean, efficient and secure.


4. The host integrity layer. These security systems protect configurations on hosts and include host-based antivirus applications, intrusion-prevention software, spyware tools and personal firewalls. As the innermost layer of security, these products provide essential "last-resort" security for applications.

If current trends continue, security attacks will become more frequent and more virulent in the coming years. Investing in signature-based security systems is of limited use. A wiser course is to develop a multilayered security architecture that recognizes the strengths and the limitations of each type of security product. When deployed effectively, this layered approach creates a network that can withstand not only security attacks, but also unpredictable surges of legitimate traffic. By investing in network integrity, you can control the rising labor expenses for IT, while improving the network bandwidth and availability your applications -- and your business operations -- require.