HP to scale up TippingPoint network security with SDN
The company's Sentinel software would run on an SDN controller and tap into TippingPoint's intelligence
IDG News Service - Hewlett-Packard plans to use its recently announced SDN controller to distribute its TippingPoint intrusion prevention system across networks, overcoming the scale limitations of dedicated appliances.
The research project, called Sentinel, is one of HP's first steps to use the distributed nature of SDN (software-defined networking) to change what networks can do. In this case, SDN can make it easier to provide protection against Internet malware throughout an enterprise or carrier network. Sentinel can scale up to handle thousands of endpoints, helping to keep enterprises secure as they embark on BYOD (bring your own device) policies, said Mauricio Sanchez, chief security architect at HP Networking.
"It's bringing that level of capability to the entire network and not just to the Internet gateway," Sanchez said. Leveraging its security capabilities along with SDN is one move by HP to compete with rivals such as Cisco and Juniper in the rapidly evolving SDN market.
TippingPoint keeps track of known sources of malware on the Internet, with a list of about 700,000 sites today, according to the company. It consists of software and an accompanying service, in which security researchers identify sites that contain hazardous code.
Currently, the TippingPoint software is deployed in appliances, which are installed as gateways between the public Internet and a private network. But those appliances can become bottlenecks because their performance is limited by the speed of their network links and hardware components.
Researchers at HP are now working on turning TippingPoint into an application that runs on HP's SDN controller, said Sanchez, a co-creator of the application. Because SDN separates the control of a network from its forwarding plane, it allows networking applications to be distributed wherever in the network they need to be. HP's controller is designed to host many different applications.
Sanchez demonstrated Sentinel at a media event at HP on Thursday. The software works by capturing and analyzing the DNS (Domain Name System) traffic that's generated when a user on the network tries to go to a website. If the site's DNS information matches that of any site on the TippingPoint list, Sentinel will take action over the network using the OpenFlow protocol, Sanchez said. It can redirect the user's request or take other steps, including sending a warning that the endpoint may have gone to that site because it was infected.
Because the Sentinel application has a real-time connection to the TippingPoint service, which updates its database at least every two hours, it has the latest information to secure the network. And because it only captures DNS traffic instead of the full flow of Web-browsing data, it can work efficiently, Sanchez said.
- SIP Migration: Addressing CIOs' Concerns Recent data from IDG Research shows that many IT executives are counting on SIP to help them meet employee efficiency and customer experience...
- City Solved Network Mystery - Saves $30K The City of Jacksonville put their hunch to work and not only solved a mystery, but found a new and innovative use for...
- Using Video to Gain a Competitive Advantage: A Business Strategy for Mid-Market Companies The insights provided in this white paper are based on industry analysts and 30+ years of experience from the Video Collaboration Group at...
- Big Data, Big Mess: Sound Risk Intelligence Through Complete Context This paper examines the insecurity of the small businesses in the supply chain and offers tips to close those backdoors into the enterprise.
- NSS Labs & Cisco Present: Evaluating Leading Breach Detection Systems Today's constantly evolving advanced malware and APTs can evade point-in-time defenses to penetrate networks. Security professionals must evolve their strategy in lockstep to...
- Will the Real Endpoint Threat Detection and Response Please Stand Up? This webinar explores new technologies & process for protecting endpoints from advanced attackers as well as the innovations that are pushing the envelope... All Network Security White Papers | Webcasts