For more info on a specific newsletter, click the title. Details will be displayed in a new window.
Subscribe to
Computerworld 40 years of the most authoritative source of news and information for IT leaders.
Using a layered security approach to achieve network integrity
or
Other Security Stories
|
|
|
|
February 12, 2004 (Computerworld) -- It's becoming increasingly clear that the current model for network security -- defend the perimeter and patch, patch, patch -- has some serious shortcomings.
First, relying on signature files and patches doesn't provide the absolute protection that some vendors promise. Even if your perimeter systems are fully up to date, new attacks that signature files don't recognize will still get through. That was the case in January 2003 when the Slammer worm struck, spreading so quickly around the world that it slipped right past signature-based defenses and reached most vulnerable hosts within 18 minutes.
Fast worms such as Slammer and new blended attacks that combine worms and viruses will likely become more common this year. Because only their authors know what forms these attacks will take, IT teams have no way of blocking them with signature files. For all the investment being made in perimeter defenses, enterprise networks remain vulnerable.
Second, this maintenance-heavy approach to network security is expensive -- too expensive. A recent study by The Yankee Group found that the largest area of enterprise IT spending, 25%, is allocated to staffing costs. Why are IT organizations spending so much on staffing? In part, because today's security model is so labor-intensive. IT organizations need staffers for a growing list of low-level security tasks, such as reading the latest pile of security bulletins, tracking down patches, reprogramming firewalls and so on. When you consider that all this security work still leaves networks vulnerable to fast worms and blended attacks, perhaps it's time to put down the patch CDs, sit back and rethink our approach to network security.
For enterprises today, the network is where business takes place. Every department in an organization relies on the network for applications and for a growing share of communications, not only e-mail and instant messaging, but soon telephony as well. The mission of network security is to ensure that applications can do their jobs and that applications have the network bandwidth and the availability needed to support the operations of the company.
There's also a broader perspective on network requirements. It's a holistic view that encompasses security as well as availability, bandwidth and control. We call it network integrity. This is the real goal behind securing a network. When the network is functioning properly, providing applications with the bandwidth and availability they need, then the network has integrity, and security is doing its job, even when the network is under attack.
Instead of investing primarily at the perimeter, network managers would do well to adopt this broader approach, recognizing the unique vulnerabilities and requirements of each area of the network and deploying a layered security architecture designed to coordinate network operations overall and achieve network integrity.
The Yankee Group recommends that enterprises make network integrity an essential element of their application security architectures and invest in these four layers:
 |   |
| Eric Ogren is a senior analyst in the Security Solutions & Services practice at The Yankee Group in Boston. |
- Perimeter defenses. Keep your perimeter security, including firewalls, intrusion-detection systems and antivirus filters and use these defenses to keep bad traffic off the network. But don't fool yourself into thinking that a secure perimeter equals a secure network. Make sure you still have resources for the next three layers of security.
- The network integrity systems layer. This is a critical area between your perimeter and your application defense systems. Security here relies on automated, policy-driven traffic management systems that recognize traffic anomalies and react in real time to block, redirect and throttle problematic traffic, ensuring that bandwidth is available for mission-critical applications.
By applying intelligent traffic management in this layer, companies can not only minimize the effects of attacks that get through the perimeter; they can also intelligently manage surges of legitimate traffic and surges from problematic applications such as instant messaging and peer-to-peer file-sharing. Vendors delivering network integrity system features include Arbor Networks Inc., Captus Networks Corp., DeepNines Inc., ForeScout Technologies Inc., Lancope Inc., Mazu Networks Inc., NetScreen Technologies Inc., Network Associates Inc., Radware Ltd., Riverhead Networks Inc., Symantec Corp., TippingPoint Technologies Inc. and TopLayer Networks. Enterprise security architects are familiar with the concepts of network integrity and should evaluate the vendors against network integrity requirements. - The application gateway layer. Security at this layer focuses on the contents of traffic reaching applications. Web application gateways, e-mail spam filters, XML security systems and Secure Sockets Layer virtual private networks help ensure that application traffic is clean, efficient and secure.
- The host integrity layer. These security systems protect configurations on hosts and include host-based antivirus applications, intrusion-prevention software, spyware tools and personal firewalls. As the innermost layer of security, these products provide essential "last-resort" security for applications.
If current trends continue, security attacks will become more frequent and more virulent in the coming years. Investing in signature-based security systems is of limited use. A wiser course is to develop a multilayered security architecture that recognizes the strengths and the limitations of each type of security product. When deployed effectively, this layered approach creates a network that can withstand not only security attacks, but also unpredictable surges of legitimate traffic. By investing in network integrity, you can control the rising labor expenses for IT, while improving the network bandwidth and availability your applications -- and your business operations -- require.
|
Print this Story |
|
Send Us Feedback |
|
E-mail this Story |
|
Digg this Story |
|
Slashdot this Story |
|
|
|
|
|
 |
|
All Zones Application Performance Zone Enterprise-Class Security Zone Enterprise Solutions Zone The File Data Management Zone Grid Computing on Windows Zone Security Management Zone ITIL Best Practices Zone The SAS Zone Storage Virtualization Zone The Data Center Management Zone |
 See your link here
|
 |
||||||||
| ||||||||
| ||||||||
| ||||||||
|
Long Tail Supplier Collaboration - What's In It For You? 
Download this Executive Bulletin (a $49.95 value) for free, compliments of MessageLabs.
Get this white paper now!
Read up on the latest ideas and technologies from companies that sell hardware, software and services.
- Powerset unveils test version of Google-killer
- iPhone out of stock 'company wide,' say Apple sales reps
- Microsoft to limit capabilities of cheap laptops
- More top stories
Security Management ZoneSecurity management is the process of developing a comprehensive data protection plan. It takes into account all potential threats, the existing network environment, the future needs of the organization, and lays out a multi-tiered blueprint to integrate the security technology needed to combat these threats. CDW can help keep your network and data secure. Visit the CDW Security Management Zone now See All Zones
|
 Fired up about IT? Join Sharkbait and share your true tales of IT. SharkBait is the place for you to sound off about everything IT – the good, the bad, and the rest of the weird stuff you deal with every day. New baits 
|
Computerworld Technology Briefing: An open-source path to optimal virtualization Looking for a virtualization strategy that offers both the flexibility and reliability to meet the demands of mixed-source environments? Look no further than the fast-emerging open virtualization approach backed by some of the biggest names in enterprise computing. Together they are pointing the way toward higher data center performance without higher costs.Download this briefing
|
 In SecurityThere's plenty of talk about how to behave during a Customs search of your computer and gear, but Jon Espenschied's got tips for securing your data (and privacy) before you reach the border. Click here to read the latest column by Jon Espenschied |
 |
 |
Layered Security Solutions
Although basic network security issues have changed very little over the past decade, the
network security landscape has changed dramatically. Today's IT professionals still have the
primary responsibility of protecting the confidentiality of corporate information, preventing
unauthorized access, and defending the network against attacks. Security experts and analysts agree that a security solution comprised of multiple layers is the best defense against today's increasingly sophisticated attacks.Download this white paper
|
Universal Threat Management - Because Conventional UTM is Not Enough!
This white paper, written by Mark Bouchard of Missing Link Security Services, examines the challenges confronting today's enterprises with respect to managing threats on a network. It also discusses the need for "Universal Threat Management", which is a security solution approach for all physical locations within an enterprise that require threat protection.Download this white paper |
Selecting the Right Threat Management Solution
This short demo will guide you through key considerations for selecting a solution to manage threats on a network. Learn about the popularity of Unified Threat Management (UTM), and how it fits into an overall security solution. Explore critical elements of a network-wide solution for multisite and large network-size deployments and identify the four key features of a threat management solution.View this demo
|
CIO
Computerworld
CSO
DEMO
GamePro
Games.net
IDG Connect
IDG World Expo
Infoworld
The Industry Standard
ITworld
JavaWorld
LinuxWorld
MacUser
Macworld
Network World
PC World
Playlist
Copyright © 2008 Computerworld Inc. All
rights reserved. Reproduction in whole or in part in any form or medium
without express written permission of Computerworld Inc. is prohibited.
Computerworld and Computerworld.com and the respective logos are
trademarks of International Data Group Inc.
|
