Reputation scoring changes the enterprise security game

Scoring a sender's reputation is already working for antispam services -- now the idea is to use that technique in the firewall and other perimeter devices

Computerworld |

Previous 1 2 3 4 Page 2 Next

Page 2 of 4

By weaving reputation intelligence into perimeter devices, the hope among security vendors is that they boost the effectiveness and performance of firewalls and intrusion-prevention systems (IPS) -- maybe even routers and switches -- as much as they have for e-mail and Web security appliances.

Robert Boenne, a network engineer for Teachers Credit Union in South Bend, Ind., likes this idea, too. "I definitely see the potential in increasing the use of reputation-based controls. As long as we're working with a vendor that makes sure valid traffic doesn't get blocked and gives us the ability to make adjustments, it would make sense," he says.

The reputation buzz

To Jamey Heary, a security consulting systems engineer and frequent security blogger, the integration of IP reputation services into all sorts of security hardware is the most exciting trend in security this year. What really jazzes him is the improved performance such integration promises, he says.

Heary uses e-mail security as one example. "The reputation lookup takes a fraction of the CPU cycles that a real scan of an e-mail would take through an antivirus, -spam or -malware engine," he says. By some estimates, the lookup can run as much as 90% faster than processing through spam filters. As another example, he says offloading content processing from the IPS could cut bandwidth requirements by a third. "An enterprise that needs three IPSs and some load-balancing to get through all the data might just need one IPS if that IPS does the reputation lookup," he says.

Reputation scoring's success in catching spam

For antispam, reputation scoring's success has blown away everyone's expectations, says Joel Snyder, a senior partner at Opus One. Early reputation services suffered from low-spam catch rates and high false positives. But two changes have led to drastic improvements in the current-generation services, he says.

For one, legitimate e-mail and spam don't often flow from the same systems any longer, and this reduces the false positive rate. Second, vendors have put a lot of effort into identifying spam IP addresses, in large part through automation, and this has raised effectiveness, Snyder says. "When I first started looking at this in 2004/2005, we were seeing 10% to 25% block rates. Now we're seeing huge block rates. So it has been a great success story."

That's certainly the case at Teachers Credit Union in South Bend, Ind., explains Robert Boenne, a network engineer at the organization. Thanks to the use of McAfee's reputation-based EMail Gateway appliance, spam has turned into a nonissue at the credit union. In fact, it's almost nonexistent, he says. And, he adds, the device requires no hand-holding. "We used to accept spam, look at it and then reject. Now we just reject."

As an example, Boenne recounts a recent week when e-mail traffic spiked from the typical 120,000 to 200,000 messages -- a volume that minus the reputation service could have overwhelmed the small company's servers. But the reputation service identified 90% of the e-mail as spam, and TCU's e-mail servers only had to process 20,000 legitimate messages.

The integration of IP reputation services speaks to a layered, in-depth security strategy, according to experts.

Pat Peterson, a Cisco fellow and researcher who had been part of the SenderBase development team at IronPort, puts it this way: "We know there are dirty, filthy awful places on the Internet, like the Russian Business Network, which hosts an enormous amount of malicious content of all types. Why wouldn't you want to inform your firewall, especially if you don't routinely do business with Russian Web sites or you're not a multinational company, that this network is out there and that 99% of the time it's used for malicious activity?"

The same sort of logic applies to the IPS, which relies on signature files to determine access. "Knowing that a signature comes from a really good server or a really bad one will provide a far more high-fidelity indicator that the signature is good than just looking at the signature file alone," Peterson explains.

Previous 1 2 3 4 Page 2 Next

Page 2 of 4

Bing’s AI chatbot came to work for me. I had to fire it.