Downloaded 28 times
Evaluating Intrusion Prevention Systems with IPS Testing
- 1. Validating Intrusion PreventionSystems1
- 2. Why Validate IPSResiliency?Product comparisonObjectiveRealistic yet repeatableQualitativeDeterministicUnderstand the impact of upgrades Impact on performanceImpact on securityImpact on other devicesUnderstand the impact of various loads High data rateHigh session setup rateHigh concurrent session level on various functions of the device2
- 3. Why Care About“Difficult Conditions”?What is your load?Peak load is your MOST important load, figure it out and test with it.The network is ever changingYouTube was introduced 3 years ago and now makes up 28% of Internet Traffic (T-Mobile).The average HTTP transaction went from 450 bytes to more than a megabyte.New applications are introduced EVERY day. It is dangerous out thereThousands of vulnerabilities & strikes, MORE introduced each day.Traditional tools are insufficientHard-to-use, not powerful enough, non-realistic traffic and rarely up-to-date.
- 4. How to ValidateIPS ResiliencyStatic content is necessary but insufficientNot just HTTP, but Flash over HTTP. Not just SMTP, but IMAP, POP3, Gmail and Hotmail.Use the worst case scenario for sessionsFind out the maximum number of sessions ever and double it.Run every Microsoft attack from the last 3 yearsYou are using mostly Microsoft, are you sure every server is patched?Your IPS should block 100% of the attacks.Run every security strike you can get your hands onThe more the better.Keep up to date on the latest strikes.Simulate evasions, obfuscation, DDoS, botnets…4
- 5. BreakingPoint IPS ValidationRealism:Blended application traffic combined with live obfuscated attacks.Future-proof: The most current application protocols (P2P, Mail Services, Voice/Video, etc.) and all known security vulnerabilities.Performance: Line-rate traffic generation.Capacity: Millions of concurrent TCP sessions.Ease-of-use: All-in-one automated system, built-in traffic profiles, scalable and flexible.
- 6. BreakingPoint Systems6Download IPSTest Methodologyhttp://www.breakingpointsystems.com/resources/testmethodologiesJoin the conversationwww.breakingpointlabs.comRequest a demonstrationhttp://www.breakingpointsystems.com/demo
Editor's Notes
- #3 It’s no secret that product capabilities and performance numbers are promoted using best case traffic conditions, conditions rarely seen in the real world.Yet, IPS devices performance and capabilities will vary widely based on the traffic encountered in your network.Deploying a new IPS or updated IPS without validating for resiliency is a surefire way to introduce vulnerabilities into your hardened critical infrastructure. There are several reasons for validating Intrusion Prevention Systems using BreakingPoint. First is to perform an “apples to apples” comparison between several devices to find one that best meets the requirements of a particular application. The data derived from any test must be objective, realistic and repeatable, qualitative, and deterministic. PRNG plays a critical role in ensuring accurate results from product bakeoffs because it allows buyers to level the playing field with randomly generated yet repeatable traffic. But this is only part of the value of PRNG. It also eliminates the possibility that devices under test can be programmed to recognize and react to codes embedded in test traffic. An example of this includes traditional testing products that brand their exploits with trademarks or other recognizable content. Vendors can easily exploit this code by programming their products to recognize the code and trigger filters to easily pass product validation. While it may appear that these products are working as promised, this is no indication that the equipment is capable of recognizing and filtering real security attacks in a production network. This is an artificial technique used to demonstrate capabilities that provides a false sense of security. Then, there is resiliency testing to validate devices before deploying into hardened IT infrastructures. Organizations should look for the appropriate resiliency score when purchasing or validate resiliency by conducting realistic and thorough product evaluations to mitigate risk of changes to networks, improve performance and security coverage, and reduce costs. The third purpose of testing is to understand the impact an upgrade will have on an IPS already deployed in the network. Update are notorious for changing the performance characteristics of a device. It is possible that an improvement in security detection will affect the throughput or latency of a device. Finally it is important to understand the impact of various loads (e.g., high data rate, high session setup rate, and high concurrent session level) on various functions of the device. Most interesting would probably be the impact on the accuracy of attack detection (both false positives and false negatives). Management interface responsiveness, reporting, and other functions may be impacted as well. In each instance, real network traffic simulation at increasingly high performance levels is key to validating today’s IPS’s before deploying into hardened infrastructures.
- #4 In reality, difficult conditions are simply the traffic your IPS is going to see on a daily basis. If not today, certainly tomorrow.
- #5 Static content is necessary but insufficientProtocol changes between applicationsChanges affect data ratesSecurity attacks are dynamic by natureSecurity attacks are intentionally evasive – many Intrusion Prevention Systems (IPS) cannot detect evasionsTraditional techniques present challengesEver changing real exploits and targetsLarge labs, massive hardware, and expensive software to scale to today’s performance requirementsPCAPs and synthetic traffic not effectiveDesigned for shells, not testing
- #6 There are several reasons for validating Intrusion Prevention Systems using BreakingPoint. First is to perform an “apples to apples” comparison between several devices to find one that best meets the requirements of a particular application. The data derived from any test must be objective, realistic and repeatable, qualitative, and deterministic. PRNG plays a critical role in ensuring accurate results from product bakeoffs because it allows buyers to level the playing field with randomly generated yet repeatable traffic. But this is only part of the value of PRNG. It also eliminates the possibility that devices under test can be programmed to recognize and react to codes embedded in test traffic. An example of this includes traditional testing products that brand their exploits with trademarks or other recognizable content. This is no indication that the equipment is capable of recognizing and filtering real security attacks in a production network. This is an artificial technique used to demonstrate capabilities that provides a false sense of security.