![Evolution of Network Security
[Acronym]
• SPI : Stateful Packet Inspection
• DPI : Deep Packet Inspection
• OC : Outbound Control
• FCI : Full Content Inspection
1984 1988 1991 1993 2001 2002 2004 2009 2011
Boom of Network
Security
Signature Packet Application SPI Application/User Context
Technology DPI OC FCI
detection filtering proxy awareness awareness
IDS IPS NGIPS
Next
Anti-DDoS Generation
Security!!
Product Firewall Firewall UTM NGFW
URL filtering DLP
Web-FW SWG](https://image.slidesharecdn.com/nextgenerationsecurity-130206191451-phpapp02/85/Next-Generation-Security-3-320.jpg)
![NGIPS - Context awareness (Example)
Context awareness provides “Actionable Intelligent”!!!
[Automated Tuning] [Incident Prioritization]
Unknown devise detection Linux-based Alerting
exploit detection (if Detection mode)
Needless action!
Abnormal traffic detection
Target server No
Dismissing/Logging
Provided?
Unexpected App./User
detection Impact level low!
Yes
…
Target server No
New vulnerability Blocking
patched?
reported
Impact level high!
Yes
Dismissing/Logging
Recommend related policy Impact level middle!](https://image.slidesharecdn.com/nextgenerationsecurity-130206191451-phpapp02/85/Next-Generation-Security-13-320.jpg)
More Related Content
Similar to Next Generation Security
Next Generation Security
- 1. Next Generation Security 2013.02, By Claude Conrad
- 2. Part I. UnderstandingNext-Gen. Security Part II. The Direction of FutureSystems’ NGFW (…this part is private!)
- 3. Evolution of NetworkSecurity [Acronym] • SPI : Stateful Packet Inspection • DPI : Deep Packet Inspection • OC : Outbound Control • FCI : Full Content Inspection 1984 1988 1991 1993 2001 2002 2004 2009 2011 Boom of Network Security Signature Packet Application SPI Application/User Context Technology DPI OC FCI detection filtering proxy awareness awareness IDS IPS NGIPS Next Anti-DDoS Generation Security!! Product Firewall Firewall UTM NGFW URL filtering DLP Web-FW SWG
- 4. Market Segmentation • 2011 : $1.19 Billion IPS/NGIPS ~ 2016 : 2.5% CAGR Divergence McAfee IPS HP Sourcefire • 2011 : $1.28 Billion ~ 2017 : CAGR 15% FW+IPS UTM Check Point Palo Alto Fortinet Check Point FW+IPS+Other SonicWall Enterprise Firewall /NGFW • 2011 : $6.3 Billion WatchGuard ~ 2017 : 7.3% CAGR Convergence Small Midsize Enterprise Large User ~100 ~1,000 ~20,000 +20,000 Throughput ~1G ~10G +10G
- 5. UTM UTM is multifunction network security products used by small or midsize businesses(SMBs). Advanced Now App. awareness User awareness Content awareness UTM WLAN controller WAN optimization VoIP Gateway …. Web-FW SSL Proxy DLP NAC Extended UTM URL filtering SSL VPN Anti-spam Anti-malware Firewall IPsec VPN IPS Anti-virus Basic 2004 UTM Defined by IDC, 2004
- 6. NGFW Next-generation Firewallprovides multiple protection mechanisms and features designed to prevent threats/attacks from network to application layers. Support in-line Bump-in-the-wire config. Minimum features; Standard first-generation firewall capabilities Integrated rather than merely colocated network IPS Application awareness and full stack visibility Extrafirewall intelligence : User ID directory, URL/IP DB Support upgrade paths to address future threats Defined by Gartner, 2009
- 7. NGFW - Applicationawareness Role Application Application detection control Regardless of the port, protocol, and Application access control (SSL) encrypted traffic! and action control! Composition Application Decryption (SSL, SSH) Application Protocol Decoding (Detect HTTP tunneling, individual function, etc.) Application Signature Application Heuristics (App. anomaly detection)
- 8. NGFW - SecurityPolicy of NGFW Existing FW NGFW Allow SOURCE to DESTINATION Allow Application SOURCE to DESTINATION SOURCE : IP addresses, Port # SOURCE : IP addresses, Port #, Users DESTINATION : IP addresses, Port # DESTINATION : IP addresses, Port # Allow 192.120.10.110 80 to any 80 Allow Facebook any any manager to any any Allow the use of 80-port for designated IP. Allow the access of “Facebook” for designated user group. (regardless of the port, protocol, and encrypted traffic!)
- 9. NGFW vs. UTM#1 Range of Security features UTM NGFW Throughput NGFW (FW+IPS+AV) UTM Market SMB Enterprise
- 10. NGFW vs. UTM#2 UTM NGFW App. ID as a IPS pattern! Port App. ID Port Traffic Classification Engine Traffic Classification Engine See applications only default port, See applications on every port, not just default port Identify potentially malicious traffic by port Identify potentially malicious traffic by application type
- 11. NGIPS Next-generation IPSbuilds on typical IPS solutions by providing application & contextual awareness to promptly assess threats, ensure a consistent and appropriate response, and reduce an organization’s security expenditures. Support in-line Bump-in-the-wire config. Minimum features; Standard first-generation IPS capabilities Application awareness and full stack visibility information sources ; user identities, vulnerability, Context awareness : patching state and geo-location information, etc. Content awareness Agile engine : Support upgrade paths to address future threats Defined by Gartner, 2011
- 12. NGIPS - Contextawareness (Definition) Context awareness(External intelligence, situational awareness) is the ability to deliver additional, relevant information to the FW & IPS engine to enable more accurate decisions to allow, alert, or block more quickly, accurately, and securely with fewer false positives. Context is the complex set of network circumstances. Context awareness is understanding the entire environment. Mgmt. system Devices Application (host profile (client side) with OS) Information Context Appliance awareness Configuration Service Vulnerabilities Context Security policy (server side (historical information! application) patching state) Special event detected! Network User ID Behaviors (NBA) How to respond?
- 13. NGIPS - Contextawareness (Example) Context awareness provides “Actionable Intelligent”!!! [Automated Tuning] [Incident Prioritization] Unknown devise detection Linux-based Alerting exploit detection (if Detection mode) Needless action! Abnormal traffic detection Target server No Dismissing/Logging Provided? Unexpected App./User detection Impact level low! Yes … Target server No New vulnerability Blocking patched? reported Impact level high! Yes Dismissing/Logging Recommend related policy Impact level middle!
- 14. NGIPS vs. NGFW#1 Context awareness NGFW-v2 User Other Content awareness NGFW Application awareness NGIPS Existing Firewall Existing IPS
- 15. NGIPS vs. NGFW#2 Element Typical FW NGFW Typical IPS NGIPS NGFW v2 Attack signature O O O O Application Applications O O O awareness User Users (Identity) O O O awareness Vulnerabilities O O DITECT Host profiles O O Context Client applications/ awareness Mobile devices O O O Virtual machines O O O NW Behavior anomaly △ O O O NBA Network access O O O O O URL CONTROL Site access O O O filtering User User access O O awareness Application Lauer 7 access O O awareness PaloAlto SourceFire Vendors CheckPoint McAfee SourceFire
- 16. The Meaning ofNext-gen. Security #1 Evolution of Convergence Awareness NGFW TCP/IP Layer IPS UTM Application Transport Internet • Network-centric • Application-centric Link Convergence Convergence • Colocated security • Closely integrated feature security feature
- 17. The Meaning ofNext-gen. Security #2 Age of Awareness (Expansion of DPI) All of awareness NGIPS for security Context Awareness NGFW Application User awareness awareness • Full content DLP, Anti-malware, inspection URL filtering Content awareness Pattern awareness • Pattern matching IPS (Basic awareness) for attack detection Anti-DDoS Deep Packet Inspection
- 18. The Meaning ofNext-gen. Security #3 Hardened Security Management Hardened Configuration features!! Policy setting Automation Information Mgmt. Appliance Monitoring Configuration system Security policy Visualization Reporting Detection Context Analysis Blocking awareness Context awareness is base of Active Control!
- 19. The Future ofSecurity Industry Product 2 Modulization 4 6 Product 8 4 ESM 3 SIEM Mgmt. 1 system 1 Consulting 3 4 Service 1 3 MSS 1990~ 2000~ 2010~ 2020~ Virus DB IPS DB Application DB Context DB
- 20. The most importantthing for strategy is "Information", The most important thing for planning is "Insight", The most important thing for development is "Practical ability", The most important thing for business is "Timing", The most important thing for service is "Executive ability“. The most important thing for outdoor activities is "Network", The most important thing for business practice is "Political power"! 2013.02, By Claude Conrad