Improved network security with IP and DNS reputation. Business white paper

Transcription

1 Improved network security with IP and DNS reputation Business white paper

2 Tabe of contents Introduction...3 Understanding today s network security threats...3 Categories of cyber threats...3 Bad devices...4 Device reputation, a critica first step...6 Why TippingPoint IP and DNS reputation services?...6 Fu, powerfu protection...7 Your next step...7

3 Introduction Understanding today s network security threats As cyber threats across the gobe continue to increase in number and sophistication, security and networking personne must not ony work harder but aso smarter to stay ahead of maicious attacks. Sophisticated scanning, penetrating, and obfuscating toos and techniques are more widey avaiabe now more than ever before. Worst of a, hackers are now highy motivated to penetrate networks, appications, and databases to stea information that can quicky be sod for profit using botnets and other resources they contro. The probem is compounded by the ow risk of being caught; the risk of prosecution is even ower. How woud a botnet attack crafted by a Romanian teenager using a machine in Boivia to attack a bank server in the U.S. be traced? And even if a trace were possibe, what aw enforcement agency woud be ikey to understand the nature of the crime, et aone hep prosecute it? In the meantime, a company might find itsef on the front page of a nationa newspaper for ess than positive reasons. Categories of cyber threats A common first ine of defense is identifying the types of traffic on the enterprise network. For the purposes of this white paper, they are broken down into the foowing three high-eve categories: 1. Known Good Traffic trusted traffic that shoud pass through the network, unimpeded and uninspected 2. Known Bad Traffic traffic that shoud be bocked proactivey before it can attempt to compromise the network 3. Unknown or Ugy Traffic untrusted traffic that requires deep packet inspection to determine if it is good (egitimate) or bad (maicious) 3

4 Bad devices To stay ahead of today s onsaught of threats, enterprises can identify known bad devices based on IP or DNS addresses and bock the traffic they spew. These devices, existing in arge quantities, are: Botnet Command and Contro (CnC) sites: It s estimated that there are 5,000 to 6,000 botnet command and contro sites wordwide on any given day 1. If communications with their compromised hosts or bot army coud be identified and stopped, their effectiveness woud be seriousy reduced. Unfortunatey, this can be extremey chaenging botnet CnC servers are constanty moving to evade detection and bocking efforts from security and network personne. In fact, botnet masters, those individuas who contro and manage a botnet network, use a variety of techniques to avoid being discovered: To communicate with their bots, bot masters use standard channes such as IRC, P2P, and HTTP traffic incuding Twitter and instant messaging. This aows them to bypass traditiona firewas and some intrusion prevention system (IPS) security measures. Bots may use dynamic agorithms to seect CnC servers, making it amost impossibe to bock them using firewa access contro ists (ACLs). Bots use both DNS and IP addresses for identifying CnC servers. Consequenty, identifying botnet CnC servers requires detaied botnet anaysis and frequent updating of CnC ists. Maware depots: It is estimated that 2,500 2 to 50,000 3 devices, which act as maware depots or host maicious content are discovered daiy wordwide. If these devices coud be identified and stopped from spreading maware, then new hosts on enterprise networks coud be significanty reduced or even prevented from compromising network security. Unfortunatey, the sheer number of current maware depots is staggering. Depots are generay categorized into two primary types. The first incudes Web sites that are designed to ure victims and then infect their devices. The second and possiby even more dangerous type, incudes Web sites of egitimate businesses that are compromised because they haven t been propery secured. These sites are trusted and typicay visited by arge numbers of users, aowing the maware on them to spread much faster. These depots can aso be used as botnet drop sites, and for hosting maware software updates. However, unike the botnet CnC sites, the ookup mechanism for these depots is amost aways the DNS name and not the IP address. Therefore, identification invoves: (1) monitoring for maware downoads and tracking their origin, and (2) evauating data hosting sites wordwide. Phishing sites: There are approximatey 50,000 4 or more new phishing sites introduced to the Internet monthy. Identifying and bocking access to these devices coud protect users from faing prey to often very credibe ooking scams. As with the maware depot sites, contro is a chaenge because of the arge number of Web sites that host these scams. In fact, the Anti-Phishing Working Group identified 56,000 unique phishing sites in August 2009 aone as shown in the chart beow. Phishing Activity Trends 60,000 55,000 50,000 45,000 40,000 35,000 30,000 25,000 20,000 15,000 10,000 5, ,761 56,362 46,882 Juy August September Unique phishing sites detected from Juy through September Anti-Phishing Working Group, Phishing Activity Trends Report, Q Shadowserver Foundation, onine botnet monitoring 2 MessageLabs Inteigence: 2009 Annua Security Report 3 Sophos Security Threat report, Anti-Phishing Working Group, Phishing Activity Trends Report, Q

5 The two primary types of phishing sites are purpose-buit sites that ure victims and gather their private information, and sites that appear to be part of a known credibe business. In the atter case, a business Web site is usuay compromised and visitors are redirected to the phishing site that is generay identica to the Web site of the compromised business except that it is soey designed for criminas to gather private information. This type of phishing site is a threat to both the user and to the company whose Web site is compromised and whose customers are being scammed. Most of these sites are reached through DNS name requests. Accuratey identifying them invoves finding and evauating phishing scams that use mutipe deivery mechanisms, and evauating the associated phishing sites throughout the Internet. Compromised hosts: Host systems (typicay persona computers, aptops, and so on) estimated to number in the miions 5 are compromised most commony by bot maware. These compromised hosts may reside in corporate networks for some time without detection. They are typicay under the contro of a remote botnet master through botnet CnC sites. Compromised hosts are extremey dangerous because they can be used by a botnet master to conduct a variety of maicious attacks, incuding: Spreading maware to other hosts Compromising additiona hosts to create more botnet devices Performing reconnaissance scans Providing access to oca networks for further compromise Conducting Distributed Denia of Service (DDoS) attacks Conducting emai spam or phishing campaigns Conducting onine-cick fraud scams Tracking these compromised devices is chaenging and requires a wordwide community of participants that contribute event and attack data. 5 MessageLabs Inteigence: 2009 Annua Security Report 5

6 Device reputation, a critica first step To deveop a cear picture of a device s reputation, it must first be determined if the device is behaving bady, or in other words, if it is generating expoit traffic or attacks; has been compromised and is part of a botnet; or is hosting a site that spreads maware. Once a device s reputation is known, then organizations can use that information to bock access to and from devices that have a known bad reputation. Enterprises need a reputation database with significant metadata on each of these bady behaving devices identified through IPv4 or IPv6 addresses or DNS names for effective network poicy enforcement. Deveoping and maintaining comprehensive and current information, a significant chaenge given the amount of data and its ever-changing nature, requires a security research team that can: Coect arge amounts of device data Correate these arge data sets Vaidate the resuts of these data sets so that devices aren t wrongfuy entered into the Reputation Database Provide frequent database updates to keep up with changing attacks Prioritize the database entries through assigning a Reputation Score To acquire this information the team must: Coect rea-time attack events with very detaied attack data from a arge wordwide community of sensors Anayze Web traffic and craw Web sites of interest to coect data on sites hosting maicious content or scams Conduct carefu maware anaysis to identify botnet CnC sites, and botnet and maware drop sites Anayze attacks and scams to identify the devices that are participating in or conducting the attacks Probaby the most important component in buiding this strong reputation service is the depth of the database. It requires a wordwide community of participants contributing event data. Database quaity depends heaviy on the size, scope, and distribution of the attack coection sites, and the quaity and depth of the coected attack data. Why TippingPoint IP and DNS reputation services? HP offers enterprises security soutions that everage TippingPoint Lighthouses, a wordwide network of attack monitoring instaations, and TippingPoint ThreatLinQ, a customer-facing, rea-time threat andscape database. This active research infrastructure greaty increases the quantity and quaity of data that HP s TippingPoint soutions can provide. The strength of these soutions is aso augmented with the data and anaysis from partner organizations such as the SANS Institute, other Web and emai research firms, as we as open source maware, phishing, and botnet research communities. To deiver the benefits of this extensive data coection, the TippingPoint Reputation Digita Vaccine Service channes a data and on-going update data feeds to an enforcement point in the network, such as an inine TippingPoint IPS that inspects traffic in rea-time and can enforce reputation security poicies. Enterprises can set poicies based on a reputation score that considers information from the reputation database, incuding IPv4 and IPv6 addresses and DNS names, as we as metadata tags for each database entry. For exampe, an organization may decide to prevent visits to a Web site that has a DNS Domain Score of 80 out of 100 or higher, meaning the Web site is known to host maicious content. Poicy can aso be based on ocation or geography: an organization that ony conducts business in North America, for instance, might set poicy to bock or initiate aerts on any in-bound traffic from Europe, Africa, South America, and Asia. In addition, poicies can be set based on the type or the reason for the bad reputation score. For exampe, an organization may bock IP addresses that are known to attack or expoit sources, Web sites that are known to host maware, IP addresses that are known botnet CnC ocations, or IP addresses that are known spam sources. It may aso choose to bock a inbound traffic from spam sources using an IPS patform that is positioned in front of its DMZ and emai server. 6

7 To provide strong first-ine perimeter protection against botnets and maware, the TippingPoint Reputation Digita Vaccine Service bocks outbound user requests to bad domains and bocks inbound traffic from bad IP addresses. As a compement to other emai security devices, it aso protects users from spam and phishing emais, and safeguards the network from devices known to conduct DDoS and Web appication attacks. Administrators may aso add their own IP and DNS reputation ists into the reputation database. Fu, powerfu protection a known bad traffic set and the standard TippingPoint Digita Vaccine Service that inspects and appies poicy on gray traffic take advantage of the muti-threaded processing capabiities unique to the TippingPoint N-Patform IPS. IT staff can efficienty administer these security soutions with the TippingPoint Security Management System that not ony heps enterprises aign poicy setting with their own network profie, but aso generates the reporting needed to show compiance with interna mandates and reguatory requirements. A robust set of HP TippingPoint soutions heps enterprises increase security with automated services that reduce administrative burdens whie increasing protection. Parae security services the TippingPoint Reputation Digita Vaccine Service that expands TippingPoint Reputation Digita Vaccine Service Reputation database Security management system Internet Access switches IPS patform Bock outbound traffic to prevent Botnet Trojan downoads Maware, spyware, and worm downoads Access to botnet CnC sites Access to phishing sites Bock inbound traffic to prevent Spam and phishing emais DDoS attacks from botnet hosts Web appication attacks from botnet hosts Your next step To earn more about the HP TippingPoint security soutions, visit 7

8 Share with coeagues Get connected Get the insider view on tech trends, aerts, and HP soutions for better business outcomes Copyright 2010 Hewett-Packard Deveopment Company, L.P. The information contained herein is subject to change without notice. The ony warranties for HP products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein shoud be construed as constituting an additiona warranty. HP sha not be iabe for technica or editoria errors or omissions contained herein. 4AA2-3535ENW, Created Juy 2010