Radware s Smart IDS Management. FireProof and Intrusion Detection Systems. Deployment and ROI. North America. International.

Size: px
Start display at page:

Download "Radware s Smart IDS Management. FireProof and Intrusion Detection Systems. Deployment and ROI. North America. International. www.radware."

Transcription

1 Radware s Smart IDS Management FireProof and Intrusion Detection Systems Deployment and ROI North America Radware Inc. 575 Corporate Dr. Suite 205 Mahwah, NJ Tel International Radware Ltd. 22 Raoul Wallenberg St. Tel Aviv 69710, Israel Tel

2 Page Introduction A high awareness of security-related issues in the past year has caused organizations to allocate more of their IT budget to security-related issues. Of those budgets, Giga claims that 54 percent of security-related spending this year was allocated to intrusion detection. 1 While budgets exist, IDS deployment is considered difficult and costly because NIDS (see below) should be installed on every network segment. This makes deployment and management very complex, and requires medium and large organizations to potentially require tens or hundreds of sensors for their networks. In addition, currently available NIDS are unable to keep up with high network bandwidth. This document will give some background on Intrusion Detection Systems (IDS), the challenges in deploying them, and the benefits of Radware s IDS Management solution. 1 Giga, July 2002,

3 Page Introduction to IDS Deployment An intrusion detection system (IDS) is a software product or hardware device that is capable of applying the latest security or attack expertise to separate relatively few potentially destructive events from a vast amount of benign activity. There are two system-monitoring approaches, network-based IDS (NIDS) and host-based IDS (HIDS), explained below. Organizations generally choose a combination of these approaches, based on their perceived vulnerabilities. Network-based Intrusion Detection System (NIDS) Network-based IDS monitors all network traffic passing on the segment where the agent is installed, reacting to a suspicious anomaly or signature-based activity. NIDS analyze every packet on their segment for attack signatures. Some Network-based IDS are unreliable at high speeds, when loaded they can drop a high percentage of the network packets. There is a limit to the number of packets that a network intrusion detection sensor can accurately analyze for potential intrusions in a given period of time. The portion of network traffic volume that exceeds this volume threshold is subject to receive partial and often inaccurate intrusion analysis. The higher the network traffic level and the more complex the analysis, the higher the error factor and potential security breach may be. Host-based Intrusion Detection System (HIDS) Host-based IDS monitors activity confined to the local host on which they are installed, and can see in detail what the attacker does, be it command execution, file access, system calls, and the like. The HIDS can then react to unusual activity on that host. A HIDS is best equipped to see attacks directed towards a specific operating system or application. Typical IDS deployment The following two components are usually part of a typical enterprise IDS deployment: NIDS Sensors sit in strategic locations and listen to all the traffic passing by them and optionally take action based on pre-defined or dynamic rules. Deciding on the location of these sensors, and matching the sensor s capacity to the segment s throughput, is the major challenge of a successful IDS implementation. IDS Console is the back-end. This is where the data gets gathered, processed, and presented to the end user. HIDS Software is installed on vulnerable hosts for additional protection.

4 Page IDS Deployment Challenges Costs: Deploying one NIDS per network segment is extremely costly, as devices can start at $25,000. The costs do not decrease after deployment as licenses must be renewed annually, and are also costly. Capacity: Current NIDS are limited in the throughput they can handle. As NIDS are passive devices, packets dropped are not blocked traffic, but rather packets that the NIDS did not have the capacity to inspect. These un-inspected packets could compromise network security. Redundancy: Since one NIDS is deployed per each network segment, there is no ability to deploy a back-up. If that device fails, all traffic on that segment will not be inspected. Scaling: Since NIDS are installed in promiscuous listening mode, and all devices on a specific network segment will all listen to the same content, upgrades or increasing bandwidth require replacement of sensors instead of scaling. SSL-based communication: NIDS sensors cannot understand SSL-encrypted traffic, so that encrypted traffic is allowed to pass un-inspected, even though it may hide a malicious attack. Network performance: Installing a NIDS sensor on a network segment requires the addition of a hub for that segment, where traffic is routed through the hub, while the NIDS is connected promiscuously. Introducing a simple hub, a lower-mtbf component with lower performance than the network s high-performance switch, can degrade overall network performance.

5 Page IDS Management with FireProof Meeting the Challenges FireProof provides high availability, load balancing, traffic aggregation, and optimization for IDS sensors. By creating IDS farms, and managing them with FireProof, organizations can overcome the following deployment and performance challenges: Cost savings with efficient deployment. Organizations can use FireProof to reduce IDS deployment costs by aggregating several segments that require inspection, therefore reducing the overall number of IDSs needed. Inspection of SSL-encoded traffic. With the addition of a CertainT 100 to passively decrypt SSL communication, FireProof can forward decrypted traffic to the IDS sensors. Thus, the sensors are always able to inspect all traffic. This is the only solution available today that allows NIDS to inspect encrypted traffic, which they would otherwise leave unexamined. Cost savings by optimizing IDS performance. FireProof can be configured to filter the traffic copied to an IDS by several parameters, including source and destination IP, application, or content. This can reduce the amount of traffic copied to an IDS device by 20% to 40%, thus lowering the overall number of IDSs needed and further reducing deployment costs for the organization. Providing fault tolerance to all IDS sensors. By creating a farm, IDS sensors provide high availability and redundancy, so that all traffic is always inspected. Inspection of all traffic, even for high throughput segments. In high throughput segments, the IDS may be unable to inspect all the traffic, which means that security can be compromised. With FireProof, adding NIDS sensors to a farm provides all required scalability and ensures that all traffic for that segment is inspected. Optimizing IDS performance by distribution of traffic by application. FireProof can be configured to send certain types of traffic, such as HTML, to IDS sensors that are optimized to handle it, and therefore inspect it more efficiently, further reducing the number of sensors required. Simplifying network management. Centralizing the location of all NIDS sensors in a network, as opposed to installing a sensor on each network segment, eases and simplifies network management. Safe software upgrades. When on NIDS is down for maintenance or upgrades in a farm, other sensors are up and securing the network.

6 Page FireProof Configurations with IDS There are two possible ways to manage IDS farms with FireProof: In-line IDS load balancing. The advantage of this configuration is that FireProof can provide traffic management capabilities to firewalls and VPN gateways, as well as for the IDS sensors. In this configuration, the IDS farm is typically connected to the internal FireProof: Out-of-path IDS load balancing. In this configuration, FireProof is connected to one or more copy ports on the switch, and is fully transparent to the network elements so that there is no need for complex routing changes on the network. The IDS farm is connected to the out-of-path FireProof: FireProof Redundancy While setting up an IDS farm provides fault tolerance for IDS sensors, in order to eliminate a single point-of-failure, redundancy needs to be provided for FireProof itself. Redundancy is achieved by using two FireProofs, where the IDS farms, clusters and policies are configured identically on both the main and backup devices. Additionally, the physical ports used for each IDS sensor must be the same for both FireProofs. As the IDS devices used for each session are kept in the Client Table, enabling Client Table mirroring ensures the appropriate IDS sensor(s) will be used for each session. IDS devices can either be directly connected to physical ports of FireProof, or via hubs.

7 Page IDS Deployment with FireProof the SSL challenge Some companies mistakenly believe that SSL (Secure Sockets Layer) will mitigate all security risks. Although SSL ensures business transactions, SSL-based communication can inhibit other parts of a security strategy. IDS sensors cannot interact with SSL, so encrypted traffic is allowed to pass without question. 2 IDS sensors are usually deployed at network locations where the SSL traffic is still encrypted, usually closer to the network edge. However, since SSL traffic is decrypted only very close to the servers or on the servers themselves, it cannot be terminated at the point where the sensors are installed. Additionally, since they are deployed out-of-path, as sniffers, they cannot terminate an SSL session. However, since they need to understand the SSL traffic, it must be decrypted for them. These two restrictions will only continue to exacerbate the problem as the percentage of SSL traffic grows. Radware offers the only solution to this problem: CertainT 100, operating in passive SSL mode, decrypts all SSL-based communication for the IDS sensors without terminating the session, so that they can inspect every packet for malicious attacks. Radware s smart IDS management solution introduces the only passive SSL capability in the industry. To assist the IDS sensors in decrypting SSL traffic, a CertainT 100 farm is added to the FireProof, as in the diagram, below: FireProof receives network traffic and performs the following to optimize intrusion detection: Drops traffic that does not require inspection, such as packets from trusted sources. Sorts traffic according to configured policies, that define which traffic should be copied to which IDS farm. Thus each IDS sensor receives the type of traffic that it processes most efficiently. Forwards SSL traffic to the Passive SSL farm for decryption. Forwards decrypted traffic to IDS farms for inspection according to configured policies. In this manner, all traffic that needs to be inspected - is inspected, with unlimited performance, scalability, and guaranteed availability. 2 Cover Your Assets, Web Style July 2002,

8 Page ROI for Smart IDS Management FireProof optimizes IDS deployment and the management of an IDS solution. Without FireProof, IDS devices are required to be installed one device per network segment. Deployment can be costly as each IDS sensor can run to tens of thousands of dollars, and a typical enterprise switched network can require hundreds of sensors for full coverage. With the creation of an IDS farm connected to FireProof, traffic from multiple lower throughput segments can be aggregated to one IDS sensor, while multiple IDS devices can be deployed for the higher throughput segments. This allows for the deployment of devices according to the total throughput requirements and not based on a specific segment s requirement, thus bypassing the one-ids-per-network-segment restriction. Additionally, FireProof can be configured to filter the traffic copied to an IDS sensor by several parameters. This means that trusted traffic, such as traffic coming through the Virtual Private Network (VPN) gateway, or other high-volume but intrusion-free traffic, such as streaming media and bit images, do not need to be copied to the IDS for inspection. This can reduce the amount of traffic copied to an IDS device by 20% to 40%. For example, a typical network with 35 segments with a throughput of about 10 Mbps each, a FireProof deployed out-of-path and controlling an IDS farm provides an immediate Return on Investment (ROI) in the following manner: Assuming that each IDS sensor can handle 40 Mbps capacity and costs $25,000. Without FireProof, one sensor is required per segment, requiring 35 sensors in all, an initial investment of $875,000. With FireProof, aggregating all segments requires capacity for 350 Mbps, which can be handled by only 9 sensors. Optimization by filtering traffic to the IDS reduces traffic to IDS by 20%-40%. The number of IDSs can be reduced by 20%, bringing the number to 7 sensors. This requires an initial investment of $175,000. Cost of two Application Switch II FireProofs is $50,000 Total deployment costs without FireProof, the 35 sensors, are $875,000, while the total deployment costs with a FireProof are $225,000, which is the cost of 7 sensors and the two FireProofs. This is a savings of $650,000 during IDS deployment. Additional savings can be realized every time the network configuration changes. In the example above, every new network segment would require an additional sensor, a cost of $25,000. However, scaling up with FireProof is cost-effective, so that a new sensor is required for every four new segments, reducing scaling costs by a quarter. Finally, since annual licensing fees for IDS are expensive as well, reducing the number of sensors required for network deployment can reduce costs even for companies who have initially deployed an IDS solution without FireProof.

9 Page Selling Radware s Smart IDS Management Qualifying Script for IDS Deployment Generally, the benefits of an IDS management solution will appeal more to security managers in an organization. At the higher level, the ROI benefits of Radware s solution can be stressed, while for others, the technical benefits of solution may be more appealing. Some possible questions that can help determine the match between a potential client and the IDS management solution are: Are you concerned about malicious attacks on your network? Have you thought about implementing an intrusion detection system to block attacks? If so, what breadth of deployment have you planned? Do you have a budget for it? Are you worried about the high cost of deploying numerous IDS sensors? How many network segments do you have? Are you considering deploying IDS sensors on all segments? How do you set fault tolerance for each sensor in each network segment? Do you have any high-throughput (above 40 Mbps) in your network? Are you worried about leaving some segments under-protected because of IDS sensor throughput limitations? Are you worried about the scalability of your IDS deployment? Are you scanning SSL-encrypted traffic with your IDS sensors? Four Reasons Radware s IDS Management is better than the competition: As Radware is an innovator in IDS traffic management, the competition is scarce. No other vendor has any passive SSL solution, and Radware s only current competition in the IDS traffic management is Top Layer s IDS Balancer Top Layer s maximal capacity is 120 Mbps 3, as opposed to FireProof s 1 Gbps capacity. 2. FireProof can support up to 20 IDS farms, and route traffic to as many or as few of them as needed. Top Layer cannot make this distinction and can only route traffic based on load balancing criteria. 3. Top Layer does not have a solution for SSL traffic. 4. Top Layer s box can only perform IDS load balancing, while FireProof can also provide attack mitigation with DoS Shield and Application Security, thus freeing up IDS sensors to deal with the less popular signatures. FireProof can also provide traffic management benefits to firewalls and VPN gateways. 3 Pushing firewall performance December 2001, Boxes from TopLayer, Nokia and NetScreen each clocked at more than 120M bit/sec throughput with short packets and 200M bit/sec with long packets. TopLayer and Nokia edged out NetScreen slightly in peak performance with small packets, with a peak of 130M bit/sec each vs. NetScreen's 120M bit/sec peak performance.

Content Inspection Director

Content Inspection Director Content Inspection Director High Speed Content Inspection North America Radware Inc. 575 Corporate Dr. Suite 205 Mahwah, NJ 07430 Tel 888 234 5763 International Radware Ltd. 22 Raoul Wallenberg St. Tel

More information

Application Security Backgrounder

Application Security Backgrounder Essential Intrusion Prevention System (IPS) & DoS Protection Knowledge for IT Managers October 2006 North America Radware Inc. 575 Corporate Dr., Lobby 1 Mahwah, NJ 07430 Tel: (888) 234-5763 International

More information

Content Scanning for secure transactions using Radware s SecureFlow and AppXcel together with Aladdin s esafe Gateway

Content Scanning for secure transactions using Radware s SecureFlow and AppXcel together with Aladdin s esafe Gateway TESTING & INTEGRATION GROUP SOLUTION GUIDE Content Scanning for secure transactions using Radware s SecureFlow and AppXcel together with Aladdin s esafe Gateway INTRODUCTION...2 RADWARE SECUREFLOW... 3

More information

SOLUTION GUIDE. Radware & CyberGuard Complete Security Solutions offering Load Balancing, High Availability and Bandwidth Management.

SOLUTION GUIDE. Radware & CyberGuard Complete Security Solutions offering Load Balancing, High Availability and Bandwidth Management. SOLUTION GUIDE Radware & CyberGuard Complete Security Solutions offering Load Balancing, High Availability and Bandwidth Management. North America Radware Inc. 575 Corporate Dr Suite 205 Mahwah, NJ 07430

More information

Taxonomy of Intrusion Detection System

Taxonomy of Intrusion Detection System Taxonomy of Intrusion Detection System Monika Sharma, Sumit Sharma Abstract During the past years, security of computer networks has become main stream in most of everyone's lives. Nowadays as the use

More information

INTRUSION DETECTION SYSTEMS and Network Security

INTRUSION DETECTION SYSTEMS and Network Security INTRUSION DETECTION SYSTEMS and Network Security Intrusion Detection System IDS A layered network security approach starts with : A well secured system which starts with: Up-to-date application and OS

More information

LinkProof And VPN Load Balancing

LinkProof And VPN Load Balancing LinkProof And Load Balancing Technical Application Note May 2008 North America Radware Inc. 575 Corporate Dr. Suite 205 Mahwah, NJ 07430 Tel 888 234 5763 International Radware Ltd. 22 Raoul Wallenberg

More information

Radware s Attack Mitigation Solution On-line Business Protection

Radware s Attack Mitigation Solution On-line Business Protection Radware s Attack Mitigation Solution On-line Business Protection Table of Contents Attack Mitigation Layers of Defense... 3 Network-Based DDoS Protections... 3 Application Based DoS/DDoS Protection...

More information

Radware s Multi-homing Solutions

Radware s Multi-homing Solutions Radware s Multi-homing Solutions White Paper May 5, 2003 North America Radware Inc. 575 Corporate Dr Suite 205 Mahwah, NJ 07430 Tel 888 234 5763 International Radware Ltd. 22 Raoul Wallenberg St Tel Aviv

More information

Advancement in Virtualization Based Intrusion Detection System in Cloud Environment

Advancement in Virtualization Based Intrusion Detection System in Cloud Environment Advancement in Virtualization Based Intrusion Detection System in Cloud Environment Jaimin K. Khatri IT Systems and Network Security GTU PG School, Ahmedabad, Gujarat, India Mr. Girish Khilari Senior Consultant,

More information

AppDirector Load balancing IBM Websphere and AppXcel

AppDirector Load balancing IBM Websphere and AppXcel TESTING & INTEGRATION GROUP SOLUTION GUIDE AppDirector Load balancing IBM Websphere and AppXcel INTRODUCTION...2 RADWARE APPDIRECTOR...3 RADWARE APPXCEL...3 IBM WEBSPHERE...4 SOLUTION DETAILS...4 HOW IT

More information

Application Delivery Controller (ADC) Implementation Load Balancing Microsoft SharePoint Servers Solution Guide

Application Delivery Controller (ADC) Implementation Load Balancing Microsoft SharePoint Servers Solution Guide Application Delivery Controller (ADC) Implementation Load Balancing Microsoft SharePoint Servers Solution Guide January, 2009 North America Radware Inc. 575 Corporate Dr., Lobby 1 Mahwah, NJ 07430 Tel:

More information

Architecture Overview

Architecture Overview Architecture Overview Design Fundamentals The networks discussed in this paper have some common design fundamentals, including segmentation into modules, which enables network traffic to be isolated and

More information

IDS / IPS. James E. Thiel S.W.A.T.

IDS / IPS. James E. Thiel S.W.A.T. IDS / IPS An introduction to intrusion detection and intrusion prevention systems James E. Thiel January 14, 2005 S.W.A.T. Drexel University Overview Intrusion Detection Purpose Types Detection Methods

More information

INTRODUCTION TO FIREWALL SECURITY

INTRODUCTION TO FIREWALL SECURITY INTRODUCTION TO FIREWALL SECURITY SESSION 1 Agenda Introduction to Firewalls Types of Firewalls Modes and Deployments Key Features in a Firewall Emerging Trends 2 Printed in USA. What Is a Firewall DMZ

More information

Security+ Guide to Network Security Fundamentals, Fourth Edition. Chapter 6 Network Security

Security+ Guide to Network Security Fundamentals, Fourth Edition. Chapter 6 Network Security Security+ Guide to Network Security Fundamentals, Fourth Edition Chapter 6 Network Security Objectives List the different types of network security devices and explain how they can be used Define network

More information

Symantec Enterprise Firewalls. From the Internet Thomas Jerry Scott

Symantec Enterprise Firewalls. From the Internet Thomas Jerry Scott Symantec Enterprise Firewalls From the Internet Thomas Symantec Firewalls Symantec offers a whole line of firewalls The Symantec Enterprise Firewall, which emerged from the older RAPTOR product We are

More information

Module II. Internet Security. Chapter 7. Intrusion Detection. Web Security: Theory & Applications. School of Software, Sun Yat-sen University

Module II. Internet Security. Chapter 7. Intrusion Detection. Web Security: Theory & Applications. School of Software, Sun Yat-sen University Module II. Internet Security Chapter 7 Intrusion Detection Web Security: Theory & Applications School of Software, Sun Yat-sen University Outline 7.1 Threats to Computer System 7.2 Process of Intrusions

More information

Securing data centres: How we are positioned as your ISP provider to prevent online attacks.

Securing data centres: How we are positioned as your ISP provider to prevent online attacks. Securing data centres: How we are positioned as your ISP provider to prevent online attacks. Executive Summary In today s technologically-demanding world, an organisation that experiences any internet

More information

PROFESSIONAL SECURITY SYSTEMS

PROFESSIONAL SECURITY SYSTEMS PROFESSIONAL SECURITY SYSTEMS Security policy, active protection against network attacks and management of IDP Introduction Intrusion Detection and Prevention (IDP ) is a new generation of network security

More information

CS 356 Lecture 17 and 18 Intrusion Detection. Spring 2013

CS 356 Lecture 17 and 18 Intrusion Detection. Spring 2013 CS 356 Lecture 17 and 18 Intrusion Detection Spring 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access Control Lists

More information

Radware s AppDirector and Microsoft Windows Terminal Services 2008 Integration Guide

Radware s AppDirector and Microsoft Windows Terminal Services 2008 Integration Guide Radware s AppDirector and Microsoft Windows Terminal Services 2008 Integration Guide Contents SOLUTION OVERVIEW... 2 RADWARE APPDIRECTOR OVERVIEW... 2 MICROSOFT WINDOWS TERMINAL SERVICES 2008... 2 SOLUTION

More information

Intrusion Detections Systems

Intrusion Detections Systems Intrusion Detections Systems 2009-03-04 Secure Computer Systems Poia Samoudi Asli Davor Sutic Contents Intrusion Detections Systems... 1 Contents... 2 Abstract... 2 Introduction... 3 IDS importance...

More information

Radware s AppDirector and AppXcel An Application Delivery solution for applications developed over BEA s Weblogic

Radware s AppDirector and AppXcel An Application Delivery solution for applications developed over BEA s Weblogic TESTING & INTEGRATION GROUP SOLUTION GUIDE Radware s AppDirector and AppXcel An Application Delivery solution for applications developed over BEA s Weblogic Contents INTRODUCTION... 2 RADWARE APPDIRECTOR...

More information

Virtualized Security: The Next Generation of Consolidation

Virtualized Security: The Next Generation of Consolidation Virtualization. Consolidation. Simplification. Choice. WHITE PAPER Virtualized Security: The Next Generation of Consolidation Virtualized Security: The Next Generation of Consolidation As we approach the

More information

TECHNICAL NOTE 10/03 DEPLOYMENT GUIDANCE FOR INTRUSION DETECTION SYSTEMS

TECHNICAL NOTE 10/03 DEPLOYMENT GUIDANCE FOR INTRUSION DETECTION SYSTEMS TECHNICAL NOTE 10/03 DEPLOYMENT GUIDANCE FOR INTRUSION DETECTION SYSTEMS 19 NOVEMBER 2003 This paper was previously published by the National Infrastructure Security Co-ordination Centre (NISCC) a predecessor

More information

Cisco Application Networking for BEA WebLogic

Cisco Application Networking for BEA WebLogic Cisco Application Networking for BEA WebLogic Faster Downloads and Site Navigation, Less Bandwidth and Server Processing, and Greater Availability for Global Deployments What You Will Learn To address

More information

Introduction... Error! Bookmark not defined. Intrusion detection & prevention principles... Error! Bookmark not defined.

Introduction... Error! Bookmark not defined. Intrusion detection & prevention principles... Error! Bookmark not defined. Contents Introduction... Error! Bookmark not defined. Intrusion detection & prevention principles... Error! Bookmark not defined. Technical OverView... Error! Bookmark not defined. Network Intrusion Detection

More information

WHITE PAPER: ENTERPRISE SECURITY. Strengthening Database Security

WHITE PAPER: ENTERPRISE SECURITY. Strengthening Database Security WHITE PAPER: ENTERPRISE SECURITY Strengthening Database Security White Paper: Enterprise Security Strengthening Database Security Contents Introduction........................................................................4

More information

Effective Intrusion Detection

Effective Intrusion Detection Effective Intrusion Detection A white paper by With careful configuration and management, intrusion detection systems can make a valuable contribution to IT infrastructure security s Global network of

More information

AN EFFICIENT INTRUSION DETECTION SYSTEM FOR NETWORKS WITH CENTRALIZED ROUTING

AN EFFICIENT INTRUSION DETECTION SYSTEM FOR NETWORKS WITH CENTRALIZED ROUTING AN EFFICIENT INTRUSION DETECTION SYSTEM FOR NETWORKS WITH CENTRALIZED ROUTING Paulo F. Andrade, Fernando Mira da Silva, Carlos Ribeiro Instituto Superior Técnico, Universidade Técnica de Lisboa, Lisboa,

More information

CSCE 465 Computer & Network Security

CSCE 465 Computer & Network Security CSCE 465 Computer & Network Security Instructor: Dr. Guofei Gu http://courses.cse.tamu.edu/guofei/csce465/ Intrusion Detection System 1 Intrusion Definitions A set of actions aimed to compromise the security

More information

Introduction of Intrusion Detection Systems

Introduction of Intrusion Detection Systems Introduction of Intrusion Detection Systems Why IDS? Inspects all inbound and outbound network activity and identifies a network or system attack from someone attempting to compromise a system. Detection:

More information

Intelligent. Data Sheet

Intelligent. Data Sheet Cisco IPS Software Product Overview Cisco IPS Software is the industry s leading network-based intrusion prevention software. It provides intelligent, precise, and flexible protection for your business

More information

Name. Description. Rationale

Name. Description. Rationale Complliiance Componentt Description DEEFFI INITION Network-Based Intrusion Detection Systems (NIDS) Network-Based Intrusion Detection Systems (NIDS) detect attacks by capturing and analyzing network traffic.

More information

Cisco Wide Area Application Services (WAAS) Software Version 4.0

Cisco Wide Area Application Services (WAAS) Software Version 4.0 Cisco Wide Area Application Services () Software Version 4.0 Product Overview Cisco Wide Area Application Services () is a powerful application acceleration and WAN optimization solution that optimizes

More information

Configuring Personal Firewalls and Understanding IDS. Securing Networks Chapter 3 Part 2 of 4 CA M S Mehta, FCA

Configuring Personal Firewalls and Understanding IDS. Securing Networks Chapter 3 Part 2 of 4 CA M S Mehta, FCA Configuring Personal Firewalls and Understanding IDS Securing Networks Chapter 3 Part 2 of 4 CA M S Mehta, FCA 1 Configuring Personal Firewalls and IDS Learning Objectives Task Statements 1.4 Analyze baseline

More information

Chapter 9 Firewalls and Intrusion Prevention Systems

Chapter 9 Firewalls and Intrusion Prevention Systems Chapter 9 Firewalls and Intrusion Prevention Systems connectivity is essential However it creates a threat Effective means of protecting LANs Inserted between the premises network and the to establish

More information

Networking and High Availability

Networking and High Availability TECHNICAL BRIEF Networking and High Availability Deployment Note Imperva appliances support a broad array of deployment options, enabling seamless integration into any data center environment. can be configured

More information

Firewall Environments. Name

Firewall Environments. Name Complliiance Componentt DEEFFI INITION Description Rationale Firewall Environments Firewall Environment is a term used to describe the set of systems and components that are involved in providing or supporting

More information

Guideline on Auditing and Log Management

Guideline on Auditing and Log Management CMSGu2012-05 Mauritian Computer Emergency Response Team CERT-MU SECURITY GUIDELINE 2011-02 Enhancing Cyber Security in Mauritius Guideline on Auditing and Log Management National Computer Board Mauritius

More information

Intrusion Detection System (IDS)

Intrusion Detection System (IDS) Intrusion Detection System (IDS) Characteristics Systems User, Process predictable actions describing process under that actions what pattern subvert actions attack of correspond the systems processes

More information

Cisco Application Networking for IBM WebSphere

Cisco Application Networking for IBM WebSphere Cisco Application Networking for IBM WebSphere Faster Downloads and Site Navigation, Less Bandwidth and Server Processing, and Greater Availability for Global Deployments What You Will Learn To address

More information

Total Cost of Ownership: Benefits of Comprehensive, Real-Time Gateway Security

Total Cost of Ownership: Benefits of Comprehensive, Real-Time Gateway Security Total Cost of Ownership: Benefits of Comprehensive, Real-Time Gateway Security White Paper September 2003 Abstract The network security landscape has changed dramatically over the past several years. Until

More information

IntruPro TM IPS. Inline Intrusion Prevention. White Paper

IntruPro TM IPS. Inline Intrusion Prevention. White Paper IntruPro TM IPS Inline Intrusion Prevention White Paper White Paper Inline Intrusion Prevention Introduction Enterprises are increasingly looking at tools that detect network security breaches and alert

More information

Securing Virtualization with Check Point and Consolidation with Virtualized Security

Securing Virtualization with Check Point and Consolidation with Virtualized Security Securing Virtualization with Check Point and Consolidation with Virtualized Security consolidate security gateways with full power of Software Blades with Check Point Virtual Systems (VSX) secure virtualized

More information

White paper. TrusGuard DPX: Complete Protection against Evolving DDoS Threats. AhnLab, Inc.

White paper. TrusGuard DPX: Complete Protection against Evolving DDoS Threats. AhnLab, Inc. TrusGuard DPX: Complete Protection against Evolving DDoS Threats AhnLab, Inc. Table of Contents Introduction... 2 The Evolution of DDoS Attacks... 2 Typical Protection against DDoS Attacks... 3 Firewalls...

More information

Network- vs. Host-based Intrusion Detection

Network- vs. Host-based Intrusion Detection Network- vs. Host-based Intrusion Detection A Guide to Intrusion Detection Technology 6600 Peachtree-Dunwoody Road 300 Embassy Row Atlanta, GA 30348 Tel: 678.443.6000 Toll-free: 800.776.2362 Fax: 678.443.6477

More information

Data Sheet. V-Net Link 700 C Series Link Load Balancer. V-NetLink:Link Load Balancing Solution from VIAEDGE

Data Sheet. V-Net Link 700 C Series Link Load Balancer. V-NetLink:Link Load Balancing Solution from VIAEDGE Data Sheet V-Net Link 700 C Series Link Load Balancer V-NetLink:Link Load Balancing Solution from VIAEDGE V-NetLink : Link Load Balancer As the use of the Internet to deliver organizations applications

More information

WHITE PAPER PROCESS CONTROL NETWORK SECURITY: INTRUSION PREVENTION IN A CONTROL SYSTEMS ENVIRONMENT

WHITE PAPER PROCESS CONTROL NETWORK SECURITY: INTRUSION PREVENTION IN A CONTROL SYSTEMS ENVIRONMENT WHITE PAPER PROCESS CONTROL NETWORK SECURITY: INTRUSION PREVENTION IN A CONTROL SYSTEMS ENVIRONMENT WHAT S INSIDE: 1. GENERAL INFORMATION 1 2. EXECUTIVE SUMMARY 1 3. BACKGROUND 2 4. QUESTIONS FOR CONSIDERATION

More information

Computer Security CS 426 Lecture 36. CS426 Fall 2010/Lecture 36 1

Computer Security CS 426 Lecture 36. CS426 Fall 2010/Lecture 36 1 Computer Security CS 426 Lecture 36 Perimeter Defense and Firewalls CS426 Fall 2010/Lecture 36 1 Announcements There will be a quiz on Wed There will be a guest lecture on Friday, by Prof. Chris Clifton

More information

Any-to-any switching with aggregation and filtering reduces monitoring costs

Any-to-any switching with aggregation and filtering reduces monitoring costs Any-to-any switching with aggregation and filtering reduces monitoring costs Summary Physical Layer Switches can filter and forward packet data to one or many monitoring devices. With intuitive graphical

More information

IREBOX X. Firebox X Family of Security Products. Comprehensive Unified Threat Management Solutions That Scale With Your Business

IREBOX X. Firebox X Family of Security Products. Comprehensive Unified Threat Management Solutions That Scale With Your Business IREBOX X IREBOX X Firebox X Family of Security Products Comprehensive Unified Threat Management Solutions That Scale With Your Business Family of Security Products Comprehensive unified threat management

More information

Networking and High Availability

Networking and High Availability yeah SecureSphere Deployment Note Networking and High Availability Imperva SecureSphere appliances support a broad array of deployment options, enabling seamless integration into any data center environment.

More information

Game changing Technology für Ihre Kunden. Thomas Bürgis System Engineering Manager CEE

Game changing Technology für Ihre Kunden. Thomas Bürgis System Engineering Manager CEE Game changing Technology für Ihre Kunden Thomas Bürgis System Engineering Manager CEE Threats have evolved traditional firewalls & IPS have not Protection centered around ports & protocols Expensive to

More information

CIP R1.5 Spring CIP Audit Workshop. April 14, 2016 Scott Pelfrey, CISA, CISSP, GISP, MBA Senior Technical Auditor

CIP R1.5 Spring CIP Audit Workshop. April 14, 2016 Scott Pelfrey, CISA, CISSP, GISP, MBA Senior Technical Auditor CIP-005-5 R1.5 Spring CIP Audit Workshop April 14, 2016 Scott Pelfrey, CISA, CISSP, GISP, MBA Senior Technical Auditor CIP-005-5 Part 1.5 Learning Objectives Terminology Discussion of IPS/IDS & firewall

More information

High Availability Solutions & Technology for NetScreen s Security Systems

High Availability Solutions & Technology for NetScreen s Security Systems High Availability Solutions & Technology for NetScreen s Security Systems Features and Benefits A White Paper By NetScreen Technologies Inc. http://www.netscreen.com INTRODUCTION...3 RESILIENCE...3 SCALABLE

More information

Improving Network Efficiency for SMB Through Intelligent Load Balancing

Improving Network Efficiency for SMB Through Intelligent Load Balancing Improving Network Efficiency for SMB Through Intelligent Load Balancing White Paper Series WP100134 Mike Mo, VP of Engineering January 2005 Abstract: As reliable Internet connectivity becomes a daily business

More information

JK0-022 CompTIA Academic/E2C Security+ Certification Exam CompTIA

JK0-022 CompTIA Academic/E2C Security+ Certification Exam CompTIA JK0-022 CompTIA Academic/E2C Security+ Certification Exam CompTIA To purchase Full version of Practice exam click below; http://www.certshome.com/jk0-022-practice-test.html FOR CompTIA JK0-022 Exam Candidates

More information

CTS2134 Introduction to Networking. Module 8.4 8.7 Network Security

CTS2134 Introduction to Networking. Module 8.4 8.7 Network Security CTS2134 Introduction to Networking Module 8.4 8.7 Network Security Switch Security: VLANs A virtual LAN (VLAN) is a logical grouping of computers based on a switch port. VLAN membership is configured by

More information

Securing Cloud using Third Party Threaded IDS

Securing Cloud using Third Party Threaded IDS Securing Cloud using Third Party Threaded IDS Madagani Rajeswari, Madhu babu Janjanam 1 Student, Dept. of CSE, Vasireddy Venkatadri Institute of Technology, Guntur, AP 2 Assistant Professor, Dept. of CSE,

More information

Security Event Management. February 7, 2007 (Revision 5)

Security Event Management. February 7, 2007 (Revision 5) Security Event Management February 7, 2007 (Revision 5) Table of Contents TABLE OF CONTENTS... 2 INTRODUCTION... 3 CRITICAL EVENT DETECTION... 3 LOG ANALYSIS, REPORTING AND STORAGE... 7 LOWER TOTAL COST

More information

Network Access Security. Lesson 10

Network Access Security. Lesson 10 Network Access Security Lesson 10 Objectives Exam Objective Matrix Technology Skill Covered Exam Objective Exam Objective Number Firewalls Given a scenario, install and configure routers and switches.

More information

Active Visibility for Multi-Tiered Security // Solutions Overview

Active Visibility for Multi-Tiered Security // Solutions Overview Introduction Cyber threats are becoming ever more sophisticated and prevalent. Traditional security approaches such as firewalls and anti-virus protection are not equipped to mitigate and manage modern

More information

Steelcape Product Overview and Functional Description

Steelcape Product Overview and Functional Description Steelcape Product Overview and Functional Description TABLE OF CONTENTS 1. General Overview 2. Applications/Uses 3. Key Features 4. Steelcape Components 5. Operations Overview: Typical Communications Session

More information

Load Balancing 101: Firewall Sandwiches

Load Balancing 101: Firewall Sandwiches F5 White Paper Load Balancing 101: Firewall Sandwiches There are many advantages to deploying firewalls, in particular, behind Application Delivery Controllers. This white paper will show how you can implement

More information

REV: 0.1.1 (July 2011) McAfee Security: Intrusion Prevention System

REV: 0.1.1 (July 2011) McAfee Security: Intrusion Prevention System McAfee Security: Intrusion Prevention System REV: 0.1.1 (July 2011) 1 Contents 1. McAfee Network Security Platform...3 2. McAfee Host Intrusion Prevention for Server...4 2.1 Network IPS...4 2.2 Workload

More information

Complete Protection against Evolving DDoS Threats

Complete Protection against Evolving DDoS Threats Complete Protection against Evolving DDoS Threats AhnLab, Inc. Table of Contents Introduction... 2 The Evolution of DDoS Attacks... 2 Typical Protection against DDoS Attacks... 3 Firewalls... 3 Intrusion

More information

WHITE PAPER. FortiGate DoS Protection Block Malicious Traffic Before It Affects Critical Applications and Systems

WHITE PAPER. FortiGate DoS Protection Block Malicious Traffic Before It Affects Critical Applications and Systems WHITE PAPER FortiGate DoS Protection Block Malicious Traffic Before It Affects Critical Applications and Systems Abstract: Denial of Service (DoS) attacks have been a part of the internet landscape for

More information

Intrusion Detection and Intrusion Prevention. Ed Sale VP of Security Pivot Group, LLC

Intrusion Detection and Intrusion Prevention. Ed Sale VP of Security Pivot Group, LLC Intrusion Detection and Intrusion Prevention Ed Sale VP of Security Pivot Group, LLC Presentation Goals Describe IDS and IPS Why They Are Important Deployment and Use Major Players The IT Security Camera

More information

Network Based Intrusion Detection Using Honey pot Deception

Network Based Intrusion Detection Using Honey pot Deception Network Based Intrusion Detection Using Honey pot Deception Dr.K.V.Kulhalli, S.R.Khot Department of Electronics and Communication Engineering D.Y.Patil College of Engg.& technology, Kolhapur,Maharashtra,India.

More information

Applications of Passive Message Logging and TCP Stream Reconstruction to Provide Application-Level Fault Tolerance. Sunny Gleason COM S 717

Applications of Passive Message Logging and TCP Stream Reconstruction to Provide Application-Level Fault Tolerance. Sunny Gleason COM S 717 Applications of Passive Message Logging and TCP Stream Reconstruction to Provide Application-Level Fault Tolerance Sunny Gleason COM S 717 December 17, 2001 0.1 Introduction The proliferation of large-scale

More information

Layer 4-7 Server Load Balancing. Security, High-Availability and Scalability of Web and Application Servers

Layer 4-7 Server Load Balancing. Security, High-Availability and Scalability of Web and Application Servers Layer 4-7 Server Load Balancing Security, High-Availability and Scalability of Web and Application Servers Foundry Overview Mission: World Headquarters San Jose, California Performance, High Availability,

More information

Smart Network. Smart Business. APSolute Immunity with DefensePro Brochure

Smart Network. Smart Business. APSolute Immunity with DefensePro Brochure Smart Network. Smart Business. APSolute Immunity with DefensePro Brochure APSolute Immunity: Your Business Clear Choice for Proactive Network Security The Changing Threats Landscape: Non-Vulnerability

More information

Advantages of Managed Security Services

Advantages of Managed Security Services Advantages of Managed Security Services Cloud services via MPLS networks for high security at low cost Get Started Now: 877.611.6342 to learn more. www.megapath.com Executive Summary Protecting Your Network

More information

Inspection of Encrypted HTTPS Traffic

Inspection of Encrypted HTTPS Traffic Technical Note Inspection of Encrypted HTTPS Traffic StoneGate version 5.0 SSL/TLS Inspection T e c h n i c a l N o t e I n s p e c t i o n o f E n c r y p t e d H T T P S T r a f f i c 1 Table of Contents

More information

Version Highlights. CertainT 100 SSL Accelerator. Version 2.11. International. New hardware and software version. North America

Version Highlights. CertainT 100 SSL Accelerator. Version 2.11. International. New hardware and software version. North America Version Highlights SSL Accelerator Version 2.11 New hardware and software version North America Radware Inc. 575 Corporate Dr. Suite 205 Mahwah, NJ 07430 Tel 888 234 5763 International Radware Ltd. 22

More information

McAfee Network Security Platform

McAfee Network Security Platform McAfee Network Security Platform Next Generation Network Security Youssef AGHARMINE, Network Security, McAfee Network is THE Security Battleground Who is behind the data breaches? 81% some form of hacking

More information

Application Reviews and Web Application Firewalls Clarified. Information Supplement: PCI Data Security Standard (PCI DSS) Requirement:

Application Reviews and Web Application Firewalls Clarified. Information Supplement: PCI Data Security Standard (PCI DSS) Requirement: Standard: Version: Date: Requirement: Author: PCI Data Security Standard (PCI DSS) 1.2 October 2008 6.6 PCI Security Standards Council Information Supplement: Application Reviews and Web Application Firewalls

More information

BSNL IDC Hosted Firewall Service. Total Network Security

BSNL IDC Hosted Firewall Service. Total Network Security Total Network Security Advantage BSNL IDC India s first Uptime Institute Certified Tier-III data centres with combined connectivity and IT services availability from BSNL Low latency Internet Data Centres

More information

The Evolution of Information Security at Wayne State University

The Evolution of Information Security at Wayne State University The Evolution of Information Security at Wayne State University Nathan W. Labadie ab0781@wayne.edu Sr. Systems Security Specialist Wayne State University A Bit of Background Covers mid-2000 to present.

More information

Security Frameworks. An Enterprise Approach to Security. Robert Belka Frazier, CISSP belka@att.net

Security Frameworks. An Enterprise Approach to Security. Robert Belka Frazier, CISSP belka@att.net Security Frameworks An Enterprise Approach to Security Robert Belka Frazier, CISSP belka@att.net Security Security is recognized as essential to protect vital processes and the systems that provide those

More information

Fortigate Features & Demo

Fortigate Features & Demo & Demo Prepared and Presented by: Georges Nassif Technical Manager Triple C Firewall Antivirus IPS Web Filtering AntiSpam Application Control DLP Client Reputation (cont d) Traffic Shaping IPSEC VPN SSL

More information

Industrial Network Security for SCADA, Automation, Process Control and PLC Systems. Contents. 1 An Introduction to Industrial Network Security 1

Industrial Network Security for SCADA, Automation, Process Control and PLC Systems. Contents. 1 An Introduction to Industrial Network Security 1 Industrial Network Security for SCADA, Automation, Process Control and PLC Systems Contents 1 An Introduction to Industrial Network Security 1 1.1 Course overview 1 1.2 The evolution of networking 1 1.3

More information

Intrusion Detection from Simple to Cloud

Intrusion Detection from Simple to Cloud Intrusion Detection from Simple to Cloud ICTN 6865 601 December 7, 2015 Abstract Intrusion detection was used to detect security vulnerabilities for a long time. The methods used in intrusion detection

More information

IDS Categories. Sensor Types Host-based (HIDS) sensors collect data from hosts for

IDS Categories. Sensor Types Host-based (HIDS) sensors collect data from hosts for Intrusion Detection Intrusion Detection Security Intrusion: a security event, or a combination of multiple security events, that constitutes a security incident in which an intruder gains, or attempts

More information

Product Overview. Product Family. Product Features. Powerful intrusion detection and monitoring capacity

Product Overview. Product Family. Product Features. Powerful intrusion detection and monitoring capacity NIP IDS Product Overview The Network Intelligent Police (NIP) Intrusion Detection System (IDS) is a new generation of session-based intelligent network IDS developed by Huaweisymantec. Deployed in key

More information

Executive Brief on Enterprise Next-Generation Firewalls

Executive Brief on Enterprise Next-Generation Firewalls Executive Brief on Enterprise Next-Generation Firewalls How security technology can reduce costs, improve compliance and increase employee productivity Enterprise Next-Generation Firewalls protect businesses

More information

Cisco Intrusion Prevention System Advanced Integration Module for Cisco 1841 and Cisco 2800 and 3800 Series Integrated Services Routers

Cisco Intrusion Prevention System Advanced Integration Module for Cisco 1841 and Cisco 2800 and 3800 Series Integrated Services Routers Cisco Intrusion Prevention System Advanced Integration Module for Cisco 1841 and Cisco 2800 and 3800 Series Integrated Services Routers The Cisco Intrusion Prevention System Advanced Integration Module

More information

Performance Evaluation of Intrusion Detection Systems

Performance Evaluation of Intrusion Detection Systems Performance Evaluation of Intrusion Detection Systems Waleed Farag & Sanwar Ali Department of Computer Science at Indiana University of Pennsylvania ABIT 2006 Outline Introduction: Intrusion Detection

More information

IS TEST 3 - TIPS FOUR (4) levels of detective controls offered by intrusion detection system (IDS) methodologies. First layer is typically responsible for monitoring the network and network devices. NIDS

More information

funkwerk packetalarm NG IDS/IPS Systems

funkwerk packetalarm NG IDS/IPS Systems funkwerk packetalarm NG IDS/IPS Systems First Class Security. Intrusion Detection and Intrusion Prevention Funkwerk IP-Appliances Corporate and Authorities networks: A Popular Target of Attacks Nowadays,

More information

nwstor Storage Security Solution 1. Executive Summary 2. Need for Data Security 3. Solution: nwstor isav Storage Security Appliances 4.

nwstor Storage Security Solution 1. Executive Summary 2. Need for Data Security 3. Solution: nwstor isav Storage Security Appliances 4. CONTENTS 1. Executive Summary 2. Need for Data Security 3. Solution: nwstor isav Storage Security Appliances 4. Conclusion 1. EXECUTIVE SUMMARY The advantages of networked data storage technologies such

More information

This chapter covers the following topics:

This chapter covers the following topics: This chapter covers the following topics: Components of SAFE Small Network Design Corporate Internet Module Campus Module Branch Versus Headend/Standalone Considerations for Small Networks C H A P T E

More information

WAN Optimization. Riverbed Steelhead Appliances

WAN Optimization. Riverbed Steelhead Appliances WAN Optimization Riverbed Steelhead Appliances Steelhead appliances deliver the highest performance and the most scalable wide-area data services solution available, overcoming both bandwidth and latency

More information

Information Supplement: Requirement 6.6 Code Reviews and Application Firewalls Clarified

Information Supplement: Requirement 6.6 Code Reviews and Application Firewalls Clarified Standard: Data Security Standard (DSS) Requirement: 6.6 Date: February 2008 Information Supplement: Requirement 6.6 Code Reviews and Application Firewalls Clarified Release date: 2008-04-15 General PCI

More information

Best Practices for Network Monitoring How a Network Monitoring Switch Helps IT Teams Stay Proactive

Best Practices for Network Monitoring How a Network Monitoring Switch Helps IT Teams Stay Proactive White Paper Best Practices for Network Monitoring How a Network Monitoring Switch Helps IT Teams Stay Proactive 26601 Agoura Road, Calabasas, CA 91302 Tel: 818.871.1800 Fax: 818.871.1805 www.ixiacom.com

More information

Unified Threat Management, Managed Security, and the Cloud Services Model

Unified Threat Management, Managed Security, and the Cloud Services Model Unified Threat Management, Managed Security, and the Cloud Services Model Kurtis E. Minder CISSP Global Account Manager - Service Provider Group Fortinet, Inc. Introduction Kurtis E. Minder, Technical

More information

Cisco IPS AIM and IPS NME for Cisco 1841 and Cisco 2800, 2900, 3800 and 3900 Series Integrated Services Routers

Cisco IPS AIM and IPS NME for Cisco 1841 and Cisco 2800, 2900, 3800 and 3900 Series Integrated Services Routers Cisco IPS AIM and IPS NME for Cisco 1841 and Cisco 2800, 2900, 3800 and 3900 Series Integrated Services Routers The Cisco Intrusion Prevention System Advanced Integration Module (IPS AIM) and Network Module

More information

A Review of Anomaly Detection Techniques in Network Intrusion Detection System

A Review of Anomaly Detection Techniques in Network Intrusion Detection System A Review of Anomaly Detection Techniques in Network Intrusion Detection System Dr.D.V.S.S.Subrahmanyam Professor, Dept. of CSE, Sreyas Institute of Engineering & Technology, Hyderabad, India ABSTRACT:In

More information