White Paper Network Security: A Buyers Guide What You Will Learn This buyer s guide provides an in-depth explanation of the factors that impel organizations to look at nextgeneration security solutions. It also offers: An analysis of the capabilities you should look for (and demand) in your network security solutions Arms you with the information you need to be an educated buyer Helps you get what you need, and not a set of future capabilities packaged in a marketecture that you can t deploy Catalysts for Security Measures Today s adversaries continue to increase their capabilities faster than the defenses deployed to stop them. Whether they are obfuscating their attacks or hiding malicious code within webpages and other files, they are making it more and more difficult to profile and identify legitimate network traffic. This is especially true in firstgeneration network security devices that restrict protection and policies to ports and protocols. The situation is likely to get worse before it gets better. Adversaries now use agile development and testing procedures to help their malware evade the majority of network security devices deployed to prevent such attacks. Enterprises therefore need to push for better security, because traditional perimeter security architectures no longer suffice. Next-generation network security devices have emerged that provide comprehensive contextual awareness and deeper analysis of network traffic. This complete contextual awareness, combined with security automation, provides the visibility and agility necessary to keep pace with today s fluid IT environment, increasing network speeds, and sophisticated threats. Next-generation network security also incorporates the ability to correlate a variety of network topologies, threats, and reputation data. Enterprises can enforce security policies based on the application being used, the employee (or group) using it, what content is in the session, and whether malware is being transferred within the session. With next-generation network security devices, enterprises have the necessary tools to address increasingly advanced attacks. Technology Disruption Organizations are fundamentally changing the way they provision and deliver technology to their employees. Providing access to critical data on mobile devices, either on or off the corporate network, is no longer a novelty it s a necessity. To speed deployment and save costs, organizations continue to push for strategic outsourcing of business functions and embrace software as a service, which results in enterprise data spread across the Internet and, unfortunately, too often out of the view and control of the internal security team. 2014 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 1 of 9
At the same time, virtualization and cloud computing are fundamentally changing how data centers are built and where the data resides, making it far more challenging to secure critical data. There is an increasing need, which few solutions address, to provide visibility, control, and threat prevention for these evolving, highly mobile, distributed, and dynamic computing environments. These issues make providing adequate security a daunting task, certainly when considering the first-generation network security tools, whose limitations include: Inability to completely see what needs protection due to visibility blind spots such as mobile devices, virtual host proliferation, cloud applications, encrypted traffic, and so on, all representing likely avenues for exploits Inability to distinguish between authorized web traffic and a potential attack when restricted to security policies based on ports and protocols alone Inability to allow select users to manage certain web applications without opening those applications to all workers in the organization (for example, marketing being the only group allowed to post to Facebook) Inability to analyze inbound files or check outbound websites to block malware before it compromises devices and results in data loss Additionally, new cloud-based and mobile technology architectures break assumptions about when certain devices are on the network and where they should be connecting from, and they dramatically complicate the use of network security controls. First-generation network security tools do not provide adequate visibility to factor in dynamic network topologies or network behavior into security policy definition and enforcement decisions. Clearly, to keep security initiatives aligned with the evolution of corporate technology, enterprises need to embrace a new set of network security capabilities. Advanced Attacks The success of any adversary hinges on its ability to evade the defenses it encounters. Adversaries currently employ a number of techniques that make it difficult to detect and block attacks. Table 1 lists a few of these tactics and explains why it s difficult for first-generation network security devices to handle them. Table 1. Malware Evasion Tactics vs. First-Generation Security Devices Evasion Tactic Inadequacies of First-Generation Devices Port hopping Encapsulation Zero-day attacks Command-and-control (C&C) evasion Malware can randomly select the port used during a session or use multiple ports during an attack. Attackers can embed their attack traffic within an open protocol like port 80 (HTTP) or 443 (SSL). Attackers can use new and randomly changing (polymorphic) malware with no known signature to compromise hosts. Attackers use a variety of techniques (such as Fast Flux) to obscure communications between compromised devices and the controllers of the bot network. First-generation devices base security policy enforcement on the port listed in the network header. The port and allowed behaviors must be defined during policy configuration. If the application randomly selects ports, the security policy can be evaded. It s not possible to build policies for every potential port that can be used by malware. First-generation network security access controls are based on ports and protocols and provide limited precision in policy actions (allow, log, block). If an attack is embedded in port 80, first-generation devices will typically let the traffic through, unless blocking all port 80 traffic is acceptable. First-generation network security devices cannot analyze inbound files or outbound web connections for the indicators of compromise and behaviors associated with targeted attacks. First-generation network security devices do not profile communications traffic, nor do they have the ability to consult a cloud-based reputation service to determine the legitimacy of website communications. Thus these first-generation devices cannot detect when a compromised computer attempts to get instructions from its controller. 2014 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 2 of 9
Evasion Tactic Inadequacies of First-Generation Devices Lateral movement Encrypted traffic Sandbox evasion Once an attacker has presence within an enterprise network, the compromised hosts perform reconnaissance and then attack other hosts to systematically move within an organization towards the ultimate target (usually high-value data). With universal access to SSL encryption in browsers and within the operating system, attackers can encrypt their communication sessions to C&C networks, exfiltration sites, and other attack targets. Attackers test their malware files against sandbox offerings designed to activate the malware in a virtual machine and detect malicious files. Sophisticated malware can become inert if it detects it s running within a virtual machine. First-generation network security devices do not profile internal communications traffic, so these devices can t detect, send an alert on, or block anomalous traffic. A device on the warehouse floor logging in to the finance network or sending large amounts of data to an external website will remain undetected. First-generation devices typically have no capability to decrypt SSL connections, making any encrypted session opaque to the network security device. Thus these devices have no way to examine the payload within the session or to enforce policies on unauthorized activity. First-generation network security devices do not have ability to correlate data with endpoint and cloud intelligence to determine indicators of compromise that can help in an early detection of malware infection. Performance Demands Moore s law continues to hold true: Computers are more powerful, networks are faster, and new applications (like video) consume bandwidth at unprecedented rates. As networks get faster, the need to inspect, and enforce security policies on those networks grows at the same rate. In an age of multigigabit network connections, network security devices must be able to inspect ingress and egress as well as lateral traffic at full connection speeds without dropping traffic or missing attacks. Simultaneously, today s advanced attacks focus on penetrating ever deeper into an organization s network, with the result that inspecting for attack traffic on the network perimeter is no longer sufficient. Thus security policy inspection and enforcement must continue to migrate deeper into the network, even to the core data center, where 10-Gbps connections are commonplace. Traditional network security device architectures are not designed to do deep packet inspection and policy enforcement at these multigigabit network speeds. Whether it s a stateful firewall or a unified threat management (UTM) device that inspects each packet multiple times depending on the policies deployed, a first-generation security device cannot scale to meet the needs of today s networks. This inability is yet another reason that businesses are looking for next-generation network security. Additionally, in a large distributed enterprise, it s critical to enforce a consistent network security policy across all network subsections. Such enforcement requires a central management capability that can transparently support hundreds of devices and easily apply global as well as localized policies. Finally, no enterprise can be aware of all the attacks emerging across the Internet. Thus, enterprises need to rely on a rich cloud-based intelligence capability that can determine whether websites, IP addresses, and files are malicious. Architectural Innovations After more than a decade of protecting networks, many first-generation security appliances are coming to the end of their useful life. The need to replace them provides an opportunity for enterprises to revisit their network security architecture and consider deploying a next-generation device that meets the scalability and effectiveness needs of this new age of computing, where mobility, virtualization, and cloud computing disrupt traditional IT architectures. 2014 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 3 of 9
At the same time, enterprises can revisit the underlying processes used to manage both network security operations and threat management. By consolidating the traditional operations-centric functions (for example, firewall management) on a leading-edge threat management platform, organizations can streamline operational management and centralize security. These changes will reduce complexity and ease the management burden while improving cost efficiency. New security approaches also need to assume that some threats will succeed no matter what the defenses are and that next-generation security must therefore aid in remediation, providing continuous security value before, during, and after an attack. Network Security Buyer s Criteria Selecting a next-generation network security platform is a critical decision because it serves as the foundation for advanced network security capabilities in the future. And given the backdrop of the changing threat landscape discussed above, the importance of network security continues to increase. So let s take a look at some of the key features you should be looking for in a next- generation network security platform. Visibility You can t control what you can t see. So not only do you need to accurately identify the applications active in your environment (regardless of protocol), but you also need to be able to see the myriad of connecting hosts, infrastructures, and users. This visibility enables you to apply the context of network and user behavior to determine the intent of any given connection and decide whether it should be blocked. Table 2 lists the capabilities that provide visibility. Table 2. Visibility s Continuous discovery Discovers hosts and applications on your network on a continuous basis. Visibility extends to client-side operating systems, browsers, virtual environments, and mobile devices. Identifies new devices quickly to eliminate the risks of unmanaged or rogue devices. Defenses can adapt in real time to a rapidly changing environment. Network mapping Maintains a real-time network map of all hosts, applications, users, and other assets in your environment. Gives you the ability to determine vulnerabilities and then prioritize security events according to impact. New devices may dictate a rapid hardening of defenses. IP security intelligence Network activity profiling Determines the reputation of sites and external server connections. Supports custom blacklists and whitelists. Determines how specific users, devices, or applications use network resources. Blocks connections to malicious sites. Controls connections to risky or nonproductive sites that are outside policy. Baseline understanding allows you to determine what is normal activity on your network and to use this baseline to detect attacks. 2014 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 4 of 9
Threat Effectiveness You must make sure your next-generation network security can provide protection for both known and emerging threats while maintaining effectiveness during peak use (see Table 3). Table 3. Threat-Detection s Effective detection Content detection Anomaly detection Uses a variety of means for detection, including signature-based, vulnerability-based, and anomaly-based or any/all to minimize both false positives (a security finding that s flagged as a problem but really isn t), as well as false negatives (a security concern that s often completely overlooked). Detects and reports on the file types traversing your network. Allows policies to block certain file types or monitor their activity. Compares baseline network behavior to actual behavior and highlights activity that is outside a normal tolerance. Helps ensure that attacks are not missed and false alarms are not generated. Detection is evasion free : It cannot be spoofed, and it is very accurate. Controls intellectual property within and outside the organization. Further inspects or controls suspicious file types (for example, it can stop executables in certain network zones or on critical hosts). Provides the ability to pinpoint potential attacks. Detects attacks for which a signature is unknown but whose behavior is suspicious. Granular Controls You want your network security devices to support safe access, not require employees to go around your defenses. This capability requires fine-grained security policies that can customize detection and response for applications and websites (see Table 4). Table 4. Access s Security policy flexibility Support policy exceptions Creates singular, specific policies that incorporate all the security elements that you control, including networks, zones, applications, users, websites, file types, and host access. Allows certain users or groups to have separate policies for certain applications or content. Reduces the attack surface by limiting the number and types of applications and websites that specific users and groups are allowed to use on the network. Facilitates enforcement by centralizing policy generation and management into a common console and set of enforcement points. Provides the ability to support business needs that may require different policies for different classes of users. For example, Facebook chat may not be an authorized generalpurpose application, but some pockets of employees (in marketing, for example) may need to access it. Access control options Support for selective application functions Provides the proper level of security for each application. Options should include allowing the traffic to pass (with or without further inspection), monitoring the connection, and blocking the traffic. Blocking should be flexible: It may allow an outright block, a block with connection reset, or even an interactive block that forces the user to go to a landing page, agree to a policy, and accept liability. Identifies functionality within an application and supports granular policies denoting which application functions are supported on the application or on a specific website. Provides enough access control flexibility that employees will not get frustrated with a security team impeding their work. Reduces the attack surface by supporting an organization s unique tolerance for certain application functions. Finegrained controls allow only certain users to access application functions on a need-to-access basis. Custom rule development Allows customers to develop and tweak rules. Provides the flexibility for organizations to provision the defenses they need to protect critical assets, given that generic policies cannot defend against targeted attacks. Also provides the ability to meet unique compliance requirements. 2014 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 5 of 9
Automation You are likely not getting a lot of additional resources to keep pace with these more advanced adversaries. Thus you need next-generation network security to automate the provisioning and tuning of the security policies and to apply those policies consistently across the enterprise. Table 5 lists important features for automating security policy management. Table 5. Automation s Automated impact assessment Automatic policy optimization and tuning User-identity association Anomalous behavior quarantine Correlates threats against host vulnerability intelligence, network topology, and attack context to reduce the number of actionable security events. Passively profiles the network and recommends new and updated rules for up-to-date protection. Automatically applies new attack signatures to block emerging attacks. Automatically blocks unknown applications. Automatically associates security events to actual users and devices through integration with DHCP and Active Directory resources. Puts users or devices exhibiting behavior far different from the baseline into quarantine on the network, applies deeper threat inspection, or both. Focuses on the most important events. Manually sifting through thousands of security events each day is virtually impossible and will result in legitimate alerts being ignored. Minimizes the amount of effort to optimize the policies for your environment. Keeps protections tuned despite dynamic IT environments (mobile, virtual). Automatically sees which users are being attacked or are violating corporate policy, without having to manually crossreference IP addresses with users. Minimizes manual tuning and makes better use of your under resourced network security team. Rapidly responds to abnormal activity. Advanced Malware Protection Increasingly sophisticated malware attacks make it more difficult to reliably detect malware on the network and to remediate it if it does get through. Without significant cloud-based malware intelligence to share real-time information across your enterprise and with other companies, you are fighting an uphill battle. Additionally, since no effective security controls can live in a vacuum, coordination is required between the defenses on the network, the protections on the endpoint, and the management console tracking threats and remediation activities. Table 6 lists the malware-protection features of next-generation network security. Table 6. Advanced Malware Protection s Inline malware detection and blocking Detects and blocks malware-infected files attempting to enter or traverse the network. Can block known bad files so they don t infect endpoints, unlike out-of-band devices that alert only on inbound malware. Breach detection and blocking Cloud-based malware intelligence Continuous analysis and retrospective alerting Detects and blocks malware-infected files attempting to communicate with C&C servers. Uses a cloud-based repository to provide malware determinations on inbound files and can analyze unknown files in a protected sandbox environment. Generates alerts in the event that the malware determination changes after an initial analysis. Tracks malware that has entered the network; identifies the point of entry, the propagation, the protocols used, and the users and hosts affected. Prevents the downloading of additional hacking utilities (for example, rootkits) and blocks the malware from receiving further instructions. These activities can greatly increase the malware s damage. Bypasses the limits of on-premises equipment. With millions of new malware samples appearing daily, billions of samples must be analyzed to find malware indicators. Finds malware that stays dormant and evades detection during entry into the network. Integration with endpoint protection Shares indicators of compromise and malware determinations on network and endpoint enforcement points. Takes advantage of a common cloud-intelligence capability to provide consistency in enforcement. Provides additional context, remediation, and real-time analysis of endpoint behavior to detect infections and deploy blocking rules at the network layer. Likewise provides protection for endpoint devices when malware is detected upon entry into the network. 2014 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 6 of 9
Performance, Scalability, and Flexibility Given the intense requirements of next-generation network security devices to analyze and apply complex policies at high speeds, their performance and their ability to scale to multigigabit networks are critical buying criteria (see Table 7). Additionally, being able to support whatever deployment model is needed, along with the capability to easily change in the future, provides investment protection in a rapidly evolving market. Table 7. Performance s Optimization for high speeds Next-generation network security device purpose-built for line-rate packet analysis and policy enforcement. Hardware optimized for throughput and accuracy (for example, a single-pass inspection engine). Provides a consistent level of deep packet visibility and threat effectiveness even as network speeds increase and security functions are added. There is no trade-off between line speed and protection. Validated performance Fault tolerance Third-party validation of a next-generation network security device performance under a number of use-case and deployment scenarios. Supports the availability requirements of the networks they protect by means of resilient hardware architectures and architectural support for high-availability deployments. Offers the ability to fail open/ bypass or closed by port, depending on the networks being protected. Consulting third-party testing labs that independently test products, such as NSS Labs, provides assurance that the security solution can handle network volume and provide threat protection for your organization. Helps prevent unplanned downtime related to a network security device. It s reasonable to expect five-nines availability, meaning there are practically zero minutes of unscheduled downtime per calendar year. Universal security architecture Modular network connectivity Supports the software enablement of multiple operating modes through licensing, including a next-generation intrusion prevention system, access and application control, next-generation firewalls, URL filtering, and Advanced Malware Protection on the same device. Supports network connectivity growth in increments and with a mixture of connection speeds across a variety of media interfaces. Allows in-field additions and in-field upgrades as network bandwidth requirements grow. Provides deployment flexibility to run whatever functions are required to meet an organization s security needs today and into the future as those requirements change. Also makes for easier provisioning, sparing, and management of these devices. Offers scalability and flexibility to fit next-generation network security devices into an existing network and supports future growth and protection as requirements may dictate. Minimizes network reconfiguration disruption. 2014 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 7 of 9
Management and Extensibility Managing information risks requires that you know your network and can set and enforce policies across the entire enterprise. Additionally, you must be able to support whatever management model your organization uses. You need to provide the flexibility to support network and security operational convergence, or to keep those as separate functions while maintaining the advantages of a common platform. Finally, you want a next- generation network security platform that supports your existing enterprise security controls and provides a robust ecosystem that accommodates additional capabilities. Table 8 provides a description of next-generation network security management requirements. Table 8. Network Management s Central enterprise security policy Role-based management Integration with existing identity stores Applies a consistent set of policies regardless of enforcement points (appliances, mobile devices, virtual appliances). Provides a hierarchy of user roles to separate network administrators and security managers so that they maintain their respective authorizations. Automatically imports (and updates) changes to users and groups within the enterprise based on integration. Sets one policy and enforces it consistently regardless of where in the enterprise a device resides. Managing multiple policies across firewalls, IPS devices, and malware detection appliances would add administrative complexity. Supports the convergence of next-generation network security devices on a common platform, without affecting management roles and responsibilities. Operational functions are handled with the appropriate operational discipline. Applies security polices to specific employees or groups within the organization, providing flexibility in network security in support of business requirements. Comprehensive management reporting Openness Provide an executive dashboard that displays key information on how the system is working and where things currently stand regarding attacks and threats. Also provides documentation of attacks and controls through a selection of report templates. Reports can be customized as needed. Provides transparency into protection mechanisms, policies, rules, and signatures, along with the ability to edit even those that come out of the box. Encourages an ecosystem of rule developers whose output can be used to provide for the best protection and expediency. Shows trends, as well as event details and statistics, so that administrators can keep the systems appropriately tuned. Documentation assists the incident response process (investigating attacks) and helps meet compliance requirements (substantiating controls). Prevents dependency on a single vendor and affords the ability to tailor protections to unique environments. Third-party solution integration Supports a solution ecosystem through open APIs for thirdparty technologies, including vulnerability management systems, network visualization, security information and event management (SIEM) applications, network access control (NAC), network forensics, event response workflow, and so forth. Simplifies security deployment and planning activities by supporting existing security technologies and sharing intelligence and coordinating responses. 2014 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 8 of 9
Conclusion Disruptive technologies like cloud computing, virtualization, and mobility continue to change the way technology services are provisioned and delivered. Enterprises need to be able to provide a similarly flexible mechanism of protecting key assets from attacks. At the same time, the threats faced by these same organizations have multiplied in number and sophistication. Adversaries today use advanced tactics to obfuscate their attacks, putting a premium on accurate and scalable network security. And when it comes to scalability, the only thing you can count on is that tomorrow s devices and networks will have more capabilities and performance than currently available ones. Given the sophistication of today s attacks, network security capabilities need to keep pace, with line-rate inspection on purpose-built devices. That s the only way to turn the tide against the attackers. This background sets the stage for the next-generation of network security. Overcoming the ports- and protocolsbased limitations of first-generation offerings, next-generation network security provides the precise application control needed to understand and profile proper application behavior and to use that baseline to detect (and block) anomalous activity. In addition, given today s dynamic network infrastructure, full network visibility becomes absolutely critical. You need situational awareness and information superiority to protect the devices and employees you may not even know are there. But all of the granular control and extensive visibility capabilities won t be effective if the next-generation network security devices are not easy to configure and operate. Proper automation allows administrators to prioritize and focus on the most critical alerts and to automatically tune security policies based on what s happening on the network. It s now possible to provision a network security defense that is continuously effective and remains relevant in a changing world. Finally, any next-generation network security platform needs to be enterprise class. That means more than just scaling to the performance and fault-tolerance demands of your environment. It means centrally managing security policies across all enforcement points, supporting a variety of security functions (firewall, IPS, malware detection), and providing an open environment to integrate with existing systems. It s an exciting time for network security professionals, because the platforms that protect the technology infrastructure are evolving quickly. We hope this next-generation security buyer s guide gives you the information you need to be an educated buyer and make the best decision you can for your enterprise. Printed in USA C07-732047-00 07/14 2014 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 9 of 9