Service Provider Security Solutions

1
Service Provider Security Solutions

• NetEvents 2008 - Asia-Pacific Service Provider
  VIP Summit
• May 28th 29th, 2008 Langkawi Malaysia

2
Agenda

• Modern Threat Landscape
• IPS for the Modern Threat Landscape
• Service Provider IPS Deployments

3
Modern Threat Landscape
Critical Infrastructure Attacks
Network/Server Downtime Attacks
Financially Motivated Attacks
The troubled past is it really behind us?
How easy is it to penetrate your critical
applications and steal data?

• Cyber warfare
• National, state, local infrastructure
• Politically motivated attacks

Outsourced or sub-contracted firm
Amateur Hacker / Criminal
Organized Crime
Terrorist, Political Activist
Rival Corporation
Angry / unethical employee or contactor
Unethical advertisers
4
Modern Threat Landscape

• Clear trend toward application vulnerability
  attacks
• 2/3 of all new vulnerabilities are in web
  applications

5
Monitoring the Attack LandscapeTippingPoint
Lighthouses

• Timely and thorough security data
• Provides data on all traffic, not just specific
  ports or types

Austin, TX
6
Asia AttacksLighthouse Data Sample
China Specific 31 million attacks Jan. 1 Apr.
30, 2008
Source DVLabs Lighthouse Program
6
6
7
The Troubled Past Still Haunts Networks
Network / Server Downtime Attacks

• Slammer Worm 2008

7
7
8
Financially Motivated AttacksPrevalence of Web
Vulnerabilities

• Web application vulnerabilities
• 2/3 of all discovered application vulnerabilities
• 80 come from PHP File Include, XSS, and SQL
  Injection attacks

Financially Motivated Attacks
3 attack types make up 80 of application
vulnerabilities
8
9
Financially Motivated Attacks Website Compromise
A piece of cake
Financially Motivated Attacks

• Hundreds of PHP File Include vulnerabilities
  discovered every month
• Most widely attacked vulnerabilities in 2006 and
  2007
• Many are 0-day attacks

9
10
Financially Motivated Attacks70,000 Web Sites
Compromised via SQL Injection
Financially Motivated Attacks

• Injections, including java script, redirected end
  users to a rogue site
• Rogue site tried to exploit vulnerabilities to
  install key-logging
• Key-logger stole passwords for various online
  games

10
11
Financially Motivated Attacks Web site
Compromised Phishing
Financially Motivated Attacks
11
12
Critical Infrastructure AttacksPolitical DDoS
Attacks
Critical Infrastructure Attacks
Estonia came under intense electronic attacks
on April 27, jamming up commercial and government
Web sites. DDOS Attacks
13
Impact Growing Security Gap

• Rate of new vulnerabilities
• Number of attacks and attackers
• Financially motivated attacks
• Number of end points
• Number of applications

• Cannot Keep Up Unless You Automate
• Not just at network perimeter
• But also major interior production network points

14
IPS SolutionsAutomated, Real-Time Network
Security
State-of-the-art Intrusion Prevention
Systems that protect enterprise networks

• Purpose-Built Hardware
• Reliability Availability
• Multi-Gigabit Throughput
• Very low Latency
• Leading Security Research
• Filter Accuracy, Coverage Timeliness

Automatic Protection

• Applications
• Operating Systems
• Network Infrastructure
• Clients, Servers
• VoIP Infrastructure

Intelligence Updates Digital Vaccine
15
10Gbps IPS Solutions
Core Controller

• 10Gbps inspection
• High availability
• High performance with low latency
• Easy to manage
• Scalable

16
IPS in the Enterprise Network
Protect Web Apps Servers
DMZ
Office LAN
Aggregation
Access
Access Switch
Protect WAN Perimeter
Distribution Switch
Web Servers
Data Center
Core
Wireless Campus
Access Switch
Protect Major Zones
Protect Remote Offices
Remote Office
Distribution Switch
VPN Concentrator
Protect Apps, Servers Data
Windows
Linux Blades
Protect Core Network
Shared Storage
Shared Tape
10Mbps 1Gbps
1Gbps 10Gbps
nx1Gbps nx10Gbps
17
IPS in a Service Provider Network
18
Summary
Automated Attack Blocking for Service Providers

• Automated attack blocking is the only way to keep
  up with
• Network / server downtime attacks
• Financially motivated attacks
• Critical infrastructure attacks
• To automate, you must go in-line
• Key criteria for in-line IPS solutions
• Cannot take the network down High Availability
• Cannot slow down application traffic
  Performance with Low Latency
• Cannot block legitimate traffic Filter Accuracy
• These points are even more critical in 10Gbps
  production networks

19
Thank You