01-09-2012, 01:44 PM
Study Of Recent Trends In Network Security
Study Of Recent Trends.docx (Size: 70.54 KB / Downloads: 41)
Introduction:
This is an effort to chronicle what a number of really smart people believe the state of the information security industry to be, and where we are going. A lot of the emphasis is on security threats, but we also consider what is working and what good practice is. We hope you will be able to use this in your strategic planning and also as input for your security architecture.
Who needs network security? Why don't we just build encryption and antimalware protection into end-points and simply enjoy open networks? From a security perspective that's always best and it's in line with the Jericho Forum vision. But in the real world it's not so simple. At the very least we need protective measures in networks to guarantee availability and performance. Beyond that there is huge potential to deliver value through security features in networks.
In fact there has always been more to network security than users realize. Fallback, monitoring and filtering are ever-present but invisible to endpoints. Many application owners believe their systems operate on top of a pure IP infrastructure, but nothing could be further from the truth -- enterprise networks are heavily structured.
Today's network products boast an impressive and growing array of single-point security solutions, ranging from simple authentication mechanisms to full-blown identity management.
Taking advantage of network-based security features is difficult in that geography and topology are major factors. They dictate ownership boundaries and legal jurisdictions and it's hard to establish a set of choke points from which all network traffic can be monitored or controlled.
Motivation
The Google and Heartland attacks have highlighted the need for something more than traditional black-list approaches to malware. We will start to see more security vendors committing to application white-listing approaches and more customers realizing anything other the than the traditional black-list approaches is "hard." If your security posture can be bypassed with custom malware you are probably already compromised.
Cory Ramsden suggests we will see grid worms – malware targeted at poorly secured smart meters and meant to cause widespread disruption. He also points out geolocation could result in location-aware malware. Imagine a program that was smart enough to not take any action unless it was within a certain geographic area, say within a government building. Once it knew it was inside the building it could propagate over a wireless connection to poorly secured access points, take pictures, infect other handheld devices, send contact information, etc.
Conclusion:
Enterprise connectivity is exploding, driven by globalization, convergence, virtualization and social computing. As corporate perimeters dissolve, the security focus switches towards application and data-level security solutions. The question to ask is what are the longer-term implications for network security? Will it become redundant or could it grow more powerful? Only one thing seems certain: It will be different from today.
Management domains don't map neatly onto the precise scope of application systems and legacy equipment presents local incompatibilities. Nevertheless, gateway devices are a convenient point for securing central databases. And complete network coverage is not always essential for value to be derived from security analysis because useful intelligence can be derived from samples of traffic.
There are also distinct advantages in locating security measures inside networks. You gain a richer picture of user behavior, enabling individual user activities to be assessed in the context of a broader community. In fact, visibility of events and understanding of context are the keys to effective security and risk management.