Attacks/Breaches

6/3/2008
09:50 AM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Gartner Details Real-Time 'Adaptive' Security Infrastructure

Future security model addresses arrival of multiple perimeters, mobile users

NATIONAL HARBOR, Md. -- Gartner Security Summit 2008 -- What if your network could proactively adapt to threats and the needs of the business? That’s the vision of the adaptive security infrastructure unveiled by Gartner here today.

Neil MacDonald, vice president and fellow at Gartner, says this is the security model necessary to accommodate the emergence of multiple perimeters and moving parts on the network, and increasingly advanced threats targeting enterprises. “We can’t control everything [in the network] anymore,” MacDonald says. That’s why a policy-based security model that is contextual makes sense, he says.

“The next generation data center is adaptive – it will do workloads on the fly,” he says. “It will be service-oriented, virtualized, model-driven and contextual. So security has to be, too.”

Among the key features of an adaptive security infrastructure are security platforms that share and correlate information rather than point solutions, so the heuristics system could communicate its suspicions to the firewall, for example. “Then the firewall could block the IP address” while the signature-based scanner could create a new signature for the threat, MacDonald says.

“Why doesn’t the heuristic system talk to the firewall?” he says. If security modules such as AV and firewalls communicated, they could correlate data on threats. “Then there would be fewer false positives."

Other features would be finer-grained controls, automation (in addition to human intervention), on-demand security services, security as a service, and integration of security and management data. And, rather than adding security to custom applications after they go operational, security models would be created at the design phase of an app, MacDonald says. “Security and operations would have better synergy."

A major change with this model of real-time, adaptive security is shifting authorization management and policy to an on-demand service that contains details and policy enforcement that matches compliance and can adapt to the user’s situation when he or she is trying to access an application, for instance.

MacDonald admits that the reality of an adaptive security infrastructure seems futuristic and faces plenty of challenges in adoption, but there are some of the building blocks available today, such as virtualization, authorization management, and deep packet inspection, for example.

Among the trends driving this vision is the increase in targeted attacks, as well as what Gartner sees as an explosion in the number of perimeters given mobile users, network guests, and business partners, for instance. “Everything has a perimeter,” and all elements in the network today are potentially hostile, he notes.

And it goes both ways, he says. “Expect our stuff to be plugged into some unknown infrastructure” by mobile users, he says. “Does that environment conform to my policies?”

Ted Julian, vice president of marketing for Application Security Inc., says he was intrigued by MacDonald’s adaptive security model and is surprised that no major security vendors are talking about this type of model today. He says scanning tools could possibly play a major role in this type of security infrastructure, and the key would be sharing information among various types of scanners.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

  • Gartner Inc.
  • Application Security Inc.

    Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

    Comment  | 
    Print  | 
    More Insights
  • Comments
    Newest First  |  Oldest First  |  Threaded View
    Crowdsourced vs. Traditional Pen Testing
    Alex Haynes, Chief Information Security Officer, CDL,  3/19/2019
    BEC Scammer Pleads Guilty
    Dark Reading Staff 3/20/2019
    Register for Dark Reading Newsletters
    White Papers
    Video
    Cartoon Contest
    Write a Caption, Win a Starbucks Card! Click Here
    Latest Comment: Well, at least it isn't Mobby Dick!
    Current Issue
    5 Emerging Cyber Threats to Watch for in 2019
    Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
    Flash Poll
    The State of Cyber Security Incident Response
    The State of Cyber Security Incident Response
    Organizations are responding to new threats with new processes for detecting and mitigating them. Here's a look at how the discipline of incident response is evolving.
    Twitter Feed
    Dark Reading - Bug Report
    Bug Report
    Enterprise Vulnerabilities
    From DHS/US-CERT's National Vulnerability Database
    CVE-2019-4035
    PUBLISHED: 2019-03-22
    IBM Content Navigator 3.0CD could allow attackers to direct web traffic to a malicious site. If attackers make a fake IBM Content Navigator site, they can send a link to ICN users to send request to their Edit client directly. Then Edit client will download documents from the fake ICN website. IBM X...
    CVE-2019-4052
    PUBLISHED: 2019-03-22
    IBM API Connect 2018.1 and 2018.4.1.2 apis can be leveraged by unauthenticated users to discover login ids of registered users. IBM X-Force ID: 156544.
    CVE-2019-9648
    PUBLISHED: 2019-03-22
    An issue was discovered in the SFTP Server component in Core FTP 2.0 Build 674. A directory traversal vulnerability exists using the SIZE command along with a \..\..\ substring, allowing an attacker to enumerate file existence based on the returned information.
    CVE-2019-9923
    PUBLISHED: 2019-03-22
    pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers.
    CVE-2019-9924
    PUBLISHED: 2019-03-22
    rbash in Bash before 4.4-beta2 did not prevent the shell user from modifying BASH_CMDS, thus allowing the user to execute any command with the permissions of the shell.