Attacks/Breaches

6/3/2008
09:50 AM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Gartner Details Real-Time 'Adaptive' Security Infrastructure

Future security model addresses arrival of multiple perimeters, mobile users

NATIONAL HARBOR, Md. -- Gartner Security Summit 2008 -- What if your network could proactively adapt to threats and the needs of the business? That’s the vision of the adaptive security infrastructure unveiled by Gartner here today.

Neil MacDonald, vice president and fellow at Gartner, says this is the security model necessary to accommodate the emergence of multiple perimeters and moving parts on the network, and increasingly advanced threats targeting enterprises. “We can’t control everything [in the network] anymore,” MacDonald says. That’s why a policy-based security model that is contextual makes sense, he says.

“The next generation data center is adaptive – it will do workloads on the fly,” he says. “It will be service-oriented, virtualized, model-driven and contextual. So security has to be, too.”

Among the key features of an adaptive security infrastructure are security platforms that share and correlate information rather than point solutions, so the heuristics system could communicate its suspicions to the firewall, for example. “Then the firewall could block the IP address” while the signature-based scanner could create a new signature for the threat, MacDonald says.

“Why doesn’t the heuristic system talk to the firewall?” he says. If security modules such as AV and firewalls communicated, they could correlate data on threats. “Then there would be fewer false positives."

Other features would be finer-grained controls, automation (in addition to human intervention), on-demand security services, security as a service, and integration of security and management data. And, rather than adding security to custom applications after they go operational, security models would be created at the design phase of an app, MacDonald says. “Security and operations would have better synergy."

A major change with this model of real-time, adaptive security is shifting authorization management and policy to an on-demand service that contains details and policy enforcement that matches compliance and can adapt to the user’s situation when he or she is trying to access an application, for instance.

MacDonald admits that the reality of an adaptive security infrastructure seems futuristic and faces plenty of challenges in adoption, but there are some of the building blocks available today, such as virtualization, authorization management, and deep packet inspection, for example.

Among the trends driving this vision is the increase in targeted attacks, as well as what Gartner sees as an explosion in the number of perimeters given mobile users, network guests, and business partners, for instance. “Everything has a perimeter,” and all elements in the network today are potentially hostile, he notes.

And it goes both ways, he says. “Expect our stuff to be plugged into some unknown infrastructure” by mobile users, he says. “Does that environment conform to my policies?”

Ted Julian, vice president of marketing for Application Security Inc., says he was intrigued by MacDonald’s adaptive security model and is surprised that no major security vendors are talking about this type of model today. He says scanning tools could possibly play a major role in this type of security infrastructure, and the key would be sharing information among various types of scanners.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

  • Gartner Inc.
  • Application Security Inc.

    Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

    Comment  | 
    Print  | 
    More Insights
  • Comments
    Newest First  |  Oldest First  |  Threaded View
    12 Free, Ready-to-Use Security Tools
    Steve Zurier, Freelance Writer,  10/12/2018
    Most IT Security Pros Want to Change Jobs
    Dark Reading Staff 10/12/2018
    6 Security Trends for 2018/2019
    Curtis Franklin Jr., Senior Editor at Dark Reading,  10/15/2018
    Register for Dark Reading Newsletters
    White Papers
    Video
    Cartoon Contest
    Write a Caption, Win a Starbucks Card! Click Here
    Latest Comment: This comment is waiting for review by our moderators.
    Current Issue
    Flash Poll
    The Risk Management Struggle
    The Risk Management Struggle
    The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
    Twitter Feed
    Dark Reading - Bug Report
    Bug Report
    Enterprise Vulnerabilities
    From DHS/US-CERT's National Vulnerability Database
    CVE-2018-10839
    PUBLISHED: 2018-10-16
    Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user inside guest could use this flaw to crash the Qemu process resulting in DoS.
    CVE-2018-13399
    PUBLISHED: 2018-10-16
    The Microsoft Windows Installer for Atlassian Fisheye and Crucible before version 4.6.1 allows local attackers to escalate privileges because of weak permissions on the installation directory.
    CVE-2018-18381
    PUBLISHED: 2018-10-16
    Z-BlogPHP 1.5.2.1935 (Zero) has a stored XSS Vulnerability in zb_system/function/c_system_admin.php via the Content-Type header during the uploading of image attachments.
    CVE-2018-18382
    PUBLISHED: 2018-10-16
    Advanced HRM 1.6 allows Remote Code Execution via PHP code in a .php file to the user/update-user-avatar URI, which can be accessed through an "Update Profile" "Change Picture" (aka user/edit-profile) action.
    CVE-2018-18374
    PUBLISHED: 2018-10-16
    XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter.