02:03 PM
Connect Directly

Is The Perimeter Really Dead?

Despite naysayers, many security experts believe perimeter defenses have relevance when deployed as a part of defense-in-depth

Even while mobile, cloud, and software services are blurring the lines of corporate IT boundaries through deperimeterization, enterprises still continue to spend increasing amounts of security budget on perimeter protection. The question is, are they wasting their money? It's one of the most contentious questions in security -- perhaps only behind the one about the usefulness of antivirus. So it is no surprise that the answers are varied.

Hardliners, of course, have been hammering on the death of the perimeter for a long time now.

"Perimeter security is no longer relevant to enterprises. With the mobilization of the workforce, it's very hard to define the perimeter of any organization because mobile-enabled employees are connecting to the network from all over the world on devices of their choosing," says Thevi Sundaralingam, vice president of product management at Accellion. "Next-gen security needs to focus keeping content safe, not on defining a network perimeter."

Then there are the cynical abandoners.

[Is IPS in it for the long haul? See The Future of IPS.]

"In my opinion, perimeter security is not dead -- it just has been handled incorrectly for so long people are giving up," says Alex Chaveriat, a consultant at SystemExpert, of this crowd.

But others believe perimeter protection still has plenty of relevance for enterprise IT, even if it means rethinking the role of the perimeter and how these defenses are deployed.

"The perimeter will never die, it will just get more focused," says Corey Nachreiner, director of security strategy for WatchGuard. "Sure, our workforce is getter more mobile, which means we need to incorporate new security solutions. But let's not fool ourselves. The perimeter will never go away."

Instead, he says, it will focus on server infrastructure and data centers, rather than endpoint users. As he puts it, the industry will eventually realize that it will always have to operate in a hybrid environment. That means recognizing the need for additional security innovations bolstering perimeter security rather than replacing it.

"Just because people are using mobile devices and cloud services doesn't mean they won't still have local servers and assets behind a relatively static perimeter," Nachreiner says.

Additionally, organizations need to maintain perimeter defenses not just for the traditional ingress monitoring, but also for egress visibility -- crucial to pinpoint large-scale breaches.

"Ultimately, the bad guys need to pass through the perimeter in order to complete the exfiltration of the data they are trying to steal," says says Michael Patterson, CEO of Plixer International. "Monitoring behaviors is playing a significant role in this area as is the reputation of the site being connected to. "

Patterson also explains that perimeter defense doesn't necessarily have to be placed as a border wall defense at the edge -- in fact, it may have more relevance inside the network as organizations monitor and block threats as they try to move laterally within the organization. It's for this reason that Mike Lloyd, CTO of RedSeal Networks, says that rather than dying, the perimeter has actually grown in recent years.

"Think of the brooms versus Mickey Mouse as the Sorcerer's Apprentice. Companies have more and more perimeters that are getting smaller and smaller," he says. "Regulation drives it: PCI demands internal "zones" of segregation. BYOD drives it: Once you let zany uncontrolled endpoint devices onto your network, you have to build zones to keep them away from internal assets. Security drives it: We've talked about defense in-depth for years, but people are finally doing it."

As a result, Lloyd says, security practitioners have more opportunities for controls. This, though, can be a blessing and a curse.

"The downside is complexity, more controls in more places," he says. "The aspirin for that headache is automation. Make sure that all the enclaves you designed are actually set up and maintained properly as change happens."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Apprentice
9/17/2013 | 3:37:51 PM
re: Is The Perimeter Really Dead?
The perimeter is not dead. It evolved and and companies have not assessed the risks accordingly. Allowing VPNs from non-company controlled devices and high bandwidth cell phones changed the perimeter from a few choke points to the Internet to many devices that the company does not have direct control over. Most companies have not acknowledged this and thus accepted the risks involved in this to their detriment. There are technologies and corporate policies that will help mitigate these risks; but, companies believe that they are too expensive or time consuming to implement. The current primary attack vector I'm seeing is phishing or web page based attacks. The BYOD attacks are a little harder to implement, but gaining popularity quickly. BYOD is harder to detect and remove so there is no doubt that criminals will migrate in this direction. I think that the key here is to no longer think about a firewall cluster as the perimeter. It has become a wide path and needs to be treated accordingly.

Jeff Jones
Abacus Solutions
User Rank: Apprentice
9/17/2013 | 10:21:02 AM
re: Is The Perimeter Really Dead?
Organizations must accept the fact that the perimeter is relatively porous. Systems have been put in place to create efficiencies and walling them off is not the answer. The best answer would seem to be a combination of perimeter defense (like the home security sign on your house) and an ability to monitor activity inside the perimeter. In today's world of mandatory open access that would be the only way to cope.
User Rank: Apprentice
9/16/2013 | 6:53:04 PM
re: Is The Perimeter Really Dead?
It's sort of amazing how long this debate has been going on. Lloyd's argument makes a lot of sense.
The Case for Integrating Physical Security & Cybersecurity
Paul Kurtz, CEO & Cofounder, TruSTAR Technology,  3/20/2018
A Look at Cybercrime's Banal Nature
Curtis Franklin Jr., Senior Editor at Dark Reading,  3/20/2018
City of Atlanta Hit with Ransomware Attack
Dark Reading Staff 3/23/2018
Register for Dark Reading Newsletters
White Papers
Current Issue
How to Cope with the IT Security Skills Shortage
Most enterprises don't have all the in-house skills they need to meet the rising threat from online attackers. Here are some tips on ways to beat the shortage.
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.