Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

9/16/2013
02:03 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Is The Perimeter Really Dead?

Despite naysayers, many security experts believe perimeter defenses have relevance when deployed as a part of defense-in-depth

Even while mobile, cloud, and software services are blurring the lines of corporate IT boundaries through deperimeterization, enterprises still continue to spend increasing amounts of security budget on perimeter protection. The question is, are they wasting their money? It's one of the most contentious questions in security -- perhaps only behind the one about the usefulness of antivirus. So it is no surprise that the answers are varied.

Hardliners, of course, have been hammering on the death of the perimeter for a long time now.

"Perimeter security is no longer relevant to enterprises. With the mobilization of the workforce, it's very hard to define the perimeter of any organization because mobile-enabled employees are connecting to the network from all over the world on devices of their choosing," says Thevi Sundaralingam, vice president of product management at Accellion. "Next-gen security needs to focus keeping content safe, not on defining a network perimeter."

Then there are the cynical abandoners.

[Is IPS in it for the long haul? See The Future of IPS.]

"In my opinion, perimeter security is not dead -- it just has been handled incorrectly for so long people are giving up," says Alex Chaveriat, a consultant at SystemExpert, of this crowd.

But others believe perimeter protection still has plenty of relevance for enterprise IT, even if it means rethinking the role of the perimeter and how these defenses are deployed.

"The perimeter will never die, it will just get more focused," says Corey Nachreiner, director of security strategy for WatchGuard. "Sure, our workforce is getter more mobile, which means we need to incorporate new security solutions. But let's not fool ourselves. The perimeter will never go away."

Instead, he says, it will focus on server infrastructure and data centers, rather than endpoint users. As he puts it, the industry will eventually realize that it will always have to operate in a hybrid environment. That means recognizing the need for additional security innovations bolstering perimeter security rather than replacing it.

"Just because people are using mobile devices and cloud services doesn't mean they won't still have local servers and assets behind a relatively static perimeter," Nachreiner says.

Additionally, organizations need to maintain perimeter defenses not just for the traditional ingress monitoring, but also for egress visibility -- crucial to pinpoint large-scale breaches.

"Ultimately, the bad guys need to pass through the perimeter in order to complete the exfiltration of the data they are trying to steal," says says Michael Patterson, CEO of Plixer International. "Monitoring behaviors is playing a significant role in this area as is the reputation of the site being connected to. "

Patterson also explains that perimeter defense doesn't necessarily have to be placed as a border wall defense at the edge -- in fact, it may have more relevance inside the network as organizations monitor and block threats as they try to move laterally within the organization. It's for this reason that Mike Lloyd, CTO of RedSeal Networks, says that rather than dying, the perimeter has actually grown in recent years.

"Think of the brooms versus Mickey Mouse as the Sorcerer's Apprentice. Companies have more and more perimeters that are getting smaller and smaller," he says. "Regulation drives it: PCI demands internal "zones" of segregation. BYOD drives it: Once you let zany uncontrolled endpoint devices onto your network, you have to build zones to keep them away from internal assets. Security drives it: We've talked about defense in-depth for years, but people are finally doing it."

As a result, Lloyd says, security practitioners have more opportunities for controls. This, though, can be a blessing and a curse.

"The downside is complexity, more controls in more places," he says. "The aspirin for that headache is automation. Make sure that all the enclaves you designed are actually set up and maintained properly as change happens."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
AccessServices
50%
50%
AccessServices,
User Rank: Apprentice
9/17/2013 | 3:37:51 PM
re: Is The Perimeter Really Dead?
The perimeter is not dead. It evolved and and companies have not assessed the risks accordingly. Allowing VPNs from non-company controlled devices and high bandwidth cell phones changed the perimeter from a few choke points to the Internet to many devices that the company does not have direct control over. Most companies have not acknowledged this and thus accepted the risks involved in this to their detriment. There are technologies and corporate policies that will help mitigate these risks; but, companies believe that they are too expensive or time consuming to implement. The current primary attack vector I'm seeing is phishing or web page based attacks. The BYOD attacks are a little harder to implement, but gaining popularity quickly. BYOD is harder to detect and remove so there is no doubt that criminals will migrate in this direction. I think that the key here is to no longer think about a firewall cluster as the perimeter. It has become a wide path and needs to be treated accordingly.

Jeff Jones
Abacus Solutions
douglasmow
50%
50%
douglasmow,
User Rank: Apprentice
9/17/2013 | 10:21:02 AM
re: Is The Perimeter Really Dead?
Organizations must accept the fact that the perimeter is relatively porous. Systems have been put in place to create efficiencies and walling them off is not the answer. The best answer would seem to be a combination of perimeter defense (like the home security sign on your house) and an ability to monitor activity inside the perimeter. In today's world of mandatory open access that would be the only way to cope.
MarciaNWC
50%
50%
MarciaNWC,
User Rank: Apprentice
9/16/2013 | 6:53:04 PM
re: Is The Perimeter Really Dead?
It's sort of amazing how long this debate has been going on. Lloyd's argument makes a lot of sense.
7 Tips for Choosing Security Metrics That Matter
Ericka Chickowski, Contributing Writer,  10/19/2020
IoT Vulnerability Disclosure Platform Launched
Dark Reading Staff 10/19/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15270
PUBLISHED: 2020-10-22
Parse Server (npm package parse-server) broadcasts events to all clients without checking if the session token is valid. This allows clients with expired sessions to still receive subscription objects. It is not possible to create subscription objects with invalid session tokens. The issue is not pa...
CVE-2018-21266
PUBLISHED: 2020-10-22
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none.
CVE-2018-21267
PUBLISHED: 2020-10-22
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none.
CVE-2020-27673
PUBLISHED: 2020-10-22
An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x. Guest OS users can cause a denial of service (host OS hang) via a high rate of events to dom0, aka CID-e99502f76271.
CVE-2020-27674
PUBLISHED: 2020-10-22
An issue was discovered in Xen through 4.14.x allowing x86 PV guest OS users to gain guest OS privileges by modifying kernel memory contents, because invalidation of TLB entries is mishandled during use of an INVLPG-like attack technique.