Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Network Security //

IPS

6/14/2018
08:05 AM
Simon Marshall
Simon Marshall
Simon Marshall
50%
50%

IPS: A Key Network Protection in an Age of Increasing Threats

Intrusion prevent systems or IPS have had a checkered history in the enterprise, but increases in malicious activity across business networks have shown the technology can make a big security difference.

Intrusion prevention systems (IPS) have had something of an up-and-down history within enterprise security. Originally not as popular as their intrusion detection cousins, IPS eventually outpaced detection systems, and today's next-generation IPS market is flooded with different vendors, approaches and results.

But behind the shiny storefront, what do enterprises need to know about IPS, what does the technology actually do for security, and why is it sometimes not ideal?

IPS vs. IDS vs. reality
Years ago, many companies were skeptical about IPS, and worried that because the system typically sits inline on the network, false positives would slow all traffic and deny access to users. This was seen in the early 2000s as a greater risk than instead adopting detection systems that flag issues but leave treatment to analysts.

The theory was that humans are better at deciding a course of action, rather than IPS sets of rules which may be correctly or incorrectly applied.

Of course, as the number of vulnerabilities and even more exploits came along, that approach wasn't viable any more as enterprises and their security teams succumbed to alert fatigue and the lack of resources to handle them all. Although still signature-based, IPS was seen as more proactive than mere detection, and the rest is history.

Retail impact
The retail industry is unfortunately full of examples where IPS could have helped, such as details stolen from 5 million credit cards of Saks customers, or the loss of card data from customers of SONIC Drive Thru.

Gary Sprague, director of information security at Rent-A-Center, a national rent-to-purchase consumer goods retailer with over 3,000 stores in 50 states, knows that IPS is a 24x7x365 operation. He's aware of the mistakes other retail organizations have made.

So, although Sprague acknowledges it's a chore to keep IPS signature files up-to-date, along with manual tuning to ensure legitimate traffic is not stopped, he treats customer data very seriously.

"We work to not store information that is most attractive (to hackers). One cannot rest when protecting important data," Sprague told Security Now.

IPS for the cloud
One thing that really gives at least one CEO the willies is the lack of physical access to the perimeter when data is stored or moves through the cloud. That's not surprising because, as a cloud supplier to enterprises, he's responsible for his "half" of that.

"We have to assume that the shared responsibility model is working. AWS and Azure handle the physical side. If we can count on them -- and I believe we can -- then we have to get our arms around virtual entry points," David Levin, CEO of CloudspaceUSA, a firm that provides cloud services to enterprises based in Houston, told SecurityNow.

"There are many (of these) as we have many accounts, public addresses, gateway devices, VPNs, etc. That means we need as much verbose log information on external transitioning traffic as possible," Levin added. "Plus, we need internal traffic details from agents monitoring network traffic, and then a system to boil it all down from our partner Alert Logic, for the SOC and analytics."


Now entering its fifth year, the 2020 Vision Executive Summit is an exclusive meeting of global CSP executives focused on navigating the disruptive forces at work in telecom today. Join us in Lisbon on December 4-6 to meet with fellow experts as we define the future of next-gen communications and how to make it profitable.

Levin makes the point that, with so many existing variables in the cloud environment, one thing he loves is consistency -- meaning limiting the number of weak points in his architectures. He works with a single IPS supplier because to work with more would be an inherent security risk.

"That would introduce varying standards, protocols and other variables… and our designs would have to be more complex which would inherently be less secure," he said.

The bugbear for Levin is that some IPS systems never feel integrated or automated enough for his comfort level, and so there are still some trade-offs. And, as an evident realist, he's clear that security is fundamentally about best effort and practice. Along with the pen tests and security audits you'd expect from this type of company, Levin leans on automation to ensure systems he creates for his customers are designed, built and maintained securely.

So, given his preference to limit the number of moving parts in his security operation, how does he feel about the flood of new technology on the market?<p?

"If a new technology does a better job than an existing system, I want it. Unless I can’t tell whether it does a better job," Levin said.

Related posts:

— Simon Marshall, Technology Journalist, special to Security Now

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/3/2020
'BootHole' Vulnerability Exposes Secure Boot Devices to Attack
Kelly Sheridan, Staff Editor, Dark Reading,  7/29/2020
Average Cost of a Data Breach: $3.86 Million
Jai Vijayan, Contributing Writer,  7/29/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-18112
PUBLISHED: 2020-08-05
Affected versions of Atlassian Fisheye allow remote attackers to view the HTTP password of a repository via an Information Disclosure vulnerability in the logging feature. The affected versions are before version 4.8.3.
CVE-2020-15109
PUBLISHED: 2020-08-04
In solidus before versions 2.8.6, 2.9.6, and 2.10.2, there is an bility to change order address without triggering address validations. This vulnerability allows a malicious customer to craft request data with parameters that allow changing the address of the current order without changing the shipm...
CVE-2020-16847
PUBLISHED: 2020-08-04
Extreme Analytics in Extreme Management Center before 8.5.0.169 allows unauthenticated reflected XSS via a parameter in a GET request, aka CFD-4887.
CVE-2020-15135
PUBLISHED: 2020-08-04
save-server (npm package) before version 1.05 is affected by a CSRF vulnerability, as there is no CSRF mitigation (Tokens etc.). The fix introduced in version version 1.05 unintentionally breaks uploading so version v1.0.7 is the fixed version. This is patched by implementing Double submit. The CSRF...
CVE-2020-13522
PUBLISHED: 2020-08-04
An exploitable arbitrary file delete vulnerability exists in SoftPerfect RAM Disk 4.1 spvve.sys driver. A specially crafted I/O request packet (IRP) can allow an unprivileged user to delete any file on the filesystem. An attacker can send a malicious IRP to trigger this vulnerability.