Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

8/22/2019
02:00 PM
Rik Turner
Rik Turner
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
50%
50%

Threat Intelligence Gateways: A Useful Adjunct to Overworked Perimeter Security

Comparative research shows the relative strengths and weaknesses of five TIG vendors and which kinds of security organization will reap the most benefit.

It's fashionable to say that in the age of cloud and teleworking, the network perimeter is no more. That with applications residing in cloud environments and employees, partners, and contractors logging in to work from just about anywhere, the old notion of a "castle-and-moat" defensive barrier around corporate assets is a thing of the past.

Well, the situation has certainly changed quite a bit, but the success of next-generation firewall (NGFW) vendors shows that there is still a lot of investment in good old edge security, i.e. technology deployed on the real, or increasingly on the theoretical edge of a network to keep bad guys and malicious stuff out.

Now, with estimates to suggest that enterprise IT systems are attacked every 39 seconds, or around 2,500 times per day, it is clear that whatever security measures we have in place to keep out attackers are under considerable pressure. Those will often include a firewall and, particularly, if it is of the aforementioned next-generation variety, it will come with a lot of compute power on board to inspect all incoming traffic in a stateful manner, all the way to the application layer (7 in the OSI model).

Enter the TIG
But what if we could lighten that burden by proactively blocking what we know to be bad before it even gets to the NGFW? Enter the threat intelligence gateway (TIG), a class of security tool that has emerged in recent years to do just this. TIGs are stateless devices deployed between a corporate router and an NGFW, effectively blocking the known bad, based on a prior knowledge of malicious URLs and compromised IP addresses, before the traffic ever gets to the firewall. This reduces the traffic to the firewall and enables the firewall to focus its CPU cycles on inspecting for the more complex and subtler attack types that warrant attention.

Where does that prior knowledge come from, and how trustworthy and up to date will it be when we get it? Clearly, this is outside the purview of the TIG itself, speaking instead to the kinds of threat intelligence enterprise customers are now commonly ingesting to inform their security decision-making. In a recent report, Ovum looked at the offerings of five of the most representative TIG vendors, and it is no coincidence that a number of them spoke of TIG's ability to integrate with threat intelligence platforms, or TIPs, a very similar acronym describing technology that ingests, aggregates, and normalizes threat feeds from commercial and open source providers, often enhancing it with a customer's own threat data.

The vendors and products we looked at were:

  • Bandura Cyber: Bandura TIG
  • Centripetal: RuleGATE
  • Ixia: TheatARMOR
  • LookingGlass: scoutSHIELD
  • Netscout: Arbor Edge Defense

Of this group, Ixia and Netscout have the longest pedigrees in the industry, with Ixia being a major name in security testing and Netscout a network monitoring/service assurance vendor that expanded into security with its 2015 acquisition of Arbor Networks. Interestingly, only LookingGlass has both a TIG and a TIP in its portfolio, though clearly all the TIGs can integrate with third-party TIPs.

As a later entrant into the market, Netscout has sought to differentiate its offering by highlighting its ability to inspect both inbound and outbound traffic, enabling it to block data exfiltration attempts or simply employee errors, and making it both a first and last line of defense, as it were. Since then, the other vendors have also begun expounding their outbound credentials too.

Who Benefits?
To some extent, a TIG can be thought of as an instantiation in software, and sometimes with some dedicated hardware in support, of the black- and whitelists that have helped web and content filtering devices decide what to block for many years. More dynamically, however, their integrations with TIPs make it possible to make threat intel actionable, since TIPs are data processing platforms while TIGs are enforcement devices.

That said, they are clearly not for everyone. It was Ovum's conclusion that TIGs can be a useful a useful additional to the arsenal of defensive tools employed by an enterprise, and particularly one that is in threat actors' crosshairs, such as in the financial sector, healthcare, or the defense sector.

If you are already taking a threat feed or two and are reasonably happy with their accuracy and timeliness, applying them in a TIG for enforcement purposes may be a quick and easy win, in terms of reducing the burden on both your firewall estate and your security staffers.

Ovum is less certain that TIGs are appropriate for smaller or even midsize companies. While they hold the promise of automating away some of the blocking activity from your firewall and your security team, you should at least have a security team large enough to manage the TIG, periodically checking on the accuracy of the threat intel it is receiving and reviewing a list of what has been blocked to keep false positives at a minimum. If you don't have someone to do that, the only way to use a TIG would be via a service provider and, as yet, such services are not available.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "You Gotta Reach 'Em to Teach 'Em.

Rik is a principal analyst in Omdia's IT security and technology team, specializing in cybersecurity technology trends, IT security, compliance, and call recording.  He provides analysis and insight on market evolution and helps end users determine what type of ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Overcoming the Challenge of Shorter Certificate Lifespans
Mike Cooper, Founder & CEO of Revocent,  10/15/2020
US Counterintelligence Director & Fmr. Europol Leader Talk Election Security
Kelly Sheridan, Staff Editor, Dark Reading,  10/16/2020
7 Tips for Choosing Security Metrics That Matter
Ericka Chickowski, Contributing Writer,  10/19/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-5790
PUBLISHED: 2020-10-20
Cross-site request forgery in Nagios XI 5.7.3 allows a remote attacker to perform sensitive application actions by tricking legitimate users into clicking a crafted link.
CVE-2020-5791
PUBLISHED: 2020-10-20
Improper neutralization of special elements used in an OS command in Nagios XI 5.7.3 allows a remote, authenticated admin user to execute operating system commands with the privileges of the apache user.
CVE-2020-5792
PUBLISHED: 2020-10-20
Improper neutralization of argument delimiters in a command in Nagios XI 5.7.3 allows a remote, authenticated admin user to write to arbitrary files and ultimately execute code with the privileges of the apache user.
CVE-2020-25157
PUBLISHED: 2020-10-20
The R-SeeNet webpage (1.5.1 through 2.4.10) suffers from SQL injection, which allows a remote attacker to invoke queries on the database and retrieve sensitive information.
CVE-2020-25648
PUBLISHED: 2020-10-20
A flaw was found in the way NSS handled CCS (ChangeCipherSpec) messages in TLS 1.3. This flaw allows a remote attacker to send multiple CCS messages, causing a denial of service for servers compiled with the NSS library. The highest threat from this vulnerability is to system availability. This flaw...