Centrally Managed Network Security: Hope or Reality?
by Dan Thomsen - Secure Computing Corporation - Friday, 18 April 2003.
Ask any IT professional to predict the future of computer networking and you will get different answers. Guessing the future of technology has always been a dicey business at best. Planning ahead for the next set of security threats and building security solutions that are not vulnerable to these threats is even more difficult, because building network technology is, on the face of it a purposeful design process, whereas security threats are typically exploitations of sloppy engineering or cleverly threading together unintended uses for software. Future security threats and vulnerabilities are not something that is easy or even possible to anticipate.

The best hope for a security solution that protects enterprise-wide networks while allowing for centralized management is the emergence of standards. Security standards like DCE, Kerberos, SAML, elements of IPv6 and others continue to be the Holy Grail for which we wait. However, the wait continues after decades with little hope for a standards-based security solution in the immediate term. Why wait for a new standard when an existing standard will do.

Letís take a look at some of the security issues facing the IT professional and see what management problems they have in common:
  • All data, including passwords, flows in the clear over most networks
  • The insider threat is on the rise
  • Wireless networking means networking is not restricted to wires any more
In todayís computer architectures, all data flows over the network. If the data stream is watched long enough, some juicy tidbits are sure to turn up. Password sniffing, watching the network stream for unencrypted passwords, is the most obvious example. Unfortunately, it is just the tip of the iceberg. Uncontrolled access to all network traffic ensures sensitive data will eventually be compromised. Access to the network stream must be limited to only the data bound for the host.

Another huge security problem that has been mainly ignored, because it is hard to solve, is the insider threat. An insider can abuse their privilege to collect sensitive data for the fun and profit of the individual, with no regard for the organization. The insider threat has always been much greater than the hacker threat, but mild-mannered, trusted employees stealing data is not headline material like a thirteen year old hacking the Pentagon. In reality, the disgruntled employee has more motivation and more access to sensitive data than any outsider. The network must not turn into an enabling technology for the disgruntled employee to compromise data or have access to data beyond that with which they are trusted.

Today, wireless networks are common place, sending and receiving data packets within corporate meeting rooms, office bays and yes, even beaches. With the expanded network perimeter, it is even more important that each packet coming in be authenticated to make sure it is coming from a valid user. Additionally, each packet going out must be checked to ensure sensitive data is not being broadcast to allow just anyone to pickup.

One way to solve all three of these problems is to control the data packets going in and out of each host. If each host only looks at the packets bound for it, the password sniffing problem is solved. If users are only allowed to access the hosts they need to do their job, they are limited to only the data with which they are trusted. As result, as much as possible, insider threat protection is gained. Finally, if each packet is checked going in and out of a host, the wireless hub would never see sensitive packets, and outsider packets entering via the wireless hub would be read only by the intended host.


Harnessing artificial intelligence to build an army of virtual analysts

PatternEx, a startup that gathered a team of AI researcher from MIT CSAIL as well as security and distributed systems experts, is poised to shake up things in the user and entity behavior analytics market.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.

Tue, Feb 9th