Business Productivity and Automated Security Controls
•Download as PPTX, PDF•
1 like•472 views
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Viewers also liked
Similar to Business Productivity and Automated Security Controls
Similar to Business Productivity and Automated Security Controls (20)
Recently uploaded
Recently uploaded (20)
Business Productivity and Automated Security Controls
- 1. Optimizing Business Productivity Through Automated Security Controls Heather Axworthy Network Security Engineer haxworthy@gmail.com 1 © 2010 Heather L. Axworthy
- 2. Bio Ten Years Experience In Networks And Security Secured Many Sensitive And Strategic Networks For Fortune 50 Companies Sr. Security Engineer Worked On Multiple IDS/IPS And Security Platforms Really Good Cook, Tried Flying A Helicopter, And Love To Hike Blog Http://Chickbits.Blogspot.Com Linkedin: Http://Www.Linkedin.Com/In/Heatheraxworthy Twitter: Haxworthy 2 © 2010 Heather L. Axworthy
- 3. Agenda 3 © 2010 Heather L. Axworthy
- 4. © 2010 Heather L. Axworthy 4 Response Detection Prevention Security Continuum IDS & Desktop People IPS
- 5. Security Continuum © 2010 Heather L. Axworthy 5
- 6. Security Assets © 2010 Heather L. Axworthy 6
- 7. © 2010 Heather L. Axworthy 7 Internet Traffic Composition of Threat Response
- 8. Composition of Threat Response:Computers, IT, and Users Security Involves Variable HumanInteraction Perimeter Security Block Malicious Traffic From Entering The Network. IPS Provides Active Blocking & Minimizes User Involvement, Reducing Response Urgency I.T. Employees Involved With Deployment And Maintenance Intrusion Detection (IDS) Alerts I.T. To Malicious Traffic But Does Not Prevent It From Penetrating The Network. IDS Requires Higher IT Employee Interaction To React To Alerts. Desktop Security Controls Involve The Highest Participation From Users. © 2010 Heather L. Axworthy 8
- 9. Single Security-Strategy Risks © 2010 Heather L. Axworthy 9
- 11. Different Security Methods Are Not Equal
- 12. Each Provides Different Levels Of Protection
- 13. If You Deploy One Technology, It’s Best To Have A Proactive Technology Like IPS At The Perimeter.
- 14. IPS Reduces The Amount Of Malicious Traffic That Gets To The End User
- 15. Employees See Less Alerts
- 16. More Time To Focus On The Business
- 17. Previous Chart Illustrates Risk Levels For Deploying Only One Security Technology.
- 18. For Example, Deploying Only Desktop Security Technologies Results In The Highest Risk Because The Threat Has Already Entered Your Network
- 19. User-centric Measures Are Inconsistent Because Users Do Not The Same Thing Every Time.© 2010 Heather L. Axworthy 10
- 20. Protection & Equipment Costs © 2010 Heather L. Axworthy 11
- 21. Protection & Equipment Costs IPS Technologies Are Proactive Higher Initial Cost Higher Level Of Protection IDS Technologies Are Reactive Lower Initial Cost Many Tools Are Open Source Majority Of The Cost Is Hardware. Protection Level Is Lower: IDS Only Alerts I.T. To Malicious Traffic And I.T. Must Spend Large Amounts Of Time Investigating, Which Can Incur Extra Costs For Additional Response Training. Desktop Security Is Reactive Quantity Of Desktops Drive Costs. Relatively Inexpensive SW User-training Costs Must Be Considered © 2010 Heather L. Axworthy 12
- 22. Deployment Considerations © 2010 Heather L. Axworthy 13 criteria partial
- 23. Recommendation To Your Clients IPS….IDS….Desktop SW….Security Awareness Training….Log Management & Monitoring ???? © 2010 Heather L. Axworthy 14 Keep The Threats Out!
- 24. What is IPS? IPS = Intrusion Prevention System/Service. Designed To Be Deployed Inline. Proactive Approach To Traffic Monitoring. Preventing The Attack Packet From Penetrating Your Network. 15 © 2010 Heather L. Axworthy
- 25. Architecture Capacity Planning – Biggest Mistake Purchasing Hardware That Is Too “Small” For Your Network. Look At The Traffic Load Of The Segments You Want To Monitor. If The Segments (vlans) You Want To Monitor Register Bandwidth In Excess Of 100MB Each, A Small 400MB Device Is Not Large Enough. Most Devices Have A Maximum Throughput Which Is Often An Aggregate Of All Interfaces On The Device. 16 © 2010 Heather L. Axworthy
- 26. Deployment 17 © 2010 Heather L. Axworthy
- 27. Event Monitoring/Tuning My Device Is In Place, What Do I Do Next? Tuning – The Time Period When You Look At Your Events And Weed Out Any False Positives And Modify Signatures. Best Practice Is At Least 30 Days Of Looking At Traffic On A Daily Basis. This Will Enable You To Filter Out Signatures That Are “Noisy” And See Events That Show Valid Attacks. Once Tuning Period Is Over, Put The Device Into Block “IPS” Mode. 18 © 2010 Heather L. Axworthy
- 28. Ensuring Success Company Buy-in, From Top Executive Management To End User. IPS Will Make “Us” More Secure. Staffing Levels – Proper Staffing Must Be In Place To Support The IPS Device(s) And The Monitoring Of Events On A Daily Basis. If The IPS Device Stops One Botnet Outbreak, Or A SQL Injection Attack, It Has Paid For Itself! 19 © 2010 Heather L. Axworthy
- 29. Q & A Heather Axworthy Network Security Engineer haxworthy@gmail.com 20 © 2010 Heather L. Axworthy
Editor's Notes
- IPS is short for Intrusion Prevention, when the specific traffic matches a signature, the device “drops” the traffic immediately and creates an event with details on the traffic. Designed to be deployed inline. IPS takes a proactive approach to traffic monitoring.
- capacity planning – buy the right device – Do your homework: Look at the traffic load of the segments you want to monitor. Every model has a threshold level. If the vlan you want to monitor registers bandwidth in excess of 100MB, and you may want to monitor additional vlan’s, a 400MB limit box will not work for you. Don’t expect to buy just one box. If you have remote sites or several internal vlan’s, you will need additional units. Buy a large enough unit that can be deployed at the perimeter in between the firewall and DMZ/Internal networks. Buy smaller units for remote sites and smaller segments.There are several out there on the market today. ISS, TippingPoint, Cisco, Sourcefire Choose the vendor that has the best reputation for good, sound security intelligence.
- You will probably need more than one device, at least one at the perimeter, and possibly a few smaller throughput devices. All IPS devices have two modes, block aka “IPS” mode, and non-block aka “IDS” mode. When you first deploy your device, it is in non-block mode, you then spend a period of time tuning out any false positives. After that period is complete, then put your device into blocking mode. “IPS” mode should always be your primary end goal!
- Now that my device is in place in non-block mode, what do I do?take a period of at least 30 days and look at the events being generated by the device on a daily basis. This time period is known as the “tuning phase”, this time is when you make adjustments to the signatures on the device. You are filtering out the false positives, so you can look at the events that are showing valid attacks.