Feeds

Don't put app protection on your firewall, Mr Jones

Top Layer touts standalone IPS appliance

  • alert
  • submit to reddit

Seven Steps to Software Security

Networking security firm Top Layer this week announced plans to boost the speed of its intrusion prevention appliances in repelling both network and application-level cyber attacks.

Top Layer's Attack Mitigator IPS 5500, due to be released in the first quarter of 2004, is designed to complement end users' existing firewall and network security infrastructure. It is touted as Top Layer's fastest and more reliable security platform to date.

Many firewall vendors (such as NetScreen and Check Point) have recently announced their intention to build application intelligence into their firewalls.

Firewalls were traditionally designed to guard against network-level attacks - such as IP spoofing and port/network scans - but as more sophisticated application-layer attacks, such as worms and exploits of known software vulnerabilities, have become increasingly common a need has arisen to rejig corporate defences.

Integration Vs best of breed

Top Layer's argument is that rather than loading extra application-aware intelligence into firewalls better performance can be obtained by using standalone intrusion detection and prevention, such as its Attack Mitigator IPS 5500.

The Attack Mitigator IPS 5500 uses a combination of hardware technology and new "Deep Packet Inspection" technology that offers better performance under heavy attack than the software-led approaches to backed by firewall vendors, according to Top Layer.

Top Layer claims the IPS 5500 can handle 60,000 stateful inspections per second or twice the rate possible with competitive technology.

The IPS 5500 adds to Top Layer's existing Attack Mitigator family of in-line security devices, which are designed block intrusions and attacks that conventional firewalls miss and that Intrusion Detection Systems (electronic burglar alarms) merely detect.

If you’re not on the white list, you’re not getting in

The Attack Mitigator IPS suite of products allows good traffic to pass through while actively blocking malicious traffic such as application-level attacks, worms (such as Slammer and Blaster), SYN floods, protocol and traffic anomalies, DoS, DDoS, and other attacks. It also blocks outbound attacks from any compromised machines within an internal network.

The Attack Mitigator IPS, which would normally sit behind corporate firewalls, does need to be tuned to customer's individual environments in order to make sure legitimate traffic is not blocked, Paul Lawrence, director of sales engineering at Top Layer told El Reg. The product also needs signature updates to recognise new types of attacks.

Cracking down on DoS

DDoS attacks have been much in the news of late with attacks on WorldPay and online gambling sites setting a worrying trend of increased hostile activity. Lawrence said most of these assaults were "high-volume brute force" attacks but with the twist that attackers were actively monitoring the success of their attacks and modifying them over time to make assaults more likely to succeed.

Although Top Layer's technology can help defend against such attacks, Lawrence was careful to say that there is no "silver bullet" answer to security problems. Businesses need to think of intrusion protection technology as one component in a multi-tiered approach to defending against attacks which needs to include firewalls and following best practice network design principles, he added. ®

Related Stories

NetScreen firms firewalls against app attacks
Check Point bolsters apps security defences
When firewalls and intrusion detection just aren't enough
Vendors sharpen tools to thwart DoS attacks
IDS users swamped with false alerts

Mobile application security vulnerability report

More from The Register

next story
Yorkshire cops fail to grasp principle behind BT Fon Wi-Fi network
'Prevent people that are passing by to hook up to your network', pleads plod
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
NEW, SINISTER web tracking tech fingerprints your computer by making it draw
Have you been on YouPorn lately, perhaps? White House website?
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Black Hat anti-Tor talk smashed by lawyers' wrecking ball
Unmasking hidden users is too hot for Carnegie-Mellon
Attackers raid SWISS BANKS with DNS and malware bombs
'Retefe' trojan uses clever spin on old attacks to grant total control of bank accounts
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Reducing security risks from open source software
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.