Feeds

Don't put app protection on your firewall, Mr Jones

Top Layer touts standalone IPS appliance

  • alert
  • submit to reddit

Providing a secure and efficient Helpdesk

Networking security firm Top Layer this week announced plans to boost the speed of its intrusion prevention appliances in repelling both network and application-level cyber attacks.

Top Layer's Attack Mitigator IPS 5500, due to be released in the first quarter of 2004, is designed to complement end users' existing firewall and network security infrastructure. It is touted as Top Layer's fastest and more reliable security platform to date.

Many firewall vendors (such as NetScreen and Check Point) have recently announced their intention to build application intelligence into their firewalls.

Firewalls were traditionally designed to guard against network-level attacks - such as IP spoofing and port/network scans - but as more sophisticated application-layer attacks, such as worms and exploits of known software vulnerabilities, have become increasingly common a need has arisen to rejig corporate defences.

Integration Vs best of breed

Top Layer's argument is that rather than loading extra application-aware intelligence into firewalls better performance can be obtained by using standalone intrusion detection and prevention, such as its Attack Mitigator IPS 5500.

The Attack Mitigator IPS 5500 uses a combination of hardware technology and new "Deep Packet Inspection" technology that offers better performance under heavy attack than the software-led approaches to backed by firewall vendors, according to Top Layer.

Top Layer claims the IPS 5500 can handle 60,000 stateful inspections per second or twice the rate possible with competitive technology.

The IPS 5500 adds to Top Layer's existing Attack Mitigator family of in-line security devices, which are designed block intrusions and attacks that conventional firewalls miss and that Intrusion Detection Systems (electronic burglar alarms) merely detect.

If you’re not on the white list, you’re not getting in

The Attack Mitigator IPS suite of products allows good traffic to pass through while actively blocking malicious traffic such as application-level attacks, worms (such as Slammer and Blaster), SYN floods, protocol and traffic anomalies, DoS, DDoS, and other attacks. It also blocks outbound attacks from any compromised machines within an internal network.

The Attack Mitigator IPS, which would normally sit behind corporate firewalls, does need to be tuned to customer's individual environments in order to make sure legitimate traffic is not blocked, Paul Lawrence, director of sales engineering at Top Layer told El Reg. The product also needs signature updates to recognise new types of attacks.

Cracking down on DoS

DDoS attacks have been much in the news of late with attacks on WorldPay and online gambling sites setting a worrying trend of increased hostile activity. Lawrence said most of these assaults were "high-volume brute force" attacks but with the twist that attackers were actively monitoring the success of their attacks and modifying them over time to make assaults more likely to succeed.

Although Top Layer's technology can help defend against such attacks, Lawrence was careful to say that there is no "silver bullet" answer to security problems. Businesses need to think of intrusion protection technology as one component in a multi-tiered approach to defending against attacks which needs to include firewalls and following best practice network design principles, he added. ®

Related Stories

NetScreen firms firewalls against app attacks
Check Point bolsters apps security defences
When firewalls and intrusion detection just aren't enough
Vendors sharpen tools to thwart DoS attacks
IDS users swamped with false alerts

New hybrid storage solutions

More from The Register

next story
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
Google recommends pronounceable passwords
Super Chrome goes into battle with Mr Mxyzptlk
Infosec geniuses hack a Canon PRINTER and install DOOM
Internet of Stuff securo-cockups strike yet again
Reddit wipes clean leaked celeb nudie pics, tells users to zip it
Now we've had all THAT TRAFFIC, we 'deplore' this theft
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
TorrentLocker unpicked: Crypto coding shocker defeats extortionists
Lousy XOR opens door into which victims can shove a foot
Greater dev access to iOS 8 will put us AT RISK from HACKERS
Knocking holes in Apple's walled garden could backfire, says securo-chap
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
Top 5 reasons to deploy VMware with Tegile
Data demand and the rise of virtualization is challenging IT teams to deliver storage performance, scalability and capacity that can keep up, while maximizing efficiency.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.