Feeds

Don't put app protection on your firewall, Mr Jones

Top Layer touts standalone IPS appliance

  • alert
  • submit to reddit

Remote control for virtualized desktops

Networking security firm Top Layer this week announced plans to boost the speed of its intrusion prevention appliances in repelling both network and application-level cyber attacks.

Top Layer's Attack Mitigator IPS 5500, due to be released in the first quarter of 2004, is designed to complement end users' existing firewall and network security infrastructure. It is touted as Top Layer's fastest and more reliable security platform to date.

Many firewall vendors (such as NetScreen and Check Point) have recently announced their intention to build application intelligence into their firewalls.

Firewalls were traditionally designed to guard against network-level attacks - such as IP spoofing and port/network scans - but as more sophisticated application-layer attacks, such as worms and exploits of known software vulnerabilities, have become increasingly common a need has arisen to rejig corporate defences.

Integration Vs best of breed

Top Layer's argument is that rather than loading extra application-aware intelligence into firewalls better performance can be obtained by using standalone intrusion detection and prevention, such as its Attack Mitigator IPS 5500.

The Attack Mitigator IPS 5500 uses a combination of hardware technology and new "Deep Packet Inspection" technology that offers better performance under heavy attack than the software-led approaches to backed by firewall vendors, according to Top Layer.

Top Layer claims the IPS 5500 can handle 60,000 stateful inspections per second or twice the rate possible with competitive technology.

The IPS 5500 adds to Top Layer's existing Attack Mitigator family of in-line security devices, which are designed block intrusions and attacks that conventional firewalls miss and that Intrusion Detection Systems (electronic burglar alarms) merely detect.

If you’re not on the white list, you’re not getting in

The Attack Mitigator IPS suite of products allows good traffic to pass through while actively blocking malicious traffic such as application-level attacks, worms (such as Slammer and Blaster), SYN floods, protocol and traffic anomalies, DoS, DDoS, and other attacks. It also blocks outbound attacks from any compromised machines within an internal network.

The Attack Mitigator IPS, which would normally sit behind corporate firewalls, does need to be tuned to customer's individual environments in order to make sure legitimate traffic is not blocked, Paul Lawrence, director of sales engineering at Top Layer told El Reg. The product also needs signature updates to recognise new types of attacks.

Cracking down on DoS

DDoS attacks have been much in the news of late with attacks on WorldPay and online gambling sites setting a worrying trend of increased hostile activity. Lawrence said most of these assaults were "high-volume brute force" attacks but with the twist that attackers were actively monitoring the success of their attacks and modifying them over time to make assaults more likely to succeed.

Although Top Layer's technology can help defend against such attacks, Lawrence was careful to say that there is no "silver bullet" answer to security problems. Businesses need to think of intrusion protection technology as one component in a multi-tiered approach to defending against attacks which needs to include firewalls and following best practice network design principles, he added. ®

Related Stories

NetScreen firms firewalls against app attacks
Check Point bolsters apps security defences
When firewalls and intrusion detection just aren't enough
Vendors sharpen tools to thwart DoS attacks
IDS users swamped with false alerts

Intelligent flash storage arrays

More from The Register

next story
Webcam hacker pervs in MASS HOME INVASION
You thought you were all alone? Nope – change your password, says ICO
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
Meet OneRNG: a fully-open entropy generator for a paranoid age
Kiwis to seek random investors for crowd-funded randomiser
USB coding anarchy: Consider all sticks licked
Thumb drive design ruled by almighty buck
Attack reveals 81 percent of Tor users but admins call for calm
Cisco Netflow a handy tool for cheapskate attackers
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
prev story

Whitepapers

Choosing cloud Backup services
Demystify how you can address your data protection needs in your small- to medium-sized business and select the best online backup service to meet your needs.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Internet Security Threat Report 2014
An overview and analysis of the year in global threat activity: identify, analyze, and provide commentary on emerging trends in the dynamic threat landscape.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.