Feeds

Don't put app protection on your firewall, Mr Jones

Top Layer touts standalone IPS appliance

  • alert
  • submit to reddit

Choosing a cloud hosting partner with confidence

Networking security firm Top Layer this week announced plans to boost the speed of its intrusion prevention appliances in repelling both network and application-level cyber attacks.

Top Layer's Attack Mitigator IPS 5500, due to be released in the first quarter of 2004, is designed to complement end users' existing firewall and network security infrastructure. It is touted as Top Layer's fastest and more reliable security platform to date.

Many firewall vendors (such as NetScreen and Check Point) have recently announced their intention to build application intelligence into their firewalls.

Firewalls were traditionally designed to guard against network-level attacks - such as IP spoofing and port/network scans - but as more sophisticated application-layer attacks, such as worms and exploits of known software vulnerabilities, have become increasingly common a need has arisen to rejig corporate defences.

Integration Vs best of breed

Top Layer's argument is that rather than loading extra application-aware intelligence into firewalls better performance can be obtained by using standalone intrusion detection and prevention, such as its Attack Mitigator IPS 5500.

The Attack Mitigator IPS 5500 uses a combination of hardware technology and new "Deep Packet Inspection" technology that offers better performance under heavy attack than the software-led approaches to backed by firewall vendors, according to Top Layer.

Top Layer claims the IPS 5500 can handle 60,000 stateful inspections per second or twice the rate possible with competitive technology.

The IPS 5500 adds to Top Layer's existing Attack Mitigator family of in-line security devices, which are designed block intrusions and attacks that conventional firewalls miss and that Intrusion Detection Systems (electronic burglar alarms) merely detect.

If you’re not on the white list, you’re not getting in

The Attack Mitigator IPS suite of products allows good traffic to pass through while actively blocking malicious traffic such as application-level attacks, worms (such as Slammer and Blaster), SYN floods, protocol and traffic anomalies, DoS, DDoS, and other attacks. It also blocks outbound attacks from any compromised machines within an internal network.

The Attack Mitigator IPS, which would normally sit behind corporate firewalls, does need to be tuned to customer's individual environments in order to make sure legitimate traffic is not blocked, Paul Lawrence, director of sales engineering at Top Layer told El Reg. The product also needs signature updates to recognise new types of attacks.

Cracking down on DoS

DDoS attacks have been much in the news of late with attacks on WorldPay and online gambling sites setting a worrying trend of increased hostile activity. Lawrence said most of these assaults were "high-volume brute force" attacks but with the twist that attackers were actively monitoring the success of their attacks and modifying them over time to make assaults more likely to succeed.

Although Top Layer's technology can help defend against such attacks, Lawrence was careful to say that there is no "silver bullet" answer to security problems. Businesses need to think of intrusion protection technology as one component in a multi-tiered approach to defending against attacks which needs to include firewalls and following best practice network design principles, he added. ®

Related Stories

NetScreen firms firewalls against app attacks
Check Point bolsters apps security defences
When firewalls and intrusion detection just aren't enough
Vendors sharpen tools to thwart DoS attacks
IDS users swamped with false alerts

Internet Security Threat Report 2014

More from The Register

next story
FYI: OS X Yosemite's Spotlight tells Apple EVERYTHING you're looking for
It's on by default – didn't you read the small print?
Russian hackers exploit 'Sandworm' bug 'to spy on NATO, EU PCs'
Fix imminent from Microsoft for Vista, Server 2008, other stuff
Edward who? GCHQ boss dodges Snowden topic during last speech
UK spies would rather 'walk' than do 'mass surveillance'
Microsoft pulls another dodgy patch
Redmond makes a hash of hashing add-on
NOT OK GOOGLE: Android images can conceal code
It's been fixed, but hordes won't have applied the upgrade
Apple grapple: Congress kills FBI's Cupertino crypto kybosh plan
Encryption would lead us all into a 'dark place', claim G-Men
'LulzSec leader Aush0k' found to be naughty boy not worthy of jail
15 months home detention leaves egg on feds' faces as they grab for more power
China is ALREADY spying on Apple iCloud users, claims watchdog
Attack harvests users' info at iPhone 6 launch
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.