Feeds

Are you serious about security?

Consider anti-reconnaissance tools

Beginner's guide to SSL certificates

Arxceo's appliances work as a virtual server, intercepting all probes made of the network and sending back false data to the source of the probe so that a hacker is provided with misleading information about the network. The Ally appliances are "invisible", having neither a TCP/IP nor MAC address. Arxceo's appliances use tagging technology to add information such as IP address and time stamps to the packet returned to the originating source, using IP source authentication techniques to determine the identity of the source. If the source is determined to be authentic, traffic can then be let through to the network.

Even if the source is determined to be authentic and is let through the first anti-reconnaissance engine, Arxceo has a number of other tricks up its sleeve to prevent other exploits from being targeted against a network. It has a second, more advanced anti-reconnaissance engine that can prevent exploits such as stealth scans, where a hacker tries to prevent the request for connexion from being logged. Arxceo's Ally technology will respond to such an attack by sending back misinformation, hiding what ports are open and addresses in use. Tests indicate that there is zero change of an attacker predicting the sequence numbers for connexion IDs that Arxceo's Ally imposes.

For more advanced anti-reconnaissance techniques, the technology relies on anomaly and behavior-based protocols for determining whether traffic is good or bad. If a hacker is abusing a certain communications protocol to appear as good traffic, the anomaly-based attack prevention engine will direct the traffic into a black hole. Or where the behavior of the traffic is seen as unacceptable, such as where a hacker is looking for open user datagram protocol ports, or where it does not align with behavioral policies set by the enterprise, it will be stopped by the behavior-based attack prevention engine.

Benefits: the bottom line

The prime benefits of using such anti-reconnaissance technology are not just that it will stop zero day attacks, but that it is "management light". You won't even know that the technology is there. The appliances can be plugged into existing networks without the need for network modifications. Since the network cannot be breached, signature and characteristic-based techniques are not needed. The company no longer needs to maintain and constantly update resource-guzzling databases of signatures for all the malware threats that they face.

As the threats that we face grow in both number and complexity, better techniques are required for guarding against them. We need proactive tools that can counter attacks previously not seen, rather than reactive tools based on signatures. It's time to meet the enemy in the field and turn the enemy's tactics against them.

Copyright © 2007, IT-Analysis.com

Choosing a cloud hosting partner with confidence

More from The Register

next story
SMASH the Bash bug! Apple and Red Hat scramble for patch batches
'Applying multiple security updates is extremely difficult'
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
Stunned by Shellshock Bash bug? Patch all you can – or be punished
UK data watchdog rolls up its sleeves, polishes truncheon
Ello? ello? ello?: Facebook challenger in DDoS KNOCKOUT
Gets back up again after half an hour though
Desperate VXers enslave FREEZERS in DDoS bot
Updated Spike malware targets Asia
Heatmiser digital thermostat users: For pity's sake, DON'T SWITCH ON the WI-FI
A stranger turns up YOUR heat with default password 1234
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.