Don't put app protection on your firewall, Mr Jones

Networking security firm Top Layer this week announced plans to boost the speed of its intrusion prevention appliances in repelling both network and application-level cyber attacks.

Top Layer's Attack Mitigator IPS 5500, due to be released in the first quarter of 2004, is designed to complement end users' existing firewall and network security infrastructure. It is touted as Top Layer's fastest and more reliable security platform to date.

Many firewall vendors (such as NetScreen and Check Point) have recently announced their intention to build application intelligence into their firewalls.

Firewalls were traditionally designed to guard against network-level attacks - such as IP spoofing and port/network scans - but as more sophisticated application-layer attacks, such as worms and exploits of known software vulnerabilities, have become increasingly common a need has arisen to rejig corporate defences.

Integration Vs best of breed

Top Layer's argument is that rather than loading extra application-aware intelligence into firewalls better performance can be obtained by using standalone intrusion detection and prevention, such as its Attack Mitigator IPS 5500.

The Attack Mitigator IPS 5500 uses a combination of hardware technology and new "Deep Packet Inspection" technology that offers better performance under heavy attack than the software-led approaches to backed by firewall vendors, according to Top Layer.

Top Layer claims the IPS 5500 can handle 60,000 stateful inspections per second or twice the rate possible with competitive technology.

The IPS 5500 adds to Top Layer's existing Attack Mitigator family of in-line security devices, which are designed block intrusions and attacks that conventional firewalls miss and that Intrusion Detection Systems (electronic burglar alarms) merely detect.

If you’re not on the white list, you’re not getting in

The Attack Mitigator IPS suite of products allows good traffic to pass through while actively blocking malicious traffic such as application-level attacks, worms (such as Slammer and Blaster), SYN floods, protocol and traffic anomalies, DoS, DDoS, and other attacks. It also blocks outbound attacks from any compromised machines within an internal network.

The Attack Mitigator IPS, which would normally sit behind corporate firewalls, does need to be tuned to customer's individual environments in order to make sure legitimate traffic is not blocked, Paul Lawrence, director of sales engineering at Top Layer told El Reg. The product also needs signature updates to recognise new types of attacks.

Cracking down on DoS

DDoS attacks have been much in the news of late with attacks on WorldPay and online gambling sites setting a worrying trend of increased hostile activity. Lawrence said most of these assaults were "high-volume brute force" attacks but with the twist that attackers were actively monitoring the success of their attacks and modifying them over time to make assaults more likely to succeed.

Although Top Layer's technology can help defend against such attacks, Lawrence was careful to say that there is no "silver bullet" answer to security problems. Businesses need to think of intrusion protection technology as one component in a multi-tiered approach to defending against attacks which needs to include firewalls and following best practice network design principles, he added. ®

Related Stories

NetScreen firms firewalls against app attacks
Check Point bolsters apps security defences
When firewalls and intrusion detection just aren't enough
Vendors sharpen tools to thwart DoS attacks
IDS users swamped with false alerts