Network Perimeter Defense Josef Pojsl, Martin Macháček, Trusted Network Solutions, Inc.

IP filtering gateways Proxy gateways Combinations (defense in depth) Traditional techniques Internet Internal Network

Perimeter expansion Increased bandwidth Remote offices Telecommuters Roaming users Partners Technology Cryptography VPNs Internet Internal Network

Role of communication Growing dependence on IT systems Paperwork replaced with electronic data As a consequence Greater potential of attacks and vulnerabilities Data integrity attacks Harder detection Automation Complexity Technology Cryptography Content scaning Intrusion detection Vulnerability scanning

Complexity Internet Internal Network VPNs Firewalls Public servers Internal servers Intrusion detection Content scanner Vulnerability scanner

Risk Assessment Risk factors Worth Attraction Threat Vulnerability Probability Countermeasures Prevention Detection Reaction High-risk environments: risk factors are relatively high

Security processes Every day New processes are being transformed into electronic forms New vulnerabilities and patches emerge Event logs must be analyzed Appropriate actions must be taken Etc. As a consequence Security is a process Services serve better than products Expert teams specialized in security are needed Some processes may be (internally) outsourced

Fighting complexity Minimalism Rarely used in software design Unusual parameter combinations Number of interactions Modularity Modules are more easily verifiable Well-defined interfaces between modules Minimal design Customization

Event logging Full, fine-grained event logs are vital for detection Easy to process, human readable Log analysis: statistics, expert systems, manual Audit Logs

Open architecture Not necessarily open-source Source code serves for –Verification –Documentation No “security through obscurity” No “breakthroughs” Compliance with open standards

Conclusion Design principles to follow when building network security defense in high-risk environments Processes, not solutions MinimalismModularity Thorough audit trails and log analysis Open architecture Expert teams Outsourcing