1. © 2006, iPolicy Networks, Inc. All rights reserved. Security Technology Correlation Proneet Biswas Sr. Security Architect iPolicy Networks pbiswas@ipolicynetworks.com 510-687-3152 Ray West Director Network Services John Brown University rtwest@jbu.edu 479-524-7188

2. www.ipolicynetworks.com iPolicy Networks Confidential © 2006, iPolicy Networks, Inc. All rights reserved. Agenda  iPolicy Networks Decoding of blended Threats Challenges of Point Solutions Role of Integrated Security Single Pass Architecture – Developing the correlation  John Brown University Overview of Network Infrastructure Security Upgrade Initiative Key criteria in evaluation of solutions Glimpse of network after deployment

3. www.ipolicynetworks.com iPolicy Networks Confidential © 2006, iPolicy Networks, Inc. All rights reserved. Blended Threats Exploit Multiple Vulnerabilities Communicate with Controlling Servers Separate propagation and attack vectors Upgrade through rogue sites

4. www.ipolicynetworks.com iPolicy Networks Confidential © 2006, iPolicy Networks, Inc. All rights reserved. Example  Lupii Worm An infected system would communicate with its attacker over UDP port 7222. This communication could be used to launch a DoS attack or generate new update commands. Exploit Web vulnerabilities on a set of systems it plans to infect and spread. Attempt to connect to a rogue site like [http://62.101.193.244/xxxx/lupii] to upgrade itself and avoid detection attempts by IDS systems.http://62.101.193.244/xxxx/lupii

5. www.ipolicynetworks.com iPolicy Networks Confidential © 2006, iPolicy Networks, Inc. All rights reserved. Challenges for Point Solutions  Takes care of the threat in its current form, not future variants TechnologyWhat it will doFailure Firewall Block all communication on port 7222 Next update from the rogue site could change the port number IDS/IPS block a set of exploits being used by the worm infected system Next update from a rogue site, could use a different set of exploits Content Filtering Block the rogue site access Site could change as there is a communication channel through the firewall

6. www.ipolicynetworks.com iPolicy Networks Confidential © 2006, iPolicy Networks, Inc. All rights reserved. Role of Integrated Security - I  Sandbox the threat + += Integrated Security IDS/IPS Block Attack Firewall Block Communication URL Filtering Block Upgrade ++ Attack CommunicateUpgrade X X X = Firewall Rule: Block all communication UDP port 7222 IDS Rule: Block all Web exploit patterns URL Filtering Rule: Block all access to rogue site - http://62.101.193.244/xxxx/lupii http://62.101.193.244/xxxx/lupii Blended Threat

7. www.ipolicynetworks.com iPolicy Networks Confidential © 2006, iPolicy Networks, Inc. All rights reserved. Role of Integrated Security - II  Define policies which span across multiple technologies  Performance Impact of sequential processing – throughput and latency.  Introduce new Security technologies with negligible impact  Ease of Management

8. www.ipolicynetworks.com iPolicy Networks Confidential © 2006, iPolicy Networks, Inc. All rights reserved. Single Pass Architecture Packets Out Packets In