Six burning questions about network security

by Ellen Messmer

June 9, 2008 —

Security issues often seem to smolder more than burn, but these six are certainly
capable of lighting a fire under IT professionals at a moment's notice. Handle
with care.

Is server virtualization worth the risk?

The benefits of moving away from traditional servers to virtual-machine
(VM) arrangements are the cost savings in hardware consolidation and remarkable
flexibility. But less-welcome consequences can be security gaps and virtual-server
sprawl, risks that draw fire from auditors.

VM security too often is being addressed after the fact, says Douglas Drew,
senior consultant with BT's emerging technologies office and an auditor for
the Payment Card Industry (PCI) standard. "How do you handle access control
or auditing? Suppose I migrate an instance of a virtual machine from rack A
to rack B: Is one a locking rack that needs a physical badge to get to the console
and the other not? Does the VM hypervisor allow for separation of administrators
A and B so A can only logically touch systems A and administrator B only touches
B? How are you re-upping the risk assessment based on the architecture change?"

Like more traditional networks, the VM environment, whether based on VMware,
XenSource or Microsoft, calls for applying best practices defined under the
ISO 27002 standard for secure systems, Drew says. "We've seen some cases
where people are slow to adopt VM because they haven't gotten their arms around
this."

And VM software
out of the box won't suffice for security, many say.

"The virtual machines are mobile, they're designed to be mobile,"
says David Lynch, vice president of marketing at Embotics, a start-up that makes
VM life-cycle management software. "You take a physical server and make
a clone of it. You lose the identity of the physical server, but your existing
management tools are based on the idea you have a physical server."

As designed today, VMware's VirtualCenter management won't prevent VM prawl
because VM ID numbers can be changedand re-set, Lynch contends. He adds it's
not possible to ensure a unique VM ID system for an enterprise using more than
one VirtualCenter.

The Embotics software, which works with VirtualCenter, tries to compensate
by using a cryptographic hash, combined with VM meta-data, to brand a VM ID
as legitimate and authentic. Other start-ups, including Fortisphere
and ManageIQ,
also are tackling the VM sprawl issue.

Some security vendors are convinced that the main VM software developers are
in such a rush to get their products out to grab market share that as Andrew
Hay, product program manager at Q1 Labs, puts it, "security is an afterthought."

Hay notes there's no Netflow-enabled virtual switch to help with activity monitoring.
"You're creating a separate network that happens to reside on a box,"
Hay says. "But no one pushes for flow analysis in the virtualized world."

Should all this stop IT managers from going virtual? The bottom line, according
to Hay: "It would be best to research your options before going fill tilt."

Does stopping data leaks lure lawyers?

Data-loss
prevention (DLP) -- or call it data-leak protection -- lets you monitor
content for unauthorized transmission. But organizations gaining experience
with it are finding DLP sheds so much light into the darker corners of the corporate
network that IT and business managers may find themselves in regulatory and
legal peril.

"You move from ignorance to compliance jeopardy," says Tony Spinelli,
senior vice president of information security at credit information services
firm Equifax, describing the early days of deploying the Symantec
DLP in his organization. DLP became a spotlight in the dark, exposing data-storage
practices that needed to be improved.

That puts both business and IT management on the spot to make changes. And
more security managers are finding that picky auditors -- once they know the
DLP tools are in place -- are demanding security changes that corporations would
be at their legal peril to ignore.

So is this "see all, know all" aspect -- in addition to the fact
that DLP can still be expensive -- enough of a downside to turn off potential
buyers? Maybe, but it would mean turning away from the most promising content-monitoring
approach, one that might be sorely needed to help keep your firm out of regulatory
and legal trouble.

Knowing in advance that DLP may be a disruptive technology, security managers
can make plans to prepare business managers -- the rightful data owners in the
eyes of most corporations -- as well as auditors and legal staff.

One security professional with DLP experience, Ron Baklarz, who recently left
MedStar Health to join Amtrak as chief information systems officer, said the
approach he took with the Reconnex DLP used at MedStar was to bring business
people into the data-oversight process.

"You need to partner with them on compliance," Baklarz advises. Giving
authorized business staff a log-in to technical DLP systems makes them active
participants in the data-loss prevention effort. ~ ~

In-the-cloud security: Dreamy or dangerous?

According to John Pescatore, a Gartner security expert who keeps tabs on in-the-cloud
security services, the basic thing about them -- be they be for e-mail,
denial-of-service (DoS) protection, vulnerability scanning or Web filtering
-- is that they're an alterative to the do-it-yourself approach in buying software
or equipment.

There are strong reasons to ascend into the cloud by buying a service -- but
also times to stay in the more earthly domain with your own stuff.

To start, it's worth thinking about enterprise in-the-cloud security services
as two basic types, Pescatore suggests. The first is bandwidth-based, such as
carrier- or ISP-based DoS protection and response.

"AT&T,
for example, can do this better and more cheaply than you can, plus they're
filtering out attacks further upstream than you can using their bandwidth,"
Pescatore says. The alternative would be buying anti-DoS equipment from a firm
such as Arbor Networks and setting up protection on your own.

The second in-the-cloud type is what Gartner prefers to call"security
as a service," which is "totally divorced from a bandwidth service,"
Pescatore says. Using an antispam service, for example, involves redirecting
the MX record to the service provider but doesn't entail specific bandwidth
services tied to one single carrier.

This genre includes e-mail spam
and antivirus filtering; vulnerability scanning; and Web filtering. What it
doesn't include, by and large, is either DLP content monitoring and filtering
or identity access and management, which are tightly coupled to internal business
changes.

Using security-as-a service in the cloud makes a lot of sense to protect mobile
laptops or provide protection for widely distributed branch offices, Pescatore
says."For the very large global corporations, this is attractive,"
he says.

However, most companies will probably find it as easy and cost-effective to
continue to guard internal operations by deploying their own security gear to
filter spam, viruses and restrict Web access.

There are potential risks to filtering services. You might not want to transmit
sensitive business transactions through this kind of third-party service. And,
there's always a chance the service might go out of business.

All of these in-the-cloud services are still fairly new, seeing a growth spurt
only in the past three years, Pescatore says, with MessageLabs, Microsoft,
Google's
Postini and Websense to be counted among the vendors. Gartner estimates that
in-the-cloud e-mail security services don't account for more than 20% of the
total e-mail security market but will jump to 35% by year-end and 70% by 2013.

According to research firm IDC, last year the market for e-mail security software
was US$1.38 billion, and appliances another $692.2 million. In-the-cloud services,
which IDC calls hosted services, were $454 million. Software and appliances
are expected to continue steady growth (see chart), and hosted services will
jump to $638 million this year and $1.39 billion by 2011.

This kind of expansion of in-the-cloud services encourages the Jericho Forum,
an organization of about 60 corporations which has been actively pushing for
innovative e-commerce security that reaches outside the traditional corporate
boundary of the perimeter.

"Web filtering in the cloud has only taken off in the last 16 months,"
says Paul Simmonds, a member of the Jericho Forum board."There are many
more in-the-cloud services today than there were a few years ago." Simmonds
said the"disappearing perimeter" in corporate networks is making in-the-cloud
security services an appealing option that many businesses are exploring today.

When it comes to security, can Microsoft get any respect?

Even Bill Gates has humbled himself at times to explain why Microsoft has fumbled
the ball so often on security. In his last public appearance at the RSA
2007 Conference, on stage with Craig Mundie, to whom he handed the baton
to direct product security going forward, the two offered a mea culpa explanation
on why Microsoft's software has fallen short.

"Humans are humans and they make mistakes," said Mundie, with the
duo later indicating that the inadequate security plaguing Microsoft software
in the past can be traced to a naïveté in the early years based
on the perception few controls were needed because"everybody was really
good" and the data center seemed carefully tucked away.

This decades-old baggage remains a burden for Microsoft, says Andreas Antonopoulos,
senior vice president and founding partner at Nemertes Research.

"Even today, the fundamental design decisions made 25 years ago still
haunt Microsoft," Antonopoulos says."Windows Vista is not a new operating
system; there are a lot of the older operating systems under the cover, which
carries with it the baggage of the last 20 years to ensure backward compatibility
of applications."

Microsoft is caught in a conundrum, Antonopoulos asserts. If the company really
decides to make a fresh start on software, it would likely have to sacrifice
financial advantages."That's not likely to happen," he says.

Burton Group analyst Dan Blum expresses a similar opinion, saying,"They
are compromised in that sense. They have the constraints of backward compatibility
in mind."

A few years ago, Microsoft sought to make a break with the past in what was
called the Next-Generation
Secure Computing Base (NGSCB) project, but"they killed it," Blum
says.

According to Blum, Microsoft remains driven along a path of"convenience
and flexibility and backwards compatibility," which gives them the best
advantage in the marketplace. Blum muses if he were Bill Gates, he would have
tried a"parallel approach" to develop a next-generation trusted operating
system, even if it broke with existing applications.

In other respects, Microsoft has produced a viable identity strategy overall,
Blum says, but it's been hobbled by its Windows-centric
approach."They never put a stamp on any platform that's different,"
he says. Microsoft's lack of support for the SAML standard, for instance,"is
a big mistake and not in the best interests of the industry."

Linux, Unix and Macintosh operating systems ship with better"secure by
design postures" than those from Microsoft, Antonopoulos contends.

But Antonopoulos and Blum both say Microsoft has improved with Vista and XP2.

"The problem is Microsoft has developed a bad reputation and it's hard
to outlive that," Antonopoulos says. Microsoft has plenty of talented engineers
with identity and trust expertise, but their ideas expressed during engineering
conferences seldom seem to get adopted in Microsoft software."I think they
must get overruled."

For some third-party security software providers that work closely with Microsoft,
it's also been trying at times.

"It's been a roller coaster," says Phil Lieberman, president of Lieberman
Software, which makes password and administrative management tools that work
with Microsoft desktop and server products."The problem with Microsoft
is it's not just one company; it's divergent ones on different paths fighting
each other."

In some Microsoft units, such as those managing CRM or Office products, there's
no effort to work with third-party applications for security while"the
core operating system group is more open," Lieberman says.

But the most aggravating part of working with Microsoft -- which may be necessary
to gain official Microsoft certification -- is that the company isn't keeping
up on the technical documentation.

"A tremendous amount of the operating system is undocumented," Lieberman
says."They're moving so fast and doing so many releases and updates, no
one is keeping track of what they're doing. For instance, if Microsoft goes
and changes something for Patch Tuesday, and a [Data Link Library] is changed,
they don't bother to change the documentation, and your application stops working.
We have to go research this and we find they've changed it."

While acknowledging Microsoft's poor track record, others are a tad more conciliatory.

Microsoft's efforts to improve have had a"positive impact," says
Oliver Friedrichs, director of Symantec's Security Response division."We
have to give Microsoft some credit for improving operating system security."

In the past few years there just haven't been the types of devastating worm
attacks, such as Code Red, Blaster and Nimbda, that exploited holes in Microsoft
products to wreck havoc around the world.

"Attackers today are focused on the third-party Web plug-ins," Friedrichs
adds.

"It's easy to pick on Microsoft because they're ubiquitous and historically
had a problem," says Jon Gossels of SystemExperts."But year after
year, their products are getting better, and a lot of professionals out there
are trying to find the bugs."

NAC: Is your firewall enough?

Network
access control (NAC) isn't for everybody, but it can be a valuable tool
for controlling the circumstances under which individuals gain network access.

That can be valuable for heavily regulated businesses. NAC can perform a comprehensive
check of endpoints before they are allowed to get on to corporate networks,
and that kind of check can help placate regulators that demand enforcement of
policies about how legitimate endpoints must be configured.

Most NAC platforms not only perform this function, but they keep records of
performing it, something demanded by various regulations such as payment card
industry (PCI) standards and the Health
Insurance Portability and Accountability Act (HIPAA).

Screening guest users is a particular problem that NAC can address well, according
to Gartner."Most Gartner clients that are planning to deploy NAC report
that their first priority is to implement a guest network," says Gartner
analyst Lawrence Orans in a report."In 2007, many security managers who
viewed NAC as a strategic security process were able to use the near-term benefits
of guest networking to justify getting started in NAC."

If businesses have a diverse set of full-time employees, contractors and guests
that use their networks regularly, NAC can help assure that the devices they
use to connect meet configuration policies. For machines that flunk, NAC can
either fix them, quarantine them or grant them access to a network segment with
only limited resources and where they can do limited damage.

Similarly, businesses that need to segment their networks based on department
or job function can use the authorization controls in NAC to do so on a fairly
detailed level.

"We see a perfect storm if companies have multiple compliance requirements
(the Sarbanes-Oxley Act, PCI, HIPAA), a diverse workforce (employees, contractors,
remote workers, partners, suppliers) and global operations (the need to segment
the environment by region, business unit and others)," says Rob Whitely,
an analyst with Forrester Research.

NAC will ultimately become an element of layered security architectures that
rely less on perimeter firewalls
as the main bastion and more on layers of security that seek to mitigate threats,
Whiteley says."This is part of a larger trend around de-perimterization.
NAC is not necessary, but will become a critical component for these new security
architectures," he says.

Most networks can get by without NAC. The technology reduces the risk that
compromised machines gain network access and that they can do damage if they
manage to get admitted anyway. But it doesn't guarantee security. NAC came about
in response to threats that traditional Layer 3 firewalls couldn't handle, and
there are threats that NAC can't handle, but it can make important contributions.

"Ask yourself: Is your firewall enough?" Whiteley says."If so,
NAC is most likely unnecessary. It provides the additional host integrity checking,
but this provides little value above and beyond more granular authentication
and authorization -- which are really just attempts to make up for shortcomings
of today's firewalls."

Has IT licked patch management?

Patch
and vulnerability management tools can take on detecting and protecting
vulnerable machines in a mostly static, controlled environment. The technology
area is considered a priority among IT managers, who most likely have spent
many years perfecting their vulnerability scanning, patch testing and software
distribution processes.

According to an Enterprise Management Associates (EMA) survey, more than three-quarters
(76%) of 250 IT managers surveyed had some sort of patch management product
in house and said patching is an important to very important process. Van Dyke
Software's fifth annual enterprise security survey of 300 network administrators
showed that 30% still worry about patching, a number that has declined over
the years. Some industry watchers speculate that the lessening concern reflects
a maturity in patch management products and in IT managers' processes.

"We really don't have anything that changes what needs to be patched,
with the exception of remote access users, who are constantly a difficulty for
us to keep patched," says Craig Bush, network administrator at Exactech
in Gainesville, Fla. "Currently, we have to wait until the client connects
to our VPN to make the updates happen, which isn't always regular."

Bush says his patching processes are mature, but vendors could ease the process
by building in time for users to properly test patches before rolling them out
across distributed machines.

"Vendors should make sure they are testing patches extensively before
pushing them out the door," he says. "This is much easier for open
source technologies than it is for closed source companies like Microsoft, which
tends to have longer lead times on patches and fixes."

Yet industry watchers say the problems with patching today and going forward
will have more to do with user environments than with vendor updates. They warn
that while patch management technology can be considered mature, as environments
evolve to include more virtualization and complex application infrastructures,
patching will need to grow up. And in turn, vendors such as Altiris (now part
of Symantec),
BigFix, CA, St. Bernard, PatchLink and Shavlik will need to bring support for
virtualization and other technologies into their tools to adequately patch customer
environments.

"It is a relatively mature technology, but that doesn't mean it's under
control. Patching in areas such as virtualization remains considerably immature
at this point; server and desktop virtualization are throwing the old rules
for patching out the window," says Andi Mann, research director at EMA.

According to Mann, virtualization introduces complexity as well as exponentially
more machines to be patched in the same amount of time. This could cause IT
managers to hasten the patch testing process, which would ultimately cause configuration
conflicts on production machines. "Testing is a critical element of patching,
and with immediate threats like zero-day attacks and the proliferation of virtual
machines being certain all the updates will work together and protect the environment
is more difficult," Mann says.

Add to that dependency patching, says Jasmine Noel, principal analyst at Ptak,
Noel & Associates, and patching could become a new challenge for IT managers.
As environments get more complex and the number of vendors distributing patches
grows, she says, the layers of testing and distribution of updates will break
the old approach to patching for many IT managers.

"What still needs work is sequencing patches from multiple vendors because
of all the infrastructure layers -- hardware, operating system on the physical
box, virtualization software and the virtual machines (operating system and
application stack) -- so what is the right sequence to install your HP,
Microsoft and Oracle
patches that all came out last Tuesday?" she asks.

Network World