The Art of Protecting from the Unknown
There have been discussions within the security community lately about the concept of protecting an information asset against unknown attacks. Recently, there have been numerous products springing up making this claim. I would like to discuss three of the techniques promoted by various vendors that make this concept both possible and workable -- though often in a limited manner.
"I Can See the Future"
Wouldn't we all love to make this claim? The ability to adequately know what is around the next corner is high on my desired super power list. Unfortunately, this is the real world, and nobody can see the future. Adequate estimates made from current data are possible and sometimes very helpful. Analyzing current and past trends allows us a degree of success in forecasting the future. This concept is used to try to pick investments, gamble on horses, and predict tomorrow's weather. This technique is also used by "Early Warning Systems" that offer advanced notification of threats based on whatever process they deem to be accurate.
Using this type of "crystal ball" technique, we have been able to notice and respond to some events as they are happening, or shortly before they are anticipated to happen. This offers a limited degree of awareness, but often requires a precise view of very specific data. General predictions often fall short, and typically, the further you attempt to forecast into the future, the more "hazy" things can seem.
In more technical terms, this concept relies on a bunch of distributed IDS sensors on a large network topology in an attempt to get a gestalt view of attacks. Utilizing the historical data, and analyzing this data can yield predictions on new attacks or rates of spread within that network topology.
Just as with stocks, horses, and the weather, actually making an accurate prediction based on historical and analytical data can be just as probable as leaving Vegas with a positive cash flow. From a systems security standpoint, relying on this methodology to guard against the unknown is extremely dangerous.
"The Fall Guy"
This approach utilizes the fact that having a stand-in take the fall for you is often preferable to you taking a fall yourself. This concept shows up in the real world by the use of stunt men in the entertainment industry and by bodyguards in the physical security realm. The basis of this technique involves having someone act as a proxy or decoy for you with the understanding that they will be hit by an attack and not you. The piece in front gets hit (and potentially damaged) while allowing your infrastructure to continue to operate, sometimes at reduced capacity. This is often the case used in many of the proxy-type software applications that are available to protect your assets.
By acting as an intermediary between the asset you are protecting and a potential attacker, you can add complexity and more points of failure to the equation. In some ways you may be lowering your attack profile, but you are also opening yourself up to other, different types of attacks. Sadly, due to the cost of these types of solutions, the defensive proxy is often called upon to protect numerous assets like web servers. As a result, a directed attack against the defensive proxy will result in a much larger loss than if the solution wasn't there at all!
This is based primarily on an application, which, as a proxy, sits in front of a web farm. There are several products in this vein, but the concept boils down to a decoy system, where the protector seems as it is the original protectee to any attackers. The core problem here is that after the decoy takes the attack and potentially fails, your information is no longer available. Network topology decisions place these solutions at "choke points" on your network to funnel all traffic through them. When that choke point fails, the network is basically cut off.
"You Should Know Better"
The final technique is the one we developed for use within our SecureIIS product. It revolves around the concept of forcing an application to think more about the type of information that it will consider legitimate. By residing within an application, as an ISAPI filter, SecureIIS wraps around the application and provides protection at the most crucial layer by monitoring all incoming and outgoing traffic as it passes through from the network to the kernel layer thus enabling the application (IIS) to change the way that it "thinks" about its inputted data and avoid being compromised.
What we have termed the "You Should Know Better" approach is the process of "teaching" an application how to protect itself. This technique is the cornerstone of a true application firewall. This method, like none other found, is the most thorough in its testing and painless in terms of implementation. All inputted information must be considered as hostile and not passed on to the host application until it has passed stringent checks for sanity and safety.
SecureIIS advances the "You Should Know Better" approach by looking for unique classes of attacks. It uses multiple security filters to inspect web server traffic for such issues as buffer overflows, parser evasions, directory traversal and other attacks. Therefore, SecureIIS is able to block against attacks that have not yet been discovered. In fact, several major vulnerabilities found within Microsoft's IIS throughout the past year have been discovered by eEye while our engineering team was developing advanced class recognition technology and product enhancements for SecureIIS.
The first two approaches listed, the "I Can See the Future" and the "Fall Guy", can be largely inaccurate and may be irresponsible marketing hype. Making a claim that the future, otherwise unpredictable, can be foretold is as inaccurate as pinpointing the next big earthquake. The true application firewall, will actually protect from unknown attacks. This is due to the sophistication in searching for entire "classes of attacks". It is the only way to proactively protect your web server from vulnerabilities. Unless of course predicting the future was in fact possible and we just haven't received that memo yet.
By Ryan Permeh |
The following articles represent the opinions of their respective authors. They do not necessarily represent the opinions of eEye Digital Security.
ComputerWorld - Recent Breaches Raise Specter of Liability Risks
"Organizations that fail to show due diligence in protecting their data assets face a real risk of legal problems in the not-too-distant future, analysts said." Full Article Sans Institute - The Twenty Most Critical Internet Security Vulnerabilities
"A little over a year ago, the SANS Institute and the National Infrastructure Protection Center (NIPC) released a document summarizing the Ten Most Critical Internet Security Vulnerabilities. This new list, released on October 1, 2001, updates and expands the Top Ten list." Full Article Information Security - Bridging the Gap
"If practitioners can't agree what a security professional is supposed to be, how can they expect others to accord them the respect they think they deserve?" Full Article |
News & Articles
Reader Q&A
Announcements
Tech Talk
Etcetera