Get Smart with IP Intelligence

There are always threats out there on the big bad internet. The majority of breaches happen at the application layer and many OWASP Top 10s like SQL injection are still malicious favorites to gain entry. Add to that the availability of DDoS tools, anonymous proxies and the rise of hacktivism means networks and systems are bigger targets than ever. Threat detection today relies on a couple elements: Identifying suspicious activity among the billions of data points and refining a large set of suspicious incidents down to those that matter.

Today’s cyber-criminals use various techniques to hide their identities and activity. Keeping them out of your systems requires constant vigilance. Every packet that transverses the internet has a source IP address so disabling inbound communications from known malicious IPs can be highly effective.

You may not know but F5 offers IP Intelligence Services which provides the functionality to block known malicious IP addresses. It is a layer of IP threat protection and an additional way to allow BIG-IP customers to defend against malicious activity and infrastructure attacks. The IP Intelligence service is offered on several BIG-IP platforms. With IP Intelligence, BIG-IP AFM can be configured to block or allow traffic entering the system based on the reputation of the source IP address.

BIG-IP AFM determines reputation using two methods. One is a continuous feed of known or suspected malicious IP addresses provided by a third-party service Webroot BrightCloud. You can also create custom feed lists that specifies IP addresses that have been blacklisted or whitelisted by the organization. The BrightCloud feed is updated every 5 minutes by default and custom feed lists are unique to the AFM and are polled at intervals of your choosing.

These two methods are jointly referred to as IP Intelligence and can be used independently or in tandem to filer traffic on the BIG-IP systems. The BrightCloud option is licensed separately through F5 and requires internet connectivity and DNS resolution from your BIG-IP system. Custom feed lists do not need connectivity since it is local to the BIG-IP.

IP Intelligence can be applied via AFM firewall policy to the Route Domain or Virtual Server. Once enabled, it will affect all traffic that arrives on your BIG-IP system no matter the access point.

The IP Intelligence data is organized into categories that help you differentiate between types of listed IP addresses. There are 11 pre-defined categories including botnets, scanners, infected sources, illegal websites and more. These correspond to the categories in the BrightCloud feed. You can also create up to 51 custom categories to meet your own specific needs.

Networks, infrastructures, systems and applications are all under attack these days. While you can do your best at securing your data, sometimes a little call blocking can go a long way in ensuring these known rascals cannot get through.

Peace of mind is always a secure feeling.

ps

Inside Look - BIG-IP Advanced Firewall Manager

If you enjoyed In 5 Minutes or Less: BIG-IP Advanced Firewall Manager, this is a much deeper dive into the BIG-IP AFM solution.  I introduce BIG-IP Advanced Firewall Manager (AFM) and have Josh Mendosa, Product Management Engineer, show a demo of BIG-IP AFM available with BIG-IP v11.3. 

 

ps

Related:

• SAML Federation with BIG-IP Access Policy Manager: Inside Look – Video
• Inside Look - BIG-IP Advanced Firewall Manager
• Solving Substantiation with SAML – White Paper
• BIG-IP Advanced Firewall Manager Datasheet
• BIG-IP Advanced Firewall Manager Product Page
• BIG-IP Access Policy Manager Overview (pdf)
• F5 Enhances Application Delivery Security with the World’s Fastest Firewall
• F5's YouTube Channel
• In 5 Minutes or Less Series (23 videos – over 2 hours of In 5 Fun)
• Inside Look Series
• Life@F5

Technorati Tags: f5,big-ip,afm,advanced firewall,in 5,video,silva,security,dos,ddos,v11.3

Connect with Peter:	Connect with F5:

In 5 Minutes or Less Video - IP Intelligence Service

I show you how to configure the IP Intelligence Service available on BIG-IP v11.2, in 5 Minutes or Less.  By identifying relevant IP addresses and leveraging intelligence from cloud-context security solutions, F5's new IP Intelligence service combines valuable information on the latest threats with the unified policy enforcement capabilities of the BIG-IP application delivery platform.   Deployed as part of the BIG-IP system, F5’s IP Intelligence service leverages data from multiple sources to effectively gather real-time IP threat information and block connections with those addresses. The service reveals both inbound and outbound communication with malicious IP addresses to enable granular threat reporting and automated blocking, helping IT teams create more effective security policies to protect their infrastructures.

In 5 Minutes or Less - IP Intelligence Service

A free 30 day evaluation of the IP intelligence service is available.

ps

Related:

• IP Intelligence Service – Datasheet
• IP Intelligence Service – SlideShare Presentation
• Dynamic Perimeter Security with IP Intelligence – White Paper
• IP Intelligence Service
• F5 and Webroot partner for security in the network
• F5 Networks introduces cloud based IP Intelligence service
• F5 Keeps Customers Protected with New IP Intelligence Service
• F5 Networks Launches IP Intelligence Service
• F5 Increases BIG-IP Security with New DNS, IP Intelligence
• F5 Keeps Customers Protected with New IP Intelligence Service
• F5 YouTube Feed

Technorati Tags: F5,big-ip,security,threat prevention,infrastructure,big data,cloud,GDI,ip intelligence

Connect with Peter:	Connect with F5:

The Exec-Disconnect on IT Security

Different Chiefs give Different Security Stories.

A recent survey shows that there is a wide gap between CEOs and Chief Security Officers when it comes to the origin and seriousness of security threats.  They differ on how they view threats to IT Infrastructure  and remain far apart on how to best address an issue that according to analyst reports, costs organizations more than $30 billion annually.  The survey of 100 CEOs and 100 CISO (or other C-levels with security responsibility), shows that the discrepancy is often due to lack of communication.  36% of CEOs said that they never get a security report from their CISO and only 27% receive updates on a regular basis.  Is it the CISO that doesn’t report back or the CEO that is not interested?  Let’s look at some more data.

The CISO felt that the biggest threat was from internal (their employees) due to lack of education and attention while the CEO felt that the biggest threat was from the outside, such as phishing attacks.   Thus, 61% of CEOs said they did have enough time and resources to adequately train the staff on how to mitigate threats while Only 27% of CISOs felt the same.  It’s opposite day.  When asked if their IT systems were ‘definitely’ or ‘probably’ under attack without their knowledge, 58% of CISOs said yes while only 26% of CEOs agreeing.  The chasm grows.  What percentage of each, do you think, said they were very concerned about their IT systems getting hacked?  30 seconds on the clock, please.  Don’t peek.  Only 15% of CEOs and ‘only’ 62% of CISOs are anxious about breaches.  15%?  That’s it?  Maybe they have great confidence in their security team…or, they don’t have the information.  65% of CEOs admitted to not having the sufficient data needed to interpret how security threats translate to overall business risk.  Wow, the very day-to-day operations.  Granted, the CEO is further removed from the specific threats and how they are handled but there is clearly a distance between how each views threats and the company’s ability to successfully mitigate them.

Lack of interest or lack of understanding/information?  Probably both.  An old adage was that a great boss hired people who were good at the things he/she wasn’t so good at.  Surround yourself with those who know their areas better.  Or maybe there is a culture that you don’t alert the top unless it’s dire, critical or unstoppable.   Communication or interest, it is evident that the C-suite isn’t really talking about these critical business issues especially when 3 times as many CEOs worried about losing their jobs following an attack than did CISOs.

ps

References

• SECURITY: A LACK OF CEO INSIGHT OR CEO INTEREST?
• CEOs Lack Visibility Into Origin and Seriousness of Security Threats
• Talking About Security Bores the Boss, Survey Shows
• Myth or Fact? Debunking 15 of the Biggest Information Security Myths
• The CEO/CISO Disconnect Infographic

Technorati Tags: F5, security research, botnet, threat landscape, Pete Silva, security, business, technology, cloud,compliance,regulations, web,internet

Connect with Peter:	Connect with F5:

Complying with PCI DSS–Part 5: Regularly Monitor and Test Networks

According to the PCI SSC, there are 12 PCI DSS requirements that satisfy a variety of security goals.  Areas of focus include building and maintaining a secure network, protecting stored cardholder data, maintaining a vulnerability management program, implementing strong access control measures, regularly monitoring and testing networks, and maintaining information security policies.  The essential framework of the PCI DSS encompasses assessment, remediation, and reporting.  We’re exploring how F5 can help organizations gain or maintain compliance and today is Regularly Monitor and Test Networks which includes PCI Requirements 10 and 11.  To read Part 1, click: Complying with PCI DSS–Part 1: Build and Maintain a Secure Network, Part 2:Complying with PCI DSS–Part 2: Protect Cardholder Data, Part 3: Complying with PCI DSS–Part 3: Maintain a Vulnerability Management Program and Part 4: Complying with PCI DSS–Part 4: Implement Strong Access Control Measures.

Requirement 10: Track and monitor all access to network resources and cardholder data.
PCI DSS Quick Reference Guide description: Logging mechanisms and the ability to track user activities are critical for effective forensics and vulnerability management.  The presence of logs in all environments allows thorough tracking and analysis if something goes wrong.  Determining the cause of a compromise is very difficult without system activity logs.
Solution: The spirit of this requirement is to ensure appropriate systems generate logs, with implementation and monitoring of log aggregation and correlation systems.  The ability to monitor and log all user sessions and requests for access to sensitive information, such as cardholder data and Social Security numbers, is critical to any security environment.  F5 offers a suite of solutions that are session-based, not packet-based. With this full reverse proxy architecture, the BIG-IP platform has the ability to manage full user sessions, regardless of the transport mechanism or network, and match those user sessions to specific data actions, supplying log data and a full audit trail from the user to the data.  This allows F5 application security devices to ensure the confidentiality, integrity, and availability of all application data on the network.
All F5 products support remote logging, allowing logs to be pushed to secure networks and devices for archiving. In addition, the TMOS architecture can manage isolated, secure logging networks in conjunction with the application networks, using features such as mirrored ports, VLANs, and virtualized administrative access.  Protecting network resources and application data 24 hours a day, seven days a week, without affecting network performance, is a core function and the foundation of all F5 security products.

Requirement 11: Regularly test security systems and processes.
PCI DSS Quick Reference Guide description: Vulnerabilities are being discovered continually by malicious individuals and researchers, and being introduced by new software.  System components, processes, and custom software should be tested frequently to ensure security is maintained over time.  Testing of security controls is especially important for any environmental changes such as deploying new software or changing system configuration.
Solution: The spirit of this requirement is to ensure that the complying organization itself tests its security system and processes.  Since F5 does not offer a penetration testing service, this is one of just two PCI DSS requirements that F5 products cannot significantly address.
Next: Maintain an Information Security Policy
ps
Related:

• Complying with PCI DSS–Part 1: Build and Maintain a Secure Network
• Complying with PCI DSS–Part 2: Protect Cardholder Data
• Complying with PCI DSS–Part 3: Maintain a Vulnerability Management Program
• Complying with PCI DSS–Part 4: Implement Strong Access Control Measures
• PCI Turns 2.0
• Will you Comply or just Check the Box?
• Cloud Balancing, Reverse Cloud Bursting, and Staying PCI-Compliant
• BIG-IP v10.1 Application Security Manager PCI Reporting
• Visa Kills PCI Assessments And Wants Your Processor To Support EMV
• Complying with PCI DSS

Technorati Tags: F5, PCI DSS, virtualization, cloud computing, Pete Silva, security, cloud, credit card, compliance, web, internet,cybercrime, holiday shopping, identity theft,

Connect with Peter:	Connect with F5:

Complying with PCI DSS–Part 1: Build and Maintain a Secure Network

According to the PCI SSC, there are 12 PCI DSS requirements that satisfy a variety of security goals.  Areas of focus include building and maintaining a secure network, protecting stored cardholder data, maintaining a vulnerability management program, implementing strong access control measures, regularly monitoring and testing networks, and maintaining information security policies.  The essential framework of the PCI DSS encompasses assessment, remediation, and reporting.  Over the next several blogs, we’ll explore how F5 can help organizations gain or maintain compliance.   Today is Build and Maintain a Secure Network which includes PCI Requirements 1 and 2.

PCI DSS Quick Reference Guide, October 2010

The PCI DSS requirements apply to all “system components,” which are defined as any network component, server, or application included in, or connected to, the cardholder data environment.  Network components include, but are not limited to, firewalls, switches, routers, wireless access points, network appliances, and other security appliances. Servers include, but are not limited to, web, database, authentication, DNS, mail, proxy, and NTP servers.  Applications include all purchased  and custom applications, including internal and external web applications.  The cardholder data environment is a combination of all the system components that come together to store and provide access to sensitive user financial information.  F5 can help with all of the core PCI DSS areas and 10 of its 12 requirements.

Requirement 1: Install and maintain a firewall and router configuration to protect cardholder data.
PCI DSS Quick Reference Guide description: Firewalls are devices that control computer traffic allowed into and out of an organization’s network, and into sensitive areas within its internal network.  Firewall functionality may also appear in other system components. Routers are hardware or software that connects two or more networks. All such devices are in scope for assessment of Requirement 1 if used within the cardholder data environment.  All systems must be protected from unauthorized access from the Internet, whether via e-commerce, employees’ remote desktop browsers, or employee email access.  Often, seemingly insignificant paths to and from the Internet can provide
unprotected pathways into key systems. Firewalls are a key protection mechanism for any computer network.

Solution: F5 BIG-IP products provide strategic points of control within the Application Delivery Network (ADN) to enable truly secure networking across all systems and network and application protocols.  The BIG-IP platform provides a unified view of layers 3 through 7 for both general reporting and alerts and those required by ICSA Labs, as well as for integration with products from security information and event management (SIEM) vendors.  BIG-IP Local Traffic Manager (LTM) offers native, high-performance firewall services to protect the entire infrastructure.  BIG-IP LTM is a purpose-built, high-performance Application Delivery Controller (ADC) designed to protect Internet data centers. In many instances, BIG-IP LTM can replace an existing firewall while also offering scalability, performance, and persistence.   Running on an F5 VIPRION chassis, BIG-IP LTM can manage up to 48 million concurrent connections and 72 Gbps of throughput with various timeout behaviors and buffer sizes when under attack. It protects UDP, TCP, SIP, DNS, HTTP, SSL, and other network attack targets while delivering uninterrupted service for legitimate  connections.  The BIG-IP platform, which offers a unique Layer 2–7 security architecture and full packet inspection, is an ICSA Labs Certified Network Firewall.

Replacing stateful firewall services with BIG-IP LTM in the data center architecture

Requirement 2: Do not use vendor-supplied defaults for system passwords and other security parameters.
PCI DSS Quick Reference Guide description: The easiest way for a hacker to access your internal network is to try default passwords or exploits based on the default system software settings in your payment card infrastructure.  Far too often, merchants do not change default passwords or settings upon deployment.  This is akin to leaving your store physically unlocked when you go home for the night.  Default passwords and settings for most network devices are widely known.  This information, combined with hacker tools that show what devices are on your network, can make unauthorized entry a simple task if you have failed to change the defaults.

Solution: All F5 products allow full access for administrators to change all forms of access and service authentication credentials, including administrator passwords, application service passwords, and system monitoring passwords (such as SNMP).  Products such as BIG-IP Access Policy Manager (APM) and BIG-IP Edge Gateway limit remote connectivity to only a GUI and can enforce two-factor authentication, allowing tighter control over authenticated entry points.  The BIG-IP platform allows the administrator to open up specific access points to be fitted into an existing secure network.  BIG-IP APM and BIG-IP Edge Gateway offer secure,  role-based administration (SSL/TLS and SSH protocols) and virtualization for designated access rights on a per-user or per-group basis.  Secure Vault, a hardware-secured encrypted storage system introduced in BIG-IP
version 9.4.5, protects critical data using a hardware-based key that does not reside on the appliance’s file system.  In BIG-IP v11, companies have the option of securing their cryptographic keys in hardware, such as a FIPS card, rather than encrypted on the BIG-IP hard drive.  The Secure Vault feature can also encrypt certificate passwords for enhanced certificate and key protection in environments where FIPS 140-2 hardware support is not required, but additional physical and role-based protection is preferred. Secure Vault encryption may also be desirable when deploying the virtual editions of BIG-IP products, which do not support key encryption on hardware.

Next: Protect Cardholder Data

ps

Related:

• PCI Turns 2.0

• Will you Comply or just Check the Box?

• Cloud Balancing, Reverse Cloud Bursting, and Staying PCI-Compliant

• BIG-IP v10.1 Application Security Manager PCI Reporting

• Visa Kills PCI Assessments And Wants Your Processor To Support EMV

• Complying with PCI DSS

Technorati Tags: F5, PCI DSS, virtualization, cloud computing, Pete Silva, security, cloud, credit card, compliance, web, internet,cybercrime, holiday shopping, identity theft,

Connect with Peter:	Connect with F5:

In 5 Minutes or Less - FirePass SSL VPN XML Configuration Export

I show you how to export your FirePass SSL VPN configuration into an easy to read XML file, In 5 Minutes or Less.  If you like the ‘In 5 Minutes or Less’ series, check out the playlist on F5’s YouTube channel along with the rest of our videos.

In 5 Minutes or Less - FirePass SSL VPN XML Configuration Export

 

ps

Related:

• F5’s YouTube Channel
• ‘In 5 Minutes or Less’ Series
• Ode to FirePass
• Secure Access with the BIG-IP System | (whitepaper)
• FirePass to BIG-IP APM Migration Service
• F5 FirePass to BIG-IP APM Migration Datasheet
• FirePass Wiki Home
• Audio Tech Brief - Secure iPhone Access to Corporate Web Applications
• In 5 Minutes or Less - F5 FirePass v7 Endpoint Security
• Pete Silva Demonstrates the FirePass SSL-VPN

Technorati Tags: F5, big-ip, integration, firepass, Pete Silva, security, business, education, technology, application delivery, ssl vpn, remote access, context-aware, infrastructure 2.0, video, web, internet

Connect with Peter:	Connect with F5: