Protecting Your Network From The Inside-Out - Terrapin

WHITE PAPERProtecting Your NetworkFrom the Inside-OutInternal Segmentation Firewall (ISFW)

WHITE PAPER: PROTECTING YOUR NETWORK FROM THE INSIDE–OUT – INTERNAL SEGMENTATION FIREWALL (ISFW)Protecting Your NetworkFrom the Inside-OutInternal Segmentation Firewall (ISFW)Table of ContentsSummary3Advanced Threats Take Advantage of the “Flat Internal” Network4The Answer is a New Class of Firewall – Internal Segmentation Firewall 5ISFW Technology Requirements6Conclusion82www.fortinet.com

WHITE PAPER: PROTECTING YOUR NETWORK FROM THE INSIDE–OUT – INTERNAL SEGMENTATION FIREWALL (ISFW)SummaryFor the last decade organizations have been trying to protect theirnetworks by building defenses across the borders of their network.This includes the Internet edge, perimeter, endpoint, and datacenter (including the DMZ). This ‘outside-in’ approach has beenbased on the concept that companies can control clearly definedpoints of entry and secure their valuable assets. The strategywas to build a border defense as strong as possible and assumenothing got past the firewall.As organizations grow and embrace the latest IT technology such as Mobility and Cloudthe traditional network boundaries are becoming increasingly complex to control andsecure. There are now many different ways into an enterprise network.Key RequirementsnnnCOMPLETE PROTECTION –Continuous inside-out protectionagainst advanced threats with asingle security infrastructureEASY DEPLOYMENT –Default Transparent Mode meansno need to re-architect thenetwork and centrally deployedand ManagedHIGH PERFORMANCE –Multi-gigabit performance supportswire speed East-West trafficNot long ago, firewall vendors marked the ports on their appliances ‘External’ (Untrusted)and ‘Internal’ (Trusted). However, advanced threats use this to their advantage because,once inside, the network is very flat and open. The inside of the network usually consistsof non-security aware devices such as switches, routers and even bridges. So once yougain access to the network as a hacker, contractor or even rogue employee, then youget free access to the entire enterprise network including all the valuable assets.The solution is a new class of firewall – Internal Segmentation Firewall (ISFW), that sits atstrategic points of the internal network. It may sit in front of specific servers that containvaluable intellectual property or a set of user devices or web applications sitting inthe cloud.3www.fortinet.com

WHITE PAPER: PROTECTING YOUR NETWORK FROM THE INSIDE–OUT – INTERNAL SEGMENTATION FIREWALL (ISFW)Once in place, the ISFW must provide instant “visibility” to traffictraversing into and out of that specific network asset. Thisvisibility is needed instantly, without months of network planningand deployment.Most importantly the ISFW must also provide “protection”because detection is only a part of the solution. Sifting throughlogs and alerts can take weeks or months; the ISFW needs todeliver proactive segmentation and real-time protection basedon the latest security updates.Finally, the ISFW must be flexible enough to be placedanywhere within the internal network and integrate with otherparts of the enterprise security solution under a single pane ofmanagement glass. Other security solutions can also provideadditional visibility and protection. This includes the emailgateway, web gateway, border firewalls, cloud firewalls andendpoints. Further, Internal Segmentation Firewalls need toscale from low to high throughputs allowing deployment acrossthe global network.FIGURE 1 – ADVANCED THREAT LIFE CYCLE1It can be seen from the threat life cycle in Figure 1 that once theperimeter border is penetrated, the majority of the activity takesplace inside the boundary of the network. Activities includedisabling any agent-based security, updates from the botnetcommand and control system, additional infection/recruitmentand extraction of the targeted assets.InternalSocial EngineeringZero Days ExploitsMalicious URLsMalicious Apps, moreInfectionThreat VectorThreat Production ReconAPP4ExtractionPackage &Encrypt Stage4Cybercriminals are creating customized attacks to evadetraditional defenses, and once inside, to avoid detection andenable egress of valuable data. Once inside the network thereare few systems in place to detect or better still protectagainst APTs.ExternalScan for vulnerabilitiesDesign phishing emailsCustomize malware, etc.DisposalAdvanced Threats Take Advantageof the “Flat Internal” Network2URLCommunication3Hide, Spread,Disarm, Access,Contact Botnet C&C,Updatewww.fortinet.com

WHITE PAPER: PROTECTING YOUR NETWORK FROM THE INSIDE–OUT – INTERNAL SEGMENTATION FIREWALL (ISFW)The Answer is a New Class of Firewall –Internal Segmentation Firewall (ISFW)Most firewall development over the past decade has beenfocused on the border, the Internet edge, perimeter (hostfirewall), endpoint, data center (DMZ) or the cloud. Thisstarted with the stateful firewall but has evolved to includeUnified Threat Management (UTM) for distributed networks,which brought together the firewall, intrusion detection andantivirus. Later came the Next Generation Firewall (NGFW),which included intrusion prevention, and application controlfor the Internet edge. More recently because of the hugeincrease in speeds, Data Center Firewalls (DCFW) havearrived to provide more than 100Gbps of throughput. All ofthese firewalls have in common an approach designed toprotect from the “outside-in.”For rapid internal deployment and protection, a new class offirewall is required – Internal Segmentation Firewall (ISFW).The Internal Segmentation Firewall has some differentcharacteristics when compared to a border firewall. Thedifferences are laid out in figure 2.FIGURE 2 – FIREWALL TYPE DIFFERENCESDeployment ModeISFWNGFWPurposeVisibility & protectionfor internal segmentsLocationAccess LayerThe ISFW needs to provide complete protectionThe first element of security is visibility. And visibility is onlyas good as network packet knowledge. What does a packetstream look like for a specific application, where did it comefrom, where is it going, even what actions are being taken(download, upload ).The second and equally important element is protection. Isthe application, content or actions malicious? Should thistype of traffic be communicating from this set of assetsto another set of assets? While this is very difficult acrossdifferent content and application types, it is an essential partof the ISFW. The ability to detect a malicious file, applicationor exploit gives an enterprise time to react and contain thethreat. All of these protection elements must be on a singledevice to be effective.Both visibility and protection are heavily reliant on a realtime central security threat intelligence service. A questionthat always needs to posed – how good is the visibility andprotection. Is it keeping up with the latest threats? That’s whyall security services should be measured on a constant basiswith 3rd party test and certification services.UTMCCFWVisibility & protectionHigh performance, lowagainst external threats latency networkand internet activitiesaprotectionVisibility & protectionagainst external threatsand user activitiesNetwork security forService ProvidersInternet GatewayCore Layer/DC GatewayInternet GatewayVariousNetwork Operation Mode Transparent ModeNAT/Route ModeNAT/Route ModeNAT/Route ModeNAT/Route ModeHardware RequirementsHigher port density toprotect multiple assetsGbE and 10GbE portsHigh speed (GbE/10GbE/40 GbE/100) &high port density,hardware accelerationHigh GbE port density,integrated wirelessconnectivity and POEHigh speed (GbE/10GbE/40 GbE) &high port density,hardware accelerationSecurity ComponentsFirewall, IPS, ATP,Application Control(User-based) Firewall,VPN, IPS, ApplicationControlFirewall, DDoS protection Comprehensive andextensible, client anddevice integrationFirewall, CGN, LTE& mobile securityOther CharacteristicsRapid Deployment –Integration withnear zero configuration Advanced ThreatProtection (Sandbox)High AvailabilityHigh Availability5DCFWDifferent WANConnectivity Optionssuch as 3G4Gwww.fortinet.com

WHITE PAPER: PROTECTING YOUR NETWORK FROM THE INSIDE–OUT – INTERNAL SEGMENTATION FIREWALL (ISFW)The ISFW needs to provide easy deploymentThe ISFW must be easy to deploy and manage. Keepingit simple for IT means being able to deploy with minimumconfiguration requirements and without having to re-architectthe existing network.The ISFW must also be able to protect different types ofinternal assets placed at different parts of the network. Itcould be a set of servers containing valuable customerinformation or a set of endpoint devices that may not be ableto be updated with the latest security protection.Additionally the ISFW must be able to integrate with otherparts of the enterprise security solution. Other securitysolutions can also provide additional visibility and protection.This includes the email gateway, web gateway, borderfirewalls, cloud firewalls and endpoints. This all needs to bemanaged with a ‘single pane of glass’ approach. This allowssecurity policies to be consistent at the border, inside thenetwork and even outside the network in clouds.Additionally, traditional firewalls are usually deployed in routingmode. Interfaces (ports) are well defined with IP addresses.This often takes months of planning and deployment. This isvaluable time in today’s instant cyber attack world. An ISFWcan be deployed in the network rapidly and with minimumdisruption. It must be as simple as powering on a deviceand connecting. It must be transparent to the network andapplication.The ISFW needs to provide wire-speed performanceBecause internal segmentation firewalls are deployed in-linefor network zoning, they must be very high performance inorder to meet the demands of internal or “East/West” traffic,and to ensure they do not become a bottleneck at thesecritical points. Unlike firewalls at the border which deal withWide Area Network (WAN) access or Internet speeds ofless than 1 gigabit per second, internal networks run muchfaster – multi-gigabit speeds. There, ISFWs need to operateat multi-gigabit speeds and be able to provide deep packet/connect inspection without slowing down the network.6ISFW Technology RequirementsA Flexible Network Operating SystemAlmost all firewall “deployments modes” require IP allocationand reconfiguration of the network. This is known as networkrouting deployment and provides traffic visibility and threatprevention capabilities. At the other end of the spectrumis sniffer mode, which is easier to configure and providesvisibility, but does not provide protection.Transparent mode combines the advantages of NetworkRouting and Sniffer modes – it provides rapid deploymentand visibility plus, more importantly, protection. Thedifferences are summarized in Figure 3.DeploymentDeploymentNetworkFIGURE3 – FIREWALLTYPE DIFFERENCESHighTrafficAvailability xityFunctionsHighL3-Routing rent mode combines the advantages of NetworkRouting and Sniffer mode. So it provides rapid deploymentand visibility plus more importantly, protection. Thedifferences are summarized in Figure 3.A Scalable Hardware ArchitectureBecause internal networks run at much higher speedsthe ISFW needs to be architected for multi-gigabit protectionthroughput. Although CPU-only based architectures areflexible they become bottlenecks when high throughput isrequired. The superior architecture still uses a CPUfor flexibility but adds custom ASICs to accelerate networktraffic and content inspection.Because the ISFW is deployed in closer proximity to the dataand devices, it may sometimes need to cope with harsherenvironments. Availability of a more ruggedized form factor istherefore another requirement of ISFWs.www.fortinet.com