AT&T: Network perimeter security should be virtual
635804
(InfoWorld) - Enterprise companies will soon begin offloading many of their network security responsibilities to telecommunications and Internet service providers and save vast amounts of time and money doing so, if AT&T has its way. Speaking to the assembled crowd at the IDC Security Forum in New York on Wednesday, Edward Amoroso, chief security officer for AT&T's services division, predicted that enterprises will begin adopting more "virtual" security capabilities from their ISPs and bandwidth providers in the coming years as those companies are better positioned to do battle with botnets, spam, and denial-of-service )DoS) threats. Based on the bandwidth-providers' existing abilities to see spikes in traffic that are tell-tale signs of botnet, spam, or other malware activity -- long before enterprises can see evidence of the attacks on their own -- Amoroso contends that companies will soon concede the process of fighting the threats and turn to companies such as AT&T for help. "We think that security at the perimeter should be virtual, which is a somewhat controversial concept, because a lot of time, effort, and career capital has already been spent securing the perimeter," Amoroso said. "But we think a lot of existing technologies there are running out of legs, and simply running firewalls at the gateway is no longer a valuable proposition." The United States government's Telecommunications act of 1996 prevents carriers from approaching customers and marketing services to them based on any trends they observe on the end users' network connections. However, the companies can already identify much of the spam and malware activity being carried out in the pipe, based on their massive infrastructure, and should be enlisted to help solve security issues, he said. For threats such as distributed DoS that can easily be thwarted upstream, the CIO said, it makes little sense for companies to continue to invest in new technologies and staff when the carriers could easily detect and snuff out the campaigns ahead of time. "How do you stop DDoS at the edge? The physics just don't make sense. When these attacks happen, the customers' routers will already be dead," said Amoroso. "We think the idea that the pipe should be dumb is strange; with spam accounting for 90 percent of all traffic on the e-mail pipe, we're delivering nothing but more attacks, malware, and junk. If people want us to keep doing that we can, but why would they want us to keep doing that when we can see it, scoop it, study it, and stop it?" Lest someone should contend that AT&T and other carriers are merely licking their chops at the prospect of adding pricey new security services to their products, the expert said security services should eventually become a set of non-optional capabilities included with the purchase of ISP and telephony services. Much as the carrier community focused on providing faster services in the 1980s and added tools to improve quality to their products in the 1990s, the CIO said that security services will become a de facto element of all the capabilities that the firms market. While early adopters are already paying a premium to use the security capabilities offered by carriers today, eventually the price should be blended into the packages of capabilities that companies buy from providers such as AT&T, the expert predicted. At the same time, AT&T and other carriers would have to sacrifice their existing businesses of selling firewall management and intrusion detection-type systems into enterprises, he said. But the move to push security tools to the bandwidth providers is one that has been made even more likely by the complexity of those technologies. "I think we'll come out of this decade thinking it was silly to have separate perimeter security systems, it doesn't make sense to build the network and overlay security as an afterthought," Amoroso said. "We have as large of a managed security services business as anyone, but this work is better off embedded in the pipeline." Emerging mobile and Voice over Internet Protocol (VoIP) services will also include integrated security capabilities that replace many of the systems being implemented to protect those technologies today, according to the AT&T CIO. "We can virtualize these things, and any carrier can do it; this is the direction that perimeter security is headed in. It's not a collision course, but rather something very pleasant, as finally there's something smooth and simple to solve these problems," he said. "It's absurd that all we hear today is that the carrier plays no role in all of this, that companies should do it at the edge. We know it's a lot of work, but we're already prepared to do it."
607278
This article discusses how a virus outbreak will produce a few unique opportunities to examine the health of an organization's network -- and learn ways to further harden the network from future automated attacks.
435313
VMware, a maker of software that enables computers to run multiple operating systems simultaneously, is working on a new product to make it secure for corporations to open their networks to contractors or telecommuters.
35029
Unpatched vulnerabilities may leave computers open to remote attacks.
265787
Oregon provider cautiously implements dependable network amid minefield of security, performance and privacy concerns.
509744
Letter: Setting the record straight on network location awareness and Vista Group Policy.
680558
Jon Oltsik says the explosion in broadband use forces a rethinking of Internet security. But a lethargic vendor response is not a promising harbinger.
415230
As networks increase in size and complexity, security products are growing in sophistication and security threats are becoming more ingenious.
737263
This paper discusses the use of NetFlow, a traffic profile monitoring technology available on many routers, for use in the early detection of worms, spammers, and other abnormal network activity in large enterprise networks and service providers. Part 2 of 2.
328112
The ground rules of the tests of Cisco and Avaya systems.
41861
Wireless networks should soon be safer to use as their in-built security systems get an overhaul.
239509
Software maintains security on laptops when they're outside the network.
405976
Letters: Going deeper on the question of security and operating systems.
623553
(InfoWorld) - Security researchers and experts this week cautioned network administrators to consider carefully whether they need to implement network access control (NAC) technology in their security infrastructure before buying in to the current hype surrounding it. Speaking on a panel at the Interop New York conference Josh Corman, host protection architect for Internet Security Systems, said that a company should have good reason to implement NAC, not just purchase the technology because it's the latest "buzzword" in the industry. "Do you want NAC because you heard itâs important or do you have real business problems to solve?" he said. NAC allows companies to perform health checks on end-point devices such as PCs and mobile devices before they are granted access to company networks. For example, employee PCs might be checked to make sure they are not infected with a virus and have up-to-date antivirus definitions before being allowed onto a corporate LAN. Corman was joined on the panel by Mike McKinnon, American director of security for Hewlett-Packard's ProCurve networking business; Elliott Glazer, direct of security architecture and consulting for Depository Trust and Clearing Organization; and Paul Stamp, a security analyst with Forrester Research. Speaking from a customer perspective, Glazer said he is more concerned at the moment with making sure the network infrastructure in his company itself is secure before worrying about how that network can check on the health of devices coming on to the network. "One of the fundamental things that has to be considered when you think about NAC is, is the network secure enough?" he said. "When I look at NAC, I say it's a great thing to do, but what do I do when someone comes in with a new piece of hardware -- what's it going to do to my network? Before I go down a NAC path, I'm going to make sure there is a secure environment there for me." "There's a lot of great stuff about NAC, but for us it's a little early," Glazer said. Forrester's Stamp said that for NAC to work effectively, companies involved in providing network security and those developing client technology must work together to make sure the networks can communicate effectively with endpoint devices. "[In NAC] it is the client-based technologies that are giving us the information, it is the client-based technologies that have to deal with any of the problems that arise," he said. "We as security are setting the policies, but the policies are taken into actionable rules by endpoint people. We have to be open to that and help them out. ... We really have to embrace the involvement of the endpoint guys."
664008
Leveraging IP Network Resources to Enable Next-Generation Corporate Communications.
371946
TechWeb - New Secure Connector feature gives remote users secure network-level access, including access to business applications, data, and network services.
556487
By Anonymous  Real networks (of computers, phones or people) can and will go wrong, but the word itself won't let you down.