The defensive perimeter of firewalls and intrusion-detection systems that most companies rely on for network security is being bypassed by hackers who have made Web applications their newest targets, security experts warned last week.
"Perimeter defense is becoming an irrelevant term," said Kevin Soo Hoo, senior security architect at US security consultancy @Stake Inc. "The emphasis [in hacking] is now shifting to the application layer. The Web application is becoming the primary vehicle for attack."
The increased demand for Web functionality has pushed almost all traffic through Ports 80 and 443 on most Web servers -- typically the only two ports that are left open by most companies. And that's where hackers are turning to gain access to enterprise networks and data, said Soo Hoo. "As a result, the threat model is changing. It makes the firewall no longer the line of defense that it once was."
Soo Hoo made his comments last week in a live webcast sponsored by Stratum8 Corp.
Stratum8 recently introduced an application firewall appliance that's designed specifically to defend against the type of threats outlined in trend data released by @Stake. Known as the Application Protection System (APS), the device sits between the firewall and the Web server and interprets the type of processes the server is attempting to perform by analyzing incoming and outgoing traffic. Based on that analysis, it can block any traffic that contains malicious code, said Abhishek Chauhan, Stratum8's chief technology officer.
The APS ships as an appliance and requires no software installation or customized configuration. In addition, Chauhan claimed that by blocking malicious code attempting to pass through HTTP ports, the technology lowers costs by reducing the number of security incidents that must be investigated. It also allows security managers to do what Chauhan called "intelligent patching" of new vulnerabilities.
Exostar LLC, a large aerospace and defense collaboration service provider, has tackled the issue of securing the Web applications of its users, including BAE Systems, The Boeing Co., Lockheed Martin Corp., Raytheon Co. and Rolls-Royce PLC. However, to secure its Web-enabled aerospace collaboration environment, known as ForumPass, Exostar chose hardware-based encryption technology from nCipher Corp.
Exostar is using nCipher's nShield hardware security module (HSM) to provide database and document encryption within the exchange and for XML-based security used to integrate external applications and Web services.
The nCipher HSM provides end-to-end encryption and digitally signs all transactions by means of the Security Assertion Markup Language, a secure XML-based language used by Web services for the exchange of authentication information and security credentials from one site to another or for users to gain access to Web applications.
"The mind-set of aerospace and defense companies is that they don't want their intellectual property to be anywhere but under their control," said Jeff Nigriny, security manager at Exostar. But the traditional practice of encrypting databases often leaves the encryption key with the database, potentially allowing skilled hackers to steal the key.
"Now we're protecting the key inside one of nCipher's HSMs," said Nigriny. "Because the key never leaves the hardware device, it's never exposed to somebody who has control of the file system. The data is more secure now than it would be on [our users'] own internal networks."
Firewalls are anything but irrelevant, said Neil Gehani, senior product manager at Check Point Software Technologies Ltd. He said that although all commercial firewalls are rules-based, many don't inspect the content of the data passing through them. Check Point, however, has a patented technology that looks "deeper into the content of Port 80, including other things like peer-to-peer connections and instant messaging," said Gehani.
"Other firewalls assume a lot of things about the packets that are passing through the port," he said, adding that malicious code can mask itself as HTTP content.