Cisco Cisco ASA 5515-X Adaptive Security Appliance - No Payload Encryption Libro blanco
- 3 -
©Nemertes Research 2008
security relationship continues to grow. More outsiders need access to more
services year by year. If a separate DMZ has to be spawned for each partner,
services year by year. If a separate DMZ has to be spawned for each partner,
customer, or supplier to which the enterprise needs to grant specialized access to
specific internal services, the number of DMZs can quickly grow from the
specific internal services, the number of DMZs can quickly grow from the
manageable to the ridiculous. The static associations such structures imply make
sense in a world where resources are stationary and separable, but is
incompatible with the flexible data center and its increasingly interdependent
resources.
incompatible with the flexible data center and its increasingly interdependent
resources.
Organizations want to ensure that they can respond to changes in their
markets and deploy new applications rapidly. With such IT agility as a strategic
focus, reliance on static barriers for security will make the infrastructure less
flexible, and therefore, make the business less agile.
focus, reliance on static barriers for security will make the infrastructure less
flexible, and therefore, make the business less agile.
Agility is a critical
competitive advantage which should not be sacrificed because of security.
Consequently, companies implementing SOA and virtualization for agility must
likewise adopt agile security to match.
likewise adopt agile security to match.
Higher Level Consciousness
The changeable nature of the new data center is only part of the problem
for security, of course. Another major part of the problem is the shift in
application and attack focus up the network stack.
Although attacks at layers two through four are still active and dangerous,
security at those levels is also relatively strong and increasingly ubiquitous.
However, security on layers five through seven lags. At the same time, enterprise
However, security on layers five through seven lags. At the same time, enterprise
applications are rapidly changing in both back-end architecture and front-end
implementations. The move to SOA drives applications to swap internal or binary
implementations. The move to SOA drives applications to swap internal or binary
communications for externalized XML interchanges. The move to unified
communications puts SIP into the center of converged and integrated voice and
data systems.
communications puts SIP into the center of converged and integrated voice and
data systems.
Enterprise operations are now being driven by XML documents, SIP
sessions, SOAP objects, and the like, and this exposes the enterprise to attacks
based on those formats and on the content conveyed within them. Criminals now
based on those formats and on the content conveyed within them. Criminals now
aim attacks at compromising parsers for any or all of these formats, hoping to
break into the system hosting an application by feeding it poisoned content in the
same way they once sought to crash or compromise routers by feeding them
carefully malformed packets. They might also seek to compromise an enterprise
break into the system hosting an application by feeding it poisoned content in the
same way they once sought to crash or compromise routers by feeding them
carefully malformed packets. They might also seek to compromise an enterprise
not by breaking into or taking control of a system but instead by using systems
for their defined purposes but towards bogus ends: in a SOA based inventory
system, for example, well-formed but bogus purchase orders created by criminals
could empty a warehouse and send millions of dollars worth of goods to random
for their defined purposes but towards bogus ends: in a SOA based inventory
system, for example, well-formed but bogus purchase orders created by criminals
could empty a warehouse and send millions of dollars worth of goods to random
or non-existent addresses. And the back end is only part of the problem: Web 2.0
front ends carry some of the same problems into the client side of the picture, as
XML traffic drives the content of client interfaces. Corrupting or hijacking those
streams could effect anything from a simple denial of service to password theft,
data theft, or operational sabotage.
XML traffic drives the content of client interfaces. Corrupting or hijacking those
streams could effect anything from a simple denial of service to password theft,
data theft, or operational sabotage.