Cisco Cisco IPS 4520 Sensor 백서

Page 2 of 6

Figure 2. Distributed Cisco Security Components

Challenges in measuring security efficacy

With the ongoing evolution of the network threat landscape, measuring the efficacy of a security device such as an

IPS sensor can be difficult. At best, the efficacy can be measured at specific points in time. However, even point-

in-time measurements are complicated by the use of complementary threat prevention techniques such as

network reputation.

Most tools for measuring security efficacy introduce predefined threats into the security device under test. In the

case of an IPS, such tools provide a point-in-time measure of traditional IPS techniques (such as protocol-based

decoding or regular-expression-based signatures) but not of Global Correlation, which relies on the measured

real-world reputation of a network. Since test tools typically use synthetic network (IP) addresses as the source

and destination of traffic flows, they cannot measure the efficacy of Global Correlation. Only empirical evidence

can prove the efficacy of such techniques.

Point-in-time measurement of traditional IPS techniques

Thorough testing, even for a single vulnerability, is complicated and requires careful test design. We write

signatures for Cisco IPS sensors to ensure that they are able to detect multiple variants of an attack, not just the

most well-known versions [TST].

We use several third-party tools to track point-in-time efficacy of the traditional techniques in Cisco IPS sensors.

One of these tools is BreakingPoint Storm. Figure 3 shows the standard configuration for testing Cisco IPS

software and signature releases.

The BreakingPoint Storm tool contains a security test component with several presets: security levels 1 through 5

and SMTP Base64 Malware. For a point-in-time measurement, we ran the strikes (tests) in security levels 1

through 3, which contain the most pertinent network security attacks. We did not run the strikes in levels 4 and 5

and in SMTP Base64 Malware; these test for less important network threats, browser-based exploits, and exploits

inside email traffic. Our research has shown that strikes outside of levels 1 through 3 are less relevant for network

IPS sensors and better suited for other parts of the Cisco security portfolio, such as Cloud Web Security, Web

Security Appliances, and Email Security Appliances, which are typically deployed in parallel with Cisco IPS [CWS],

[WSA], [ESA]. As such, security levels 1 through 3 are the best fit for testing traditional IPS techniques.