-- PAGE 8 --

<< previous page next page >>

Network Security Measurements cont...

This means that by the time an administrator manages to research vulnerabilities, download the patches, and to test and deploy the patches, several new vulnerabilities of an equally severe nature may well have already exploited the same weakness on the system.

In response to these heightened risks, the risk assessment model has been evolving in the following 3 areas.

1: The continuing evolution of the trust model

Terminal computers and servers are not only the target of the attacks, but are also increasingly becoming the source of attacks once hackers seize control over them. In such scenarios, the end-user's identity is authorised on the network. However, the status of the client computer they are using is not authorised on the network, and neither is the computers' behaviour whilst under the control of the hacker. As a result, traditional trust models based on username and password authorisation, privilege assignment and audit fail to meet security requirements adequately under this scenario.

2: The continuing evolution of security threats

Worms, viruses, application layer attacks, together with email phishing, mobile coding, and other integrated “techniques” continue to escalating the risk of infection. Direct attacks to core servers and services lead to millions of dollars worth of losses each year. The statistics for average losses per phishing victim jumped from $257 in 2005 to $1,244 in 2006⁴ and U.S. consumers lost more than $7 billion over the last two years as a result of infection by viruses, spyware, and phishing schemes.⁵ Accordingly, 43% of organisations now say that their information security systems are factored in to the organisation's risk management programmes.⁶ It is likely that these figures will continue to increase.

Also, the popularity of instant messaging systems such as MSN, GoolgeTalk and P2P applications such as BT's Emule increases non-business traffic which can cause significant, and largely unnecessary, bandwidth wastage and performance deterioration on the network. Therefore, traditional unauthorised access threat models based on network layers no longer meet contemporary security requirements.

3: The continuing evolution of business infrastructures and network architectures

With the development of new network applications and enterprise IT infrastructures, businesses continue to introduce new application models. Staff turnover, adjustments to organisational structures and new business sales channels all affect the requisites for the design and implementation of security policies. As such, traditional static operation models and security policies need to adopt more proactive models.

The IPS is one among the security solutions capable of meeting these new security requirements. The assessment framework of an IPS is based upon those elements which enable a security model to evolve and develop in response to the manifestation of new and previously unseen security attacks, and new and emerging organisational requirements. In fact, one of the primary factors that ought to be considered when assessing the performance of an IPS product is its ability to adapt and respond. There are currently over 15 major IPS products and solutions on the market, and when evaluating these, it is important to take a comparative look at their relative capacity to proactively adapt and scale to changing requirements over time. At the same time, it is unhelpful when assessing the business value of these products just to concentrate upon the merits of isolated tools, or upon one single piece of software; rather an overall analysis should be undertaken which measures demonstrable capacity for adaptation, scalability and development of the security model framework over time.

-- PAGE 8 --

<< previous page next page >>

Page 1 | Page 2 | Page 3 | Page 4 | Page 5 | Page 6 | Page 7 | Page 8 | Page 9 | Page 10 | Page 11 | Page 12 | Glossary | References

Notes:

4 AVIVAH LITAN, 1 November 2006, Phishing Attacks Leapfrog Despite Attempts to Stop Them, Available from World Wide Web: http://www.gartner.com

5 Consumer Reports September 2007. [online]. [Accessed 9th September 2007]. Available from World Wide Web: http://www.consumerreports.org:80/

6 ERNST & YOUNG. 2007. Companies only just waking up to privacy and data risks, according to global Ernst & Young study Press release, issued 14 November 2006

Xuhua Ji, September 2007

(You are free to reproduce any of the information in this article or part thereof, so long as the byline remains intact and a link is provided back to this page)

    add to del.icio.us

We offer Windows Server 2003 and Windows Server 2008 training courses: read more

Further reading on network security