Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud

8/22/2019
02:00 PM
Rik Turner
Rik Turner
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
50%
50%

Threat Intelligence Gateways: A Useful Adjunct to Overworked Perimeter Security

Comparative research shows the relative strengths and weaknesses of five TIG vendors and which kinds of security organization will reap the most benefit.

It's fashionable to say that in the age of cloud and teleworking, the network perimeter is no more. That with applications residing in cloud environments and employees, partners, and contractors logging in to work from just about anywhere, the old notion of a "castle-and-moat" defensive barrier around corporate assets is a thing of the past.

Well, the situation has certainly changed quite a bit, but the success of next-generation firewall (NGFW) vendors shows that there is still a lot of investment in good old edge security, i.e. technology deployed on the real, or increasingly on the theoretical edge of a network to keep bad guys and malicious stuff out.

Now, with estimates to suggest that enterprise IT systems are attacked every 39 seconds, or around 2,500 times per day, it is clear that whatever security measures we have in place to keep out attackers are under considerable pressure. Those will often include a firewall and, particularly, if it is of the aforementioned next-generation variety, it will come with a lot of compute power on board to inspect all incoming traffic in a stateful manner, all the way to the application layer (7 in the OSI model).

Enter the TIG
But what if we could lighten that burden by proactively blocking what we know to be bad before it even gets to the NGFW? Enter the threat intelligence gateway (TIG), a class of security tool that has emerged in recent years to do just this. TIGs are stateless devices deployed between a corporate router and an NGFW, effectively blocking the known bad, based on a prior knowledge of malicious URLs and compromised IP addresses, before the traffic ever gets to the firewall. This reduces the traffic to the firewall and enables the firewall to focus its CPU cycles on inspecting for the more complex and subtler attack types that warrant attention.

Where does that prior knowledge come from, and how trustworthy and up to date will it be when we get it? Clearly, this is outside the purview of the TIG itself, speaking instead to the kinds of threat intelligence enterprise customers are now commonly ingesting to inform their security decision-making. In a recent report, Ovum looked at the offerings of five of the most representative TIG vendors, and it is no coincidence that a number of them spoke of TIG's ability to integrate with threat intelligence platforms, or TIPs, a very similar acronym describing technology that ingests, aggregates, and normalizes threat feeds from commercial and open source providers, often enhancing it with a customer's own threat data.

The vendors and products we looked at were:

  • Bandura Cyber: Bandura TIG
  • Centripetal: RuleGATE
  • Ixia: TheatARMOR
  • LookingGlass: scoutSHIELD
  • Netscout: Arbor Edge Defense

Of this group, Ixia and Netscout have the longest pedigrees in the industry, with Ixia being a major name in security testing and Netscout a network monitoring/service assurance vendor that expanded into security with its 2015 acquisition of Arbor Networks. Interestingly, only LookingGlass has both a TIG and a TIP in its portfolio, though clearly all the TIGs can integrate with third-party TIPs.

As a later entrant into the market, Netscout has sought to differentiate its offering by highlighting its ability to inspect both inbound and outbound traffic, enabling it to block data exfiltration attempts or simply employee errors, and making it both a first and last line of defense, as it were. Since then, the other vendors have also begun expounding their outbound credentials too.

Who Benefits?
To some extent, a TIG can be thought of as an instantiation in software, and sometimes with some dedicated hardware in support, of the black- and whitelists that have helped web and content filtering devices decide what to block for many years. More dynamically, however, their integrations with TIPs make it possible to make threat intel actionable, since TIPs are data processing platforms while TIGs are enforcement devices.

That said, they are clearly not for everyone. It was Ovum's conclusion that TIGs can be a useful a useful additional to the arsenal of defensive tools employed by an enterprise, and particularly one that is in threat actors' crosshairs, such as in the financial sector, healthcare, or the defense sector.

If you are already taking a threat feed or two and are reasonably happy with their accuracy and timeliness, applying them in a TIG for enforcement purposes may be a quick and easy win, in terms of reducing the burden on both your firewall estate and your security staffers.

Ovum is less certain that TIGs are appropriate for smaller or even midsize companies. While they hold the promise of automating away some of the blocking activity from your firewall and your security team, you should at least have a security team large enough to manage the TIG, periodically checking on the accuracy of the threat intel it is receiving and reviewing a list of what has been blocked to keep false positives at a minimum. If you don't have someone to do that, the only way to use a TIG would be via a service provider and, as yet, such services are not available.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "You Gotta Reach 'Em to Teach 'Em.

Rik is a principal analyst in Omdia's IT security and technology team, specializing in cybersecurity technology trends, IT security, compliance, and call recording.  He provides analysis and insight on market evolution and helps end users determine what type of ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 5/28/2020
GDPR Enforcement Loosens Amid Pandemic
Seth Rosenblatt, Contributing Writer,  5/27/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Can you smell me now?
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-11019
PUBLISHED: 2020-05-29
In FreeRDP less than or equal to 2.0.0, when running with logger set to "WLOG_TRACE", a possible crash of application could occur due to a read of an invalid array index. Data could be printed as string to local terminal. This has been fixed in 2.1.0.
CVE-2020-11038
PUBLISHED: 2020-05-29
In FreeRDP less than or equal to 2.0.0, an Integer Overflow to Buffer Overflow exists. When using /video redirection, a manipulated server can instruct the client to allocate a buffer with a smaller size than requested due to an integer overflow in size calculation. With later messages, the server c...
CVE-2020-11039
PUBLISHED: 2020-05-29
In FreeRDP less than or equal to 2.0.0, when using a manipulated server with USB redirection enabled (nearly) arbitrary memory can be read and written due to integer overflows in length checks. This has been patched in 2.1.0.
CVE-2020-11041
PUBLISHED: 2020-05-29
In FreeRDP less than or equal to 2.0.0, an outside controlled array index is used unchecked for data used as configuration for sound backend (alsa, oss, pulse, ...). The most likely outcome is a crash of the client instance followed by no or distorted sound or a session disconnect. If a user cannot ...
CVE-2020-1798
PUBLISHED: 2020-05-29
HUAWEI P30 smartphones with versions earlier than 10.1.0.135(C00E135R2P11) have an improper authentication vulnerability. A logic error occurs when handling NFC work, an attacker should establish a NFC connection to the target phone, and then do a series of operations on the target phone. Successful...