Cisco IPS 7.0 Raises the Bar
Cisco is shipping what it claims is the first intrusion-prevention system (IPS) to correlate IP reputation filtering with signature-based intrusion prevention sensors.
Mon, August 10, 2009
Network World — Cisco is shipping what it claims is the first intrusion-prevention system (IPS) to correlate IP reputation filtering with signature-based intrusion prevention sensors.
Cisco Bolsters Security Family
Slideshow: 11 Security Companies to Watch
Archive of Network World tests
We tested the software upgrade to Cisco's shipping IPS hardware and appliances and found that not only has Cisco increased the value of its IPS in preventing attacks, it has done so in a way that any security manager can easily and intuitively deploy in just minutes.
While there are the rough edges and blank spots you'd expect in any new release, Cisco has set the bar pretty high with this release.
When Cisco acquired Ironport in 2007, it got a hidden gem in the deal: SenderBase, which is Ironport's IP address reputation service. SenderBase originally focused on spam sources, but when Ironport's moved into the Web security gateway business it refocused SenderBase as a more generic service that addressed spam, malware and viruses.
Cisco has taken the SenderBase technology and created yet another reputation service, Cisco SensorBase, which is accessible in the IPS 7.0 software release. We found that SensorBase is tightly integrated with the IPS and, as our testing shows, actually works. (See story on how SensorBase works.)
Security managers can use SensorBase data in two ways. Reputation filtering lets you block all traffic from IP addresses with an extremely bad reputation. This is done regardless of traffic type -- all traffic from these sites will be blocked.
This basic use of reputation filters isn't new, but what's interesting is that Cisco will use this reputation data to change the Risk Rating of security events identified by the IPS. In other words, an event linked to a 'bad' IP address will result in an even higher Risk Rating.
"Risk Rating" is a Cisco-proprietary value, from 0 to 100, that is computed for every event identified by the IPS. Risk Rating lets you prioritize events and decide what to look at and what to ignore.
Prior to IPS 7.0, Risk Rating was computed using six main factors, such as value of the asset being attacked, the danger of the attack, the match between the attack and the target operating system, the quality of the signature, and so on. With IPS 7.0, another factor can be thrown into the mix: the reputation of the attacker as determined by Cisco's SensorBase.
Testing Global Correlation Inspection
In Cisco's IPS products, every event has a Risk Rating and the security manager generally defines three bands of risks: low, medium, and high. For each of the bands, you can then select a set of actions, from logging that an event occurred to actively blocking all traffic from a particular IP address for some period of time. Risk Ratings aren't new -- what's new is the addition of reputation information in 7.0.
