Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud

8/22/2019
02:00 PM
Rik Turner
Rik Turner
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
50%
50%

Threat Intelligence Gateways: A Useful Adjunct to Overworked Perimeter Security

Comparative research shows the relative strengths and weaknesses of five TIG vendors and which kinds of security organization will reap the most benefit.

It's fashionable to say that in the age of cloud and teleworking, the network perimeter is no more. That with applications residing in cloud environments and employees, partners, and contractors logging in to work from just about anywhere, the old notion of a "castle-and-moat" defensive barrier around corporate assets is a thing of the past.

Well, the situation has certainly changed quite a bit, but the success of next-generation firewall (NGFW) vendors shows that there is still a lot of investment in good old edge security, i.e. technology deployed on the real, or increasingly on the theoretical edge of a network to keep bad guys and malicious stuff out.

Now, with estimates to suggest that enterprise IT systems are attacked every 39 seconds, or around 2,500 times per day, it is clear that whatever security measures we have in place to keep out attackers are under considerable pressure. Those will often include a firewall and, particularly, if it is of the aforementioned next-generation variety, it will come with a lot of compute power on board to inspect all incoming traffic in a stateful manner, all the way to the application layer (7 in the OSI model).

Enter the TIG
But what if we could lighten that burden by proactively blocking what we know to be bad before it even gets to the NGFW? Enter the threat intelligence gateway (TIG), a class of security tool that has emerged in recent years to do just this. TIGs are stateless devices deployed between a corporate router and an NGFW, effectively blocking the known bad, based on a prior knowledge of malicious URLs and compromised IP addresses, before the traffic ever gets to the firewall. This reduces the traffic to the firewall and enables the firewall to focus its CPU cycles on inspecting for the more complex and subtler attack types that warrant attention.

Where does that prior knowledge come from, and how trustworthy and up to date will it be when we get it? Clearly, this is outside the purview of the TIG itself, speaking instead to the kinds of threat intelligence enterprise customers are now commonly ingesting to inform their security decision-making. In a recent report, Ovum looked at the offerings of five of the most representative TIG vendors, and it is no coincidence that a number of them spoke of TIG's ability to integrate with threat intelligence platforms, or TIPs, a very similar acronym describing technology that ingests, aggregates, and normalizes threat feeds from commercial and open source providers, often enhancing it with a customer's own threat data.

The vendors and products we looked at were:

  • Bandura Cyber: Bandura TIG
  • Centripetal: RuleGATE
  • Ixia: TheatARMOR
  • LookingGlass: scoutSHIELD
  • Netscout: Arbor Edge Defense

Of this group, Ixia and Netscout have the longest pedigrees in the industry, with Ixia being a major name in security testing and Netscout a network monitoring/service assurance vendor that expanded into security with its 2015 acquisition of Arbor Networks. Interestingly, only LookingGlass has both a TIG and a TIP in its portfolio, though clearly all the TIGs can integrate with third-party TIPs.

As a later entrant into the market, Netscout has sought to differentiate its offering by highlighting its ability to inspect both inbound and outbound traffic, enabling it to block data exfiltration attempts or simply employee errors, and making it both a first and last line of defense, as it were. Since then, the other vendors have also begun expounding their outbound credentials too.

Who Benefits?
To some extent, a TIG can be thought of as an instantiation in software, and sometimes with some dedicated hardware in support, of the black- and whitelists that have helped web and content filtering devices decide what to block for many years. More dynamically, however, their integrations with TIPs make it possible to make threat intel actionable, since TIPs are data processing platforms while TIGs are enforcement devices.

That said, they are clearly not for everyone. It was Ovum's conclusion that TIGs can be a useful a useful additional to the arsenal of defensive tools employed by an enterprise, and particularly one that is in threat actors' crosshairs, such as in the financial sector, healthcare, or the defense sector.

If you are already taking a threat feed or two and are reasonably happy with their accuracy and timeliness, applying them in a TIG for enforcement purposes may be a quick and easy win, in terms of reducing the burden on both your firewall estate and your security staffers.

Ovum is less certain that TIGs are appropriate for smaller or even midsize companies. While they hold the promise of automating away some of the blocking activity from your firewall and your security team, you should at least have a security team large enough to manage the TIG, periodically checking on the accuracy of the threat intel it is receiving and reviewing a list of what has been blocked to keep false positives at a minimum. If you don't have someone to do that, the only way to use a TIG would be via a service provider and, as yet, such services are not available.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "You Gotta Reach 'Em to Teach 'Em.

Rik is a principal analyst in Ovum's IT security and technology team, specializing in cybersecurity technology trends, IT security, compliance, and call recording. He provides analysis and insight on market evolution and helps end users determine what type of technology and ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
AI Is Everywhere, but Don't Ignore the Basics
Howie Xu, Vice President of AI and Machine Learning at Zscaler,  9/10/2019
Fed Kaspersky Ban Made Permanent by New Rules
Dark Reading Staff 9/11/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-4147
PUBLISHED: 2019-09-16
IBM Sterling File Gateway 2.2.0.0 through 6.0.1.0 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 158413.
CVE-2019-5481
PUBLISHED: 2019-09-16
Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.
CVE-2019-5482
PUBLISHED: 2019-09-16
Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.
CVE-2019-15741
PUBLISHED: 2019-09-16
An issue was discovered in GitLab Omnibus 7.4 through 12.2.1. An unsafe interaction with logrotate could result in a privilege escalation
CVE-2019-16370
PUBLISHED: 2019-09-16
The PGP signing plugin in Gradle before 6.0 relies on the SHA-1 algorithm, which might allow an attacker to replace an artifact with a different one that has the same SHA-1 message digest, a related issue to CVE-2005-4900.