Translated from 日本語 • View original Anti-malware is a measure against known threats.
Hello. This is Iwakiri for the security project. This is the second time.
Last time, I talked about how "anti-malware alone cannot protect a server", but to put it simply, anti-malware is a measure against "known threats".
What is really scary is the "unknown threat"
Unknown threats, which means that you may not be able to deal with new malware species. It takes time to identify new types of malware, so by the time they are confirmed, they may already be infected and cause great damage.
Server security is the same as health management.
If we compare a server to a human, maintaining security is similar to maintaining health, i.e., managing health. The basis of health management is to observe changes in daily physical condition. And if you find signs of illness, go to the hospital or take medicine to deal with it early. In the same way, servers need to be carefully observed (monitored and detected) from a security perspective, and if something is wrong, it should be dealt with as soon as possible (prevention or elimination).
Deep Security detects and defends against with 6 rules.
The six rules refer to the following functions, as I mentioned last time.
- Web reputation
- Intrusion Prevention
- Fraud Countermeasures
- Change monitoring
- Security log monitoring
- Firewall
And these six rules can be broadly classified into three categories.
- Detection only rules
- Rules for defense (extermination)
- Rules that allow you to choose whether to detect or prevent
Let's take a look at each rule.
Web Reputation
"Reputation" means reputation. Block access to disreputable (malicious websites). Think of it as a feature that blocks directors to phishing sites. Suppose the site has been tampered with and has links to malicious sites or redirects. Even if you don't notice this anomaly at the timing of the tampering, it will prevent it when you try to access the link.
This web reputation is a "rule that makes a defense". In other words, if you enable it, you will not be able to access malicious sites certified by Trend Micro (*). *You can adjust the level of access control.
Intrusion Prevention
Along with "anti-malware", I think it is the most used rule in Deep Security. Broadly categorized, there are two functions:
- Virtual patches
- Parameter tampering check
Virtual Patches
If a vulnerability is discovered in the OS/middleware/software, it should be patched immediately. However, since patches are directed directly to vulnerable OS/middleware/software, there is a possibility that a specification change may occur and applications running on these environments will not work as before. This means that if a vulnerability is discovered, it cannot be patched immediately.
That's why we're going to use this virtual patch. When a vulnerability is discovered, a virtual patch is released to filter the vulnerability. It keeps the OS/middleware/software version intact and puts a lid on vulnerabilities. In addition, virtual patches may be released for vulnerabilities for which no countermeasure patches exist, so they are also effective for zero-day attacks.
However, this is a temporary measure until the "application behavior check" is completed after the official patch is applied, so be sure to apply the official patch in the end.
Parameter Tamper Check
To put it simply, it is an attack that tamperes with the GET/POST parameter. With GET, you can rewrite the parameters in the URL into OS commands, SQL commands, or JavaScript, and access the database or OS files to extract the information. Cross-site scripting and SQL injection are famous. Parameter tampering checking is an area where security products called "Web Application Firewall (WAF)" excel. Deep Security is not as powerful as a WAF, but it does have this feature.
These intrusion defenses are "rules that allow you to choose whether to detect or defend". Intrusion prevention rules risk stopping services depending on the design of the application, so we will wait and see how it goes in detection mode at first. Then, if you find a false positive (mistaking a normal access for an attack), fix the application or adjust the level of intrusion prevention rules (for example, lowering the threshold) to eliminate the false positive. When the false positives are gone, switch to defense mode.
This is the explanation of "web reputation" and "intrusion prevention". Next time, I will explain the remaining four rules. To be continued...
If you want to set up and operate Deep Security, you can do it!