Translated from 日本語 • View original What does Deep Security excel at?
Hello. This is Iwakiri from the ISAO Security Project. This is the fourth time. From this time on, it will be an intermediate edition. In the intermediate section, we will explain how to set up Deep Security. Before that, I would like to talk a little conceptually.
Deep Security is a product called "IDS/IPS" when classified.
I think many people are wondering, "What is IDS/IPS?" See the diagram below.
First, take a look at the three boxes on the far right. The environment that makes up a web service can be divided into three layers.
Web application layer This is the layer where programs created in PHP, Java, etc. are placed. This is where DB and file data and runtime libraries are also included. In principle, it does not work without an OS or middleware. These are created by people from development companies and internal development departments. Some programmers are veterans and some are beginners, so their construction varies greatly. Therefore, it can be said that this layer has the highest number of attacks.
OS/middleware layer OS is Linux and Windows. Middleware is software that runs applications, such as DBs (such as MySQL) and programming languages (such as PHP). These are made by major vendors and volunteers. It is made by engineers with highly specialized skills, so security is fine! It is easy to think, but since both OS and middleware are major software, attackers with high technical skills will target them (so-called attacks that exploit vulnerabilities in OS and middleware). It is also this layer that places malware.
Network layer This is the layer that uses network equipment to manage ports and protocols. Ensure security by properly configuring firewalls and network groups. I think that the security measures of this layer are more standardized (*) than other layers. *There are certain things to do, such as restricting ports and IP addresses.
Next, look at the arrow on the far left. This is the type of cyberattack. Cyber attacks target each layer, so they can be broadly divided into:
- Attacks targeting the web application layer
- Attacks targeting the OS/middleware layer
- Attacks targeting the network layer
It is classified into three categories. And the security products that defend against each attack are also broadly classified into three categories. (Please see the picture of the box color-coded in the middle three)
Web Application Firewall (WAF) primarily protects the web application layer.
Intrusion Detection System/Intrusion Prevention System (IDS/IPS) Mainly protects the OS/middleware layer.
Firewall (F/W) protects the network layer.
Security products that say "mostly" also have the ability to protect other layers. WAF may have the ability to protect the OS/middleware layer, and IDS/IPS may have the ability to protect the web application layer. (The fact that the picture on this box is eroding a little bit in addition to my own layer shows that.)
Because of this, there are quite a few web services that only introduce F/W and IDS/IPS. Normally, I would like to have all three of these products, but there is also a budget relationship (^^;
So, to what extent does Deep Security cover other layers?
The arrows that extend up and down are the covered areas of Deep Security. At first, I said that Deep Security is IDS/IPS, but in fact, it has some WAF functions and F/W functions.
In the beginner section, we introduced the six rules of Deep Security, but let's take a look at which product features these rules correspond to.
Web reputation: This is a feature that both WAF and IDS/IPS are good at.
Intrusion prevention ・Parameter tamper checking: This is a function that WAFs are good at. ・Virtual patching: This is a function that IDS/IPS is good at.
Anti-malware programs: This is a function that IDS/IPS is good at.
Change monitoring: This is a feature that IDS/IPS is good at.
Security log monitoring: This is a feature that IDS/IPS is good at.
Firewall: This is a feature that F/W is good at.
To put it very roughly, disabling firewall rules in environments with F/W or disabling web reputation rules and intrusion prevention (parameter tampering checks) rules in environments with WAF may not cause any real harm (which is not recommended).
However, please note that at least the following rules are the functions that IDS/IPS is good at, so if you disable them, you will not be able to fully fulfill the functions of IDS/IPS.
- Intrusion prevention (virtual patching)
- Fraud Countermeasures
- Change monitoring
- Security log monitoring
Next time, we will explain how to set it up. To be continued...