On guard

Enterprise security involves more than just anti-virus software on every desktop. SMBs need firewalls, IDS/IPS and the rest of the security arsenal

Security awareness among Indian SMBs has risen over the years. However, it is going to be a while before SMBs can call themselves ‘secure’.

The prerequisites are awareness, a well-drafted and implemented security policy and processes and the right technology to back it all up.

Today, network devices—switches and routers—come with integrated security (such as in-built firewall functionality). We will take the comprehensive technology coverage aspect and look at some commonly used security products.

Combating viruses

Viruses continue to pose the biggest threat to networks. Consequently, desktop anti-virus solutions are widely deployed.

Anti-virus is the first line of defence. These solutions have a virus scanning engine to discover viruses. Depending on their capabilities, the solution may be able to scan a computer (desktop and server), e-mail (desktop and mail gateway), network drives etc. The scanning engine compares each file with known patterns to determine if a computer is infected or not. It then repairs or isolates the file according to the type of infection. Some anti-virus solutions use ‘heuristic’ technology to discover fresh viruses whose patterns are not on record. To do this, they detect virus-like activity.

The scanning engine is periodically updated with signatures or patterns from the anti-virus vendor. Your anti-virus software is only as strong as its updates. This is one of the biggest vulnerabilities in desktop anti-virus software. Users may not be concerned about keeping an anti-virus updated at all times and virus infections are the result. This is why it is important that an enterprise anti-virus package should have centralised management and update capabilities.

In the server-based network anti-virus deployment model, the software is run from a central server that downloads updates from the vendor’s servers and ‘pushes’ them across an internal network (LAN) to client desktops and servers. This method is more efficient than individually updating the anti-virus software on each system.

As the update process is managed from a central point, it becomes easier for an administrator to ensure that the protection on all machines is up to date. The arrangement also saves Internet bandwidth as updates are only downloaded once.

Getting an AV fix

Operating system support and centralised management or update are a must have feature when it comes to selecting an anti-virus solution. Apart from protection against viruses and Trojans, protection from spyware and adware is necessary.

Anti-virus solutions come as packaged products or as managed services. If you are choosing a managed service, check on the vendor’s track record and clientèle. Support is another important parameter. Your vendor must provide 24/7 support and online support should be a given.

On the cost front, you have to consider license, support and upgrade costs that are one time in nature. Then there are the recurring (annual) costs—update subscription and maintenance.

When it comes to features, many anti-virus solutions come with free add-on features. Be sure to evaluate these features and whether you really need them. This is essential to avoid going in for an expensive solution with non-essential features.

The second line of defence

Firewalls help protect a network from external threats such as blackhat hackers and malicious traffic. Firewalls are available at the network and the desktop (client) level. They come in two varieties—network layer and application layer firewalls. Yet another way of classifying firewalls is into packet filter, application gateway, circuit level gateway, and stateful inspection types. Firewalls are available as hardware or software. Network firewalls are usually hardware appliances while software firewalls are used to protect desktop PCs.

A very basic (and effective) firewall that can be created is to employ NAT (Network Address Translation) on your switch or router. Firewalls also offer inbuilt NAT, a feature to look out for. In addition to this, features like the number of users allowed to connect and maximum allowed throughput are important. The number of physical connections permitted should also be considered. It is advisable to go in for a firewall with excess specifications to accommodate future growth.

Most available firewalls provide VPN (Virtual Private Network). Here you need to check for the number of concurrent VPN sessions and VPN protocols supported. It is also essential to check for encryption.

Availability features—load balancing and failover (active-active or active-passive) also have to be considered. Clustering is another useful feature if you have high availability requirements. On the management side, look at supported management protocols (SSH, telnet, SNMP, etc.) and the user interface.

Stopping intruders

Intrusion detection systems (IDS) are the next layer of defence after a firewall and an anti-virus system. An IDS helps analyse network traffic to detect attacks and virus or worm attacks that get past anti-virus systems.

An IDS’ functioning is similar to that of an anti-virus solution. A typical IDS compares network traffic patterns, server log files, or applications with signatures of known attacks to detect malicious network activity. Latter day IDS include heuristic features to detect previously undocumented attacks by tracking traffic anomalies.

The common types of IDS are network-based, host-based and application-based. In a network based IDS, the system plugs into the network and monitors network traffic for malicious activity. Host-based IDS tracks a specific host for possible intrusions, and an application-based IDS tracks specific applications. Each of these has its pros and cons and the prices vary. This is why many enterprises prefer to use a combination of IDS types for better security.

Irrespective of the type of firewalls, there are some common parameters of selecting an IDS. These are the bandwidth used, ease of use, management, operating systems supported, and reporting features. First of all, the IDS should be able to rapidly and consistently detect attacks. Consistency in detection is essential to ensure that the IDS performs well even while monitoring a heavily trafficked link. Centralised management should be possible if you are using multiple IDS’. Comprehensive alerting, logging and reporting are necessary prerequisites.

Once an attack has been detected, an IDS can be passive or reactive in nature. A passive IDS will log suspicious activity whereas a reactive IDS will actually implement corrective action. The reactive IDS concept has led to the development a new class of devices called an IPS (Intrusion Prevention Systems). Many recent IPS devices incorporate ‘intelligent’ features, they sport self-learning mechanisms to identify abnormal traffic.