Cloud-based Web Threat Management

Security

Everyone is talking about cloud computing in amorphous terms and positioning the cloud for future requirements. This doesn't serve anyone's interest and only confuses the market.

Is cloud computing a reality anywhere? Yes and I have a concrete example in web threat management. To be clear, I am defining web threats as a malicious code propagated through compromised URLs or distributed through social engineering. What makes web threats are more difficult to address than those in the past? A few things:

1. Volume. We are seeing unprecedented growth in malicious code, 200% in 2008 alone.

2. Rapid change. The bad guys know how to alter new malcode so it remains under the radar of existing security defenses. They move from site to site, alter their attack code, etc.

3. Targeted stealthy attacks. Some malicious code waits months before being activated while others target a specific demographic group, geographic location, vertical industry or organization.

4. Trust. Users trust legitimate web sites and social networks so when they are compromised or used to launch Internet con games, they are tough to stop.

For all of these reasons, traditional signature-based security tools don't really work. There are too many signatures to write and distribute, signature databases become bloated quickly, and performance tanks.

So what's the best solution? Cloud-based web threat management. Companies like Blue Coat Systems, Cisco, and Trend Micro have been pushing this model for a while. Soon it will become a critical part of the design in most threat management systems.

In this model, cloud-based intelligence acts as an additional layer of defense supporting onsite devices and endpoint agents. Furthermore, cloud-base web threat management takes advantage of Metcalf's Law. To paraphrase: "The value of a network is proportional to the number of connected users." In this case, users combine to share web threat experiences and intelligence with one another.

If your PC's Internet security software or signature downloads impact your system's boot time or network performance you already know that the signature-based model is unsustainable. The cloud is already proving to be a better mousetrap for web threat management. Performance, coverage, and scaling issues will make it cloud-based security a defacto standard moving forward.

• Blue Coat Systems
• Cisco Sytems
• Trend Micro