Cisco IPS 7.0 raises the bar

Cisco is shipping what it claims is the first intrusion-prevention system (IPS) to correlate IP reputation filtering with signature-based intrusion prevention sensors.

We tested the software upgrade to Cisco's shipping IPS hardware and appliances and found that not only has Cisco increased the value of its IPS in preventing attacks, it has done so in a way that any security manager can easily and intuitively deploy in just minutes.

While there are the rough edges and blank spots you'd expect in any new release, Cisco has set the bar pretty high with this release.

When Cisco acquired Ironport in 2007, it got a hidden gem in the deal: SenderBase, which is Ironport's IP address reputation service. SenderBase originally focused on spam sources, but when Ironport's moved into the Web security gateway business it refocused SenderBase as a more generic service that addressed spam, malware and viruses.

Click to see: Scorecard

Cisco has taken the SenderBase technology and created yet another reputation service, Cisco SensorBase, which is accessible in the IPS 7.0 software release. We found that SensorBase is tightly integrated with the IPS and, as our testing shows, actually works. (See story on how SensorBase works.)

Security managers can use SensorBase data in two ways. Reputation filtering lets you block all traffic from IP addresses with an extremely bad reputation. This is done regardless of traffic type -- all traffic from these sites will be blocked.

This basic use of reputation filters isn't new, but what's interesting is that Cisco will use this reputation data to change the Risk Rating of security events identified by the IPS. In other words, an event linked to a 'bad' IP address will result in an even higher Risk Rating.

"Risk Rating" is a Cisco-proprietary value, from 0 to 100, that is computed for every event identified by the IPS. Risk Rating lets you prioritize events and decide what to look at and what to ignore.

Prior to IPS 7.0, Risk Rating was computed using six main factors, such as value of the asset being attacked, the danger of the attack, the match between the attack and the target operating system, the quality of the signature, and so on. With IPS 7.0, another factor can be thrown into the mix: the reputation of the attacker as determined by Cisco's SensorBase.

Testing Global Correlation Inspection

In Cisco's IPS products, every event has a Risk Rating and the security manager generally defines three bands of risks: low, medium, and high. For each of the bands, you can then select a set of actions, from logging that an event occurred to actively blocking all traffic from a particular IP address for some period of time. Risk Ratings aren't new — what's new is the addition of reputation information in 7.0.

Global Correlation Inspection raises the Risk Rating for any event when one of the IP addresses involved has a bad reputation.

The difference between Reputation Filtering and Global Correlation Inspection is pretty important: with Reputation Filtering turned on, an extremely bad reputation of -10 will cause all traffic to be dropped. With Global Correlation Inspection turned on, bad reputations will only cause Risk Ratings of events to be raised.