From firewall to 'firebox' for the data center

Mercy Medical Center's security wish list is far from atypical. The Baltimore healthcare provider wants to make sure that users access only the services and servers they require and that its data-center servers remain secure and problem free. Nevertheless, it hasn't yet found quite the right technology combination.

Network access control (NAC) gear from ConSentry Networks handles the user-access-control piece, but the technology doesn't give Mercy Medical a way to address the additional, server-level security it would like. (Compare Network Access Control products.)"We want to segregate the servers in the data center from one another," says Mark Rein, the center's senior IT director. The organization needs this separation because it opens its data-center servers to third-party vendors handling certain management and maintenance duties. "We want them to access just that one server or application, and not be able to see or talk to any of the other servers. It's like we need NAC, but at the server level."

This is not an extravagance. "The server is the primary attack-point nowadays, which means that the server is also a great jumping-off point," says Joel Snyder, a senior partner with Opus One and a Network World product tester. "As organizations have heterogeneous data centers -- mixes of Unix flavors, Windows, old mainframes -- there are going to be issues with older systems that might not be patched or closely protected becoming infected and turning into attack vectors for other servers."

That can be an especially brutal problem for enterprises whose security defenses line up at the edge of the data center. If an attack gets through to a server and rides over unprotected high-speed, server-to-server connections, the enterprise quickly gets compromised. Never mind the problems encountered when these servers exist in a virtualized environment.

See related story: How to segregate virtual servers

"Most of our servers are virtual servers sitting in blade chassis. When you start looking at how these virtual servers are potentially talking or co-mingling over the hypervisor to one another, that's a tough problem. At this point, available tool sets are not really great," Rein says.

As a partial solution to the server-isolation problem, Mercy Medical has selected the PA-4000 Series application firewall from Palo Alto Networks. "ConSentry handles the end users, but Palo Alto is more server- and application-centric. It allows us to fine-tune what our outsourcers can do on a particular server," Rein says.

NAC-like server firewalls

Unlike traditional firewalls, which rely on port numbers to differentiate traffic, Palo Alto's appliance is like NAC in that it can see up to Layer 7. It filters traffic based on application and user role via Microsoft's Active Directory, a tactic that becomes useful as more applications run over the single superhighway of Port 80.

The vendor, however, hasn't integrated some of the higher-end capabilities that users, such as Mercy Medical's Rein, hope it one day will for even better server-level protection. These include intrusion-prevention systems (IPS) and data-leakage-prevention services.