From firewall to 'firebox' for the data center
Firewalls gain access-control, intrusion-prevention and other functions as they take on server-to-server protection in the data center
By Joanne Cummings
,
Network World
, 03/17/2008
- Share/Email
- Tweet This
- Print

Mercy Medical Center's security wish list is far from atypical. The Baltimore healthcare provider wants to make sure that
users access only the services and servers they require and that its data-center servers remain secure and problem free. Nevertheless,
it hasn't yet found quite the right technology combination.
Network access control (NAC) gear from ConSentry Networks handles the user-access-control piece, but the technology doesn't give Mercy Medical a way to address the additional, server-level
security it would like. (Compare Network Access Control products.)"We want to segregate the servers in the data center from one another," says Mark Rein, the center's senior IT director.
The organization needs this separation because it opens its data-center servers to third-party vendors handling certain management
and maintenance duties. "We want them to access just that one server or application, and not be able to see or talk to any
of the other servers. It's like we need NAC, but at the server level."
This is not an extravagance. "The server is the primary attack-point nowadays, which means that the server is also a great
jumping-off point," says Joel Snyder, a senior partner with Opus One and a Network World product tester. "As organizations
have heterogeneous data centers -- mixes of Unix flavors, Windows, old mainframes -- there are going to be issues with older
systems that might not be patched or closely protected becoming infected and turning into attack vectors for other servers."
That can be an especially brutal problem for enterprises whose security defenses line up at the edge of the data center. If
an attack gets through to a server and rides over unprotected high-speed, server-to-server connections, the enterprise quickly
gets compromised. Never mind the problems encountered when these servers exist in a virtualized environment.
See related story: How to segregate virtual servers
"Most of our servers are virtual servers sitting in blade chassis. When you start looking at how these virtual servers are
potentially talking or co-mingling over the hypervisor to one another, that's a tough problem. At this point, available tool
sets are not really great," Rein says.
As a partial solution to the server-isolation problem, Mercy Medical has selected the PA-4000 Series application firewall
from Palo Alto Networks. "ConSentry handles the end users, but Palo Alto is more server- and application-centric. It allows us to fine-tune what
our outsourcers can do on a particular server," Rein says.
NAC-like server firewalls
Unlike traditional firewalls, which rely on port numbers to differentiate traffic, Palo Alto's appliance is like NAC in that
it can see up to Layer 7. It filters traffic based on application and user role via Microsoft's Active Directory, a tactic that becomes useful as more applications run over the single superhighway of Port 80.
The vendor, however, hasn't integrated some of the higher-end capabilities that users, such as Mercy Medical's Rein, hope
it one day will for even better server-level protection. These include intrusion-prevention systems (IPS) and data-leakage-prevention
services.
Partner Content
www.bmc.com
Gartner 2009 Magic Quadrant for Job Scheduling
Gartner has positioned BMC CONTROL-M in the Leaders Quadrant of their "2009 Magic Quadrant for Job Scheduling." The report assesses the ability to execute and completeness of vision of key vendors in the marketplace. Read a full copy today, courtesy of BMC Software.
Download whitepaper
Dell's SMART Approach to Workload Automation
Read a compelling case study by EMA, Inc. to learn how Dell uses BMC CONTROL-M to cut cost and increase productivity with workload automation.
Download whitepaper
Workload Automation Cost Savings 2 Minute Video
A major computer manufacturer uses BMC CONTROL-M and just four people to schedule and run over 85,000 jobs every month. By switching to BMC CONTROL-M, they more than quadrupled the workload without adding a single staff member. See how in this 2-minute video overview.
Go to video
Comments (2)
You're joking right?By Anonymous on March 19, 2008, 6:18 pmSounds more like an architectural, end user access control issue, using virtual machines when they should not be used and lack of planning. How many people have...
Reply | Read entire comment
Check Point is outdatedBy Anonymous on April 4, 2008, 2:21 am2 Gbps is pretty good, right? Meanwhile, competitors are announcing in-line IPS appliances that can do 10 Gbps of bi-directional traffic inspection.
Reply | Read entire comment
View all comments