Application visibility and control enables IT to say "yes" to the business
In Part 1 of this article we examined how enterprises could gain application visibility and control to accommodate programs hosted outside the enterprise, and where they might implement that.
By deconstructing traffic (detecting and decrypting, decoding and de-tunneling), organizations can deduce what applications are on their networks. That requires being able to see all traffic because applications don’t correspond to ports anymore, and to exert control these functions must be done in line. The best place to do this is at the firewall — it sees all traffic, demarcates the trust boundary and can enforce policy. But the traditional enterprise firewall needs a serious overhaul to perform these functions.
On to Part 2. If organizations (and security vendors) can regain application visibility and control the right way, enterprises will realize additional benefits: fine-grained application control, user-based policies and reporting and better content scanning. All of this adds up to the ability to have a far more meaningful conversation with the business – focused on enabling applications, users and appropriate content, rather than just saying, “no”.
Applications aren’t threats. As described in Part 1, controlling applications is simple:
* Block undesirable applications.
* Safely enable good applications (ensure that they are free of threats).
* By policy – not by looking at applications as “threats”.
* Ensure less important applications don’t hurt more important ones.
The above presumes that the network professional knows what each application is, understands its relevance to the business and how it behaves. This knowledge is critical – each application or class of application has to be examined for benefit/risk. If the application provides high value and little risk, the answer is easy. If the application provides high value and high risk, the answer is harder, and IT must mitigate the risks associated with enabling the application.
The business can articulate the value side of the equation. Network and security professionals must come to the table knowing the risks the application carries:
* Can it carry malware?
* Does it chew up bandwidth?
* Does it tunnel other applications?
* Are there vulnerabilities associated with it?
The main point is that applications aren’t threats and therefore need policy control, not the “find it and kill it” mentality reserved for malicious content.
Beyond that, there is application prioritization. Enterprises should, as part of application control, ensure that necessary applications aren’t slowed or squeezed out by acceptable applications. In other words, a degree of application shaping is an appropriate addition to application control.
Bring users into view
In most enterprises, when talk turns to application use/abuse, the next question anybody asks is: Who is responsible? Responding with an IP address in today’s dynamic environments is useless. If you can see the specific application, you should be able to see the user of that application.
Enterprises have been consolidating users into a centralized directory for years, and many have experienced a degree of success. Why not use that for application control?
The first logical use of user/group information is for reporting purposes, such as who is using (or abusing) that particular application? The second use is more powerful, setting policy by user or group.
Most organizations need to go beyond a global, monolithic policy; there’s a need for a finer-grained approach to application enablement. For example, sales and marketing might need to use social networks to market product, or IT might need to use BitTorrent to obtain Linux binaries. Or, executives might need access to World of Warcraft.
The point is once you have fine-grained visibility and control of applications, you’ll need a similar level of granularity of users. There are a few ways of doing this: identification or authentication.
Identification is easier — you’re simply tying the application traffic of a logged-in workstation to the user it’s logged in with. There are a couple of ways to do this – either sniff the login traffic, or use real-time event data from the enterprise directory.
Authentication is significantly harder, requiring secure participation in the authentication scheme (cookies, NTLM, Kerberos), and often necessitating acting as a proxy, which has its own issues.
High-performance content scanning
Once you have the ability to see and control specific applications by user, what else? How about content scanning? There are three kinds of content organizations are concerned about: malicious content (threats), sensitive or confidential content (leaks), and nonproductive/inappropriate content. Functions such as intrusion prevention, antivirus and scanning for confidential data can all be lumped into “content scanning.”
Traditionally, disparate security appliances provide different aspects of content scanning (unified threat management devices attempt to wrap it all up, but often perform poorly). By deconstructing application traffic you’ve done a significant portion of the work of content scanning. The major issue with scanning using traditional approaches is that redundant steps impede traffic (deconstruction, scan for exploits — followed by another deconstruction, scan for viruses, followed by another deconstruction, scan for confidential data and so on).
If you insert a single content scanning step into the process of determining the application, you can gain a tremendous amount of security benefit, with very little performance hit. To collapse content scanning like this, however, requires some redesign
* The ability to deconstruct fully (as described in Part 1), not just the minimum needed for one type of content scanning.
* The idea of collapsing content scanning suggests a single engine – and the enterprise requirement for high performance dictates a stream-based engine.
* A consolidated signature format across the various types of content you’re scanning for (exploits, malware, confidential data).
The result is high-performance content scanning. It isn’t perfect (buffer-based scanning can sometimes do a more thorough job at the cost of introducing significant latency), but it can perform well if implemented correctly.
So, by doing application visibility and control correctly, enterprise network and security professionals have an opportunity to do something that’s previously proven elusive. By approaching the business with application- and user-based policies, and scanning content without slowing down application traffic, network security can start being viewed as a business enabler, rather than a business impediment.
King is director of product marketing for Palo Alto Networks. He can be reached at cking@paloaltonetworks.com.
