Ixia ibypass: Avoid 5 Common Security Risks in One Easy Step

Transcription

1 PRODUCT BRIEF Ixia ibypass: Avoid 5 Common Security Risks in One Easy Step With multi-million-dollar security breaches continuing to make headlines, businesses continue to invest in advanced security defenses next-generation firewalls and intrusion prevention systems (NGFW and NGIPS), data leak prevention (DLP), distributed denial of service (DDoS) mitigation, and others. But along with the obvious challenge of having to manage the growing complexity, deploying multiple security elements inline can introduce new vulnerabilities and put availability at risk. Several of these can be overcome by installing a simple, low-cost device called a bypass switch along with new security elements. At the most basic level, a bypass switch adds a layer of protection against planned and unplanned events taking down security devices and entire network links. Bypass intelligence removes risk and cost during deployment and day-to-day operation, preventing vulnerabilities from arising as you build out your state-of-the-art security infrastructure. Risks Inherent in Inline Security Deployments don t always go as planned Inline tools introduce risk (single points of failure) Next-gen devices may need to fail open Every tool eventually fails or requires maintenance/ updates Let s start with a quick look at the top five vulnerabilities Ixia s Intelligent Bypass (ibypass) switches address: RISK #1. DEPLOYMENTS TAKE TOO LONG AND DON T ALWAYS GO AS PLANNED Large enterprise IT and security teams are used to making the most of limited maintenance windows to perform upgrades and install new devices such as nextgen IPS devices. But if each device takes several hours to install, a large rollout or network upgrade means taking links out of commission for an unacceptable amount of time. Page 1

2 Projects can take even longer if glitches occur unexpectedly. For example, activating a new set of intrusion signatures might impact the live network in unexpected ways, perhaps causing too many false positives to appear, and result in critical traffic being blocked. In both scenarios, installing a bypass switch with each IPS promotes speed and adds insulation. The bypass switch takes mere minutes to install, leaving your team free to add and tinker with configurations at its convenience. New devices can be placed inline with the flip of a switch, without impacting live traffic. Ixia ibypass delivers: Better use of maintenance windows High availability and resilience Faster deployments 5x greater reliability RISK #2. EACH INLINE TOOL ADDS A SINGLE POINT OF FAILURE Large companies may deploy multiple security devices inline to bolster network defenses. This may sound like you are building a staunch line of defense until you consider the fact that any one of these devices could bring down a whole link by going out of service. Each element that introduces a single point of failure brings network uptime, performance, and scalability into question. Attaching each device to an intelligent bypass switch prevents such problems, first by continually monitoring the health of all connected devices, then by allowing traffic to bypass a compromised device and continue to flow. RISK #3. NEXT-GEN DEVICES MAY NOT SUPPORT HIGH AVAILABILITY (HA) When early firewall solutions stalled or lost power, they failed closed, meaning traffic stopped flowing while the device was out of commission. Today, some nextgeneration solutions combining firewall and IPS functionality need to fail open so that traffic can continue to flow while issues get resolved. If the NGIPS function is crucial to application security, traffic must be switched to a backup IPS device in the event of failure. Intelligent bypass allows this to take place very cost-efficiently. Page 2

3 RISK #4. EVERY TOOL FAILS OR REQUIRES MAINTENANCE AT SOME POINT This simple truth gives rise to issues surrounding operational ownership. Your security team prescribes new functionality to safeguard the network, but the team responsible for maintaining the network cautions against maintaining too many inline devices. IPSs and other devices do in fact need to be shut down in order to perform routine servicing or upgrades, configure new policies, or move devices from one segment to another. And in the worst-case scenarios, a breach might occur or traffic stop flowing long enough to cost the company millions of dollars in lost revenues and brand reputation. Bypass functionality allows service to take place at any time with no risk to the network and prevents compromised devices from putting networks and applications at risk. Network 1 Out-of-Band Tool 3 (APM) In-Line Tool 1 (IPS) In-Line Tool 2 (DDoS) RISK #5. YOUR SECURITY ARCHITECTURE WILL NOT SCALE EFFICIENTLY Installing intelligent bypass switches allows new devices to be added or moved between links as needed. New high-density switches support multiple links and inline security devices for a highly flexible and cost-effective solution, allowing new devices to be added at will. Using ibypass VHD (Very High Density), you can also configure service chaining that allows two or more inline security tools to be deployed in sequence on the same network link. WHAT EXACTLY DOES THE BYPASS SWITCH DO? In a recent survey of Ixia customers, more than 90 percent said they would choose availability over security in the event of a device failure. External bypass switches mitigate the need to choose by ensuring high availability W. Agoura Road Calabasas, CA USA Tel Page 3

4 Internal Bypass Switch IPS External Bypass Switch Bypass Switch IPS This includes: Automatically detecting issues with inline tools and alerting the right team to take action Rerouting traffic to backup tools or to the next inline tool Preventing the failed tool from taking down the entire link Ixia s ibypass switches are deployed between inline network devices and in front of security tools, providing a reliable separation point to continuously verify the tools ability to process network traffic. WHY DOES IT NEED TO BE EXTERNAL BYPASS? By now you may be thinking that your NGIPS or firewall comes complete with built in bypass functionality, and this may be true. Visibility offerings such as network packet brokers (NPBs) may also integrate bypass. On the surface, this internal bypass option sounds like one less thing to buy and manage. But what happens when the firewall or NGIPS or NPB in question is the thing that fails? With internal bypass, or no bypass switch at all, you need to wait for a scheduled maintenance window, perhaps get a network change authorization signed, and alert users that service will be interrupted. Page 4

5 External bypass switching also delivers up to five times greater reliability: Bypass Switch Mean Time Between Failure (MTBF) in Hours Integrated 80,000 External 450,000 So, assuming you re convinced of the value external bypass provides, how do you go about choosing the right one? IXIA IBYPASS: INTELLIGENCE FOR BETTER SECURITY Along with reliability and performance, users should factor in two increasingly compelling criteria for any networking investment; namely, intelligence and automation. Ixia s ibypass switches offer compelling advantages on both counts: Flexibility: Can operate as a bypass switch or network tap. In tap mode, ibypass copies and sends traffic to out-of-band security or analytics tools allowing those managing networks to refine configurations without impacting live traffic. In bypass mode, the switch monitors the health of attached devices and can be configured to promote a fail open or fail closed response to occur as needed. High density: Multiple security tools may process traffic from a single network link; a single bypass can support redundant or serial tools. Pre-configured heartbeats speed deployment with industry-leading security solutions. Easy-to-use centralized management includes drag-and-drop functionality through an intuitive user interface and presets that reduce setup time and ongoing support efforts. Versatility to act as a network tap and easily take devices in and out of line. IXIA WORLDWIDE W. Agoura Road Calabasas, CA (Toll Free North America) (Outside North America) (Fax) IXIA EUROPE Clarion House, Norreys Drive Maidenhead SL64FL United Kingdom Sales (Fax) IXIA ASIA PACIFIC 101 Thomson Road, #29-04/05 United Square, Singapore Sales (Fax) Page 5 I Keysight Technologies, 2017