We had a little trouble coming up with a novel and pithy backdrop for what you will see in the Network Security space at RSAC 2015. We wonder if this year we will see the first IoT firewall, because hacking thermostats and refrigerators has made threat models go bonkers. The truth is that most customers are trying to figure out what to do with the new next-generation devices they already bought. We shouldn’t wonder why the new emperor looks a lot like the old emperor, when we dress our new ruler (NGFW) up in clothes (rules) that look so similar to our old-school port- and protocol-based rulesets.

But the fact is there will be some shiny stuff at this year’s conference, largely focused on detection. This is a very productive and positive trend—for years we have been calling for a budget shift away from ineffective prevention technologies to detecting and investigating attacks. We see organizations with mature security programs making this shift, but far too many others continue to buy the marketing hyperbole, “of course you can block it.” Given that no one really knows what ‘it’ is, we have a hard time understanding how we can make real progress in blocking more stuff in the coming year.

Which means you need to respond faster and better. Huh, where have we heard that before?

Giving up on Prevention…

Talking to many practitioners over the past year I felt like I was seeing a capitulation of sorts. There is finally widespread acknowledgement that it is hard to reliably prevent attacks. And we are not just talking about space alien attacks coming from a hacking UFO. It’s hard enough for most organizations to deal with Metasploit.

Of course we are not going all Jericho on you, advocating giving up on prevention on the network. Can you hear the sigh of relief from all the QSAs? Especially the ones feeling pressure to push full isolation of protected data (as opposed to segmentation) during assessments. Most of those organizations cannot even manage one network, so let’s have them manage multiple isolated environments. That will work out just great.

There will still be a lot of the same old same old—you still need a firewall and IPS to enforce both positive (access control) and negative (attack) policies on your perimeter. You just need to be realistic about what they can block—even shiny NGFW models. Remember that network security devices are not just for blocking attacks. We still believe segmentation is your friend—you will continue to deploy those boxes, both to keep the QSAs happy and to make sure that critical data is separated from not-so-critical data.

And you will also hear all about malware sandboxes at the RSAC this year. Again. Everyone has a sandbox—just ask them. Except some don’t call them sandboxes. I guess they are discriminating against kids who like sand in today’s distinctly un-politically-correct world. They might be called malware detonation devices or services. That sounds shinier, no? But if you want to troll the reps on the show floor (and who doesn’t?), get them to debate an on-premise approach versus a cloud-based approach to detonation. It doesn’t really matter what side of the fence they are on, but it’s fun seeing them get all red in the face when you challenge them.

Finally, you may hear some lips flapping about data center firewalls. Basically just really fast segmentation devices. If they try to convince you they can detect attacks on a 40gbps data center network, and flash their hot-off-the-presses NSS Lab results, ask what happens when they turn on more than 5 rules at a time. If they bother you, say you plan to run SSL on your internal networks and the device needs to inspect all traffic. But make sure an EMT is close by, as that strategy has been known to cause aneurysms in sales reps.

To Focus on Detection…

So if many organizations have given up trying to block all attacks, what the hell are they supposed to do? Spend tons of money on more appliances to detect attacks they missed at the perimeter, of course. And the security industrial complex keeps chugging along. You will see a lot of focus on network-based threat detection at the show. We ourselves are guilty of fanning the flames a bit with our new research on that topic.

The fact is, the technology is moving forward. Analyzing network traffic patterns, profiling and baselining normal communications, and then looking for stuff that’s not normal gives you a much better chance of finding compromised devices on your networks. Before your new product schematics wind up in some non-descript building in Shanghai, Chechnya, Moscow, or Tel Aviv. What’s new is the base of analysis possible with today’s better analytics. Booth personnel will bandy about terms like “big data” and “machine learning” like they understand what they even mean. But honestly baselines aren’t based only on Netflow records or DNS queries any more—they can now incorporate very granular metadata from network traffic including identity, content, frequency of communication, and various other attributes that get math folks all hot and bothered.

The real issue is making sure these detection devices can work with your existing gear and aren’t just a flash in the pan, about to be integrated as features in your perimeter security gateway. Okay, we would be pulling your leg if we said any aspect of detection won’t eventually become an integrated feature of other network security gear. That’s just the way it goes. But if you really need to figure out what’s happening on your network, visit these vendors on the floor.

While Consolidating Functions…

What hasn’t changed is that big organizations think they need separate devices for all their key functions. Or has it? Is best of breed (finally) dead? Well, not exactly, but it has more to do with politics than technology. Pretty much all the network security players have technologies that allow authorized traffic and block attacks. Back when category names mattered, those functions were called firewalls and IPS respectively. But wait—now everything is a next-generation firewall, right? But it does a lot more than a firewall. It also detonates malware (or integrates with a cloud service that does). And it looks for command-and-control traffic patterns. All within one or many boxes, leveraging a single policy, right?

But that’s a firewall. Just ask Gartner. Sigh. And no, we won’t troll you any more by calling it an Enterprise UTM, for old time’s sake.

Product categories aside, regardless of whether a network security vendor started as a firewall player or with IPS (or both, thanks to the magic of acquisitions), they are all attacking the same real estate: what we call the network security gateway. The real question is: how can you get there? So on the show floor focus on migration. You know you want to enforce both access control and attack policies on the device. You probably want to look for malware on ingress, and C&C indicators on egress. And you don’t want to wrestle with 10 different management interfaces. Challenge the SEs in the booths (you know, the folks who know what they are doing) to sketch out how they’d solve your problem on a piece of paper. Of course they’ll be wrong, but it should be fun to see what they come up with on the fly.

And Looking for Automation…

Another hot topic in network security will be automation. Because managing hundreds of firewalls is a pain in the ass. Actually, managing hundreds of any kind of complicated technology causes ulcers. So a bunch of new startups will be in the Innovation Sandbox detonating malware. No, not that kind of sandbox. ISB is RSAC’s showcase for new companies and technologies, where they will happily show you how to use an alert from your SIEM or a bad IP address from your threat intelligence provider to make changes automagically on your firewalls. They have spent a bunch of time making sure they support vintage 2007 edge routers and lots of other devices to make sure they have you covered.

But all the same, you have been flummoxed by spending 60 percent of your time opening ports for those pesky developers who cannot seem to understand that port 443 is a legitimate port, and they don’t need a special port. Automating some of those rote functions can free you up to do more important and strategic things. As long as the sales rep in the booth isn’t named John Connor, everything should be fine.

In the Cloud…

Even though you focus on network security, don’t think you can escape the cloud hype monster at RSAC. No chance. All the vendors will be talking about how their fancy 7-layer inspection technology is now available as a virtual machine. Of course unless they are old (like us), they won’t remember that network security appliances happened because granular inspection and policy enforcement in software did not scale. Details, we know. You are allowed to laugh when they position software-based network security as new and innovative.

They also don’t understand that inserting inspection points and bottlenecks in a cloud environment (public, private, or hybrid) breaks the whole cloud computing model. And they won’t be even paying lip service to SDN (Software Defined Networks) for the most part. SDN is currently a bit like voodoo for security people. So we guess avoidance is the best strategy at this point. Sigh, again.

The booth staff will faithfully stick to the talking points marketing gave them about how it’s the same, but just in the cloud… Smile politely and then come to our Pragmatic SecDevOps lab session, where we will tell you how to really automate and protect those cloud-based thingies that are popping up everywhere like Tribbles.