Threat Intelligence Gateways: A Useful Adjunct to Overworked Perimeter Security

It's fashionable to say that in the age of cloud and teleworking, the network perimeter is no more. That with applications residing in cloud environments and employees, partners, and contractors logging in to work from just about anywhere, the old notion of a "castle-and-moat" defensive barrier around corporate assets is a thing of the past.

Well, the situation has certainly changed quite a bit, but the success of next-generation firewall (NGFW) vendors shows that there is still a lot of investment in good old edge security, i.e. technology deployed on the real, or increasingly on the theoretical edge of a network to keep bad guys and malicious stuff out.

Now, with estimates to suggest that enterprise IT systems are attacked every 39 seconds, or around 2,500 times per day, it is clear that whatever security measures we have in place to keep out attackers are under considerable pressure. Those will often include a firewall and, particularly, if it is of the aforementioned next-generation variety, it will come with a lot of compute power on board to inspect all incoming traffic in a stateful manner, all the way to the application layer (7 in the OSI model).

Enter the TIG
But what if we could lighten that burden by proactively blocking what we know to be bad before it even gets to the NGFW? Enter the threat intelligence gateway (TIG), a class of security tool that has emerged in recent years to do just this. TIGs are stateless devices deployed between a corporate router and an NGFW, effectively blocking the known bad, based on a prior knowledge of malicious URLs and compromised IP addresses, before the traffic ever gets to the firewall. This reduces the traffic to the firewall and enables the firewall to focus its CPU cycles on inspecting for the more complex and subtler attack types that warrant attention.

Where does that prior knowledge come from, and how trustworthy and up to date will it be when we get it? Clearly, this is outside the purview of the TIG itself, speaking instead to the kinds of threat intelligence enterprise customers are now commonly ingesting to inform their security decision-making. In a recent report, Ovum looked at the offerings of five of the most representative TIG vendors, and it is no coincidence that a number of them spoke of TIG's ability to integrate with threat intelligence platforms, or TIPs, a very similar acronym describing technology that ingests, aggregates, and normalizes threat feeds from commercial and open source providers, often enhancing it with a customer's own threat data.

The vendors and products we looked at were:

Of this group, Ixia and Netscout have the longest pedigrees in the industry, with Ixia being a major name in security testing and Netscout a network monitoring/service assurance vendor that expanded into security with its 2015 acquisition of Arbor Networks. Interestingly, only LookingGlass has both a TIG and a TIP in its portfolio, though clearly all the TIGs can integrate with third-party TIPs.

As a later entrant into the market, Netscout has sought to differentiate its offering by highlighting its ability to inspect both inbound and outbound traffic, enabling it to block data exfiltration attempts or simply employee errors, and making it both a first and last line of defense, as it were. Since then, the other vendors have also begun expounding their outbound credentials too.

Who Benefits?
To some extent, a TIG can be thought of as an instantiation in software, and sometimes with some dedicated hardware in support, of the black- and whitelists that have helped web and content filtering devices decide what to block for many years. More dynamically, however, their integrations with TIPs make it possible to make threat intel actionable, since TIPs are data processing platforms while TIGs are enforcement devices.

That said, they are clearly not for everyone. It was Ovum's conclusion that TIGs can be a useful a useful additional to the arsenal of defensive tools employed by an enterprise, and particularly one that is in threat actors' crosshairs, such as in the financial sector, healthcare, or the defense sector.

If you are already taking a threat feed or two and are reasonably happy with their accuracy and timeliness, applying them in a TIG for enforcement purposes may be a quick and easy win, in terms of reducing the burden on both your firewall estate and your security staffers.

Ovum is less certain that TIGs are appropriate for smaller or even midsize companies. While they hold the promise of automating away some of the blocking activity from your firewall and your security team, you should at least have a security team large enough to manage the TIG, periodically checking on the accuracy of the threat intel it is receiving and reviewing a list of what has been blocked to keep false positives at a minimum. If you don't have someone to do that, the only way to use a TIG would be via a service provider and, as yet, such services are not available.

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "You Gotta Reach 'Em to Teach 'Em.