IBM Proventia Intrusion Prevention System for Crossbeam

1
IBM Proventia Intrusion Prevention System for
Crossbeam
25 ????? 2008 ????
??????? ????? ??????????? ?? ??????????????
????????????
2
??? ????? Intrusion Prevention System?

• IPS ??????? ?? IDS
• IDS ???? ???????? ???? ? ????????? ? ???
• IPS ????????? ?????
• ????????? ?????????? ?????????????? ????
  ???????????? ????????????? ????????? ??????????,
  ????? ???????? ???????? ??????????? ????, ?????
  ?? ???? ?????????????? ??????? ?? ??????????
  ??????
• ??? ????? ???????????? ????????? ???????
• ????????????? ? ????????????? ??????????
• ??????? ???????

3
????? ??????? ???? ?? ????
1 Computer Security Institute/FBIs 2006 Computer
Crime and Security Survey 2 Computer Economics,
2006 3 ICSA Labs, 9th Annual Computer Virus
Prevalence Survey 4 Cybertrust, Risky Business,
September 2006 5 Gartner, Gartners Top
Predictions for IT Organizations and Users, 2007
Beyond, December 2006

• ?????? ???????????
• 98 ?????????? ??????????? ????????1
• 97 ?????????? ???????????? 1
• 79 ?????????? anti-spyware 1
• 61 ?????????? ????????? ??????????? ???????????
  ????? 1
• ? ? ?? ?? ?????
• 80 ???????? ??????????? ? ????? ??? ?????
  ????????? ???????, 30 ????????? ????? ??? ? 10
  ??????? 3
• ??????? ?????? ????? ???????? ?? ?????????
  ??????????? ?????? ? ??? ????? 168,000 ? ???1
• ?? ????? ????, 32 ???????? ???????????? ?? ????,
  ???????? ?? ?????? ????? ?????????
• 43 ?? ??? ???? ??????, ? 27 ???????????????????
  ??????4
• 75 ???????? ????? ???????????? ????????????
  ??????????? ??????? ??????? ???????????? ??????
  ??????5

3
3
4
?????? ? ?????? ????

• IBM Proventia Network Intrusion Prevention System
  (IPS)
• ?????????? ????????? ???????????? ????? ????
  ??????? ?????? ? ??????????? ????? ??? ???? ??
  ????? ????? ?? ?????? ???????? ????????
• ??????? ??????? ?????????
• ?????????? ????????????? 10 ????/??? ?? 15
  ????/???
• ?? 8 ?????????? ?????????
• ?????? ?? ?????????? IBM Managed Protection
  Services
• ?????????????
• ?????????
• ?????????
• ???????????? ?? ?????????

4
5
?????? ??? ?????? Proventia Network IPS
????? 2500 ?????? ? ??? ??????? ????????
????????????
5
6
DoS ? DDoS ?????

• ????????????? ??????? ?? ?????
• ??????????? ???????? ????????? ???????? ??????
• ?????????? ??????? ???????? ????? ????????
  ????????

????????? ??????? ??? ????? Mstream, Trinoo,
TFN2K, Stacheldraht ? Shaft.
7
?????? 164 ???????? ????????????? DoS ??????
????????? ?? 15 ???? ? ???

• Cisco_IOS_IPV4_DoShttp//www.cisco.com/warp/publi
  c/707/cisco-sa-20030717-blocked.shtml
• DCOM_RemoteGetClassObject_DoShttp//www.microsoft
  .com/technet/security/bulletin/ms03-039.mspx
• HTTP_CrystalReports_FileAccess_DoShttp//www.micr
  osoft.com/technet/security/bulletin/MS04-017.mspx
  http//dev2dev.bea.com/pub/advisory/20
• PlugAndPlay_DoShttp//www.microsoft.com/technet/s
  ecurity/advisory/899588.mspx
• TCP_Within_Window_DoShttp//www.microsoft.com/tec
  hnet/security/bulletin/ms06-032.mspxhttp//www.ci
  sco.com/warp/public/707/cisco-sa-20040420-tcp-ios.
  shtml
• VOIP_DRDoShttp//secunia.com/advisories/21071/

8
?????? 16 ???????? ????????? DoS

• SynFlood
• TCP_Connection_Flood
• UDP_Flood_DoS
• DNS_Malformed_Flood
• Stream_DoS
• ICMP_Flood
• Malformed_Packet_Storm

9
?????? ??? ?????? Proventia Network IPS

• ?????????????? ????????? ? ?? ??????? ??????????
  ? ????????????? X-Force
• ????? ???????????
• ?????? ????????? ?????????????? ???????????
• ?????????????????? ? ?????? ???????
• ?????? ??????? ?????
• ?????????? ????? ?????????? ??????

9
10
Proventia Network IPS for Crossbeam

• ????????? ?????? Crossbeam AP8400 APM (?? 10 ??
  ????? ?????) ? X-80 (?? 4 ?? ????? ?????)
• ?????????? ??????????
• ???????????? ????????
• ????????????? ???????
• Robust high availability
• ?????????????? ??????
• Standby blades
• Box-to-box HA
• ??????????????????
• ?? 10 ????/??? ?? ??????

11
UTM X-Series Modular Architecture
FIREWALL GROUP
ANTI-VIRUS GROUP
DYNAMIC STANDBY
IDS GROUP

• Fully switched data paths
• 40 to 160 Gbps of backplane capacity
• Fully switched control paths
• 14 Gbps of backplane capacity
• No single point of failure

12
Proventia IPS for Crossbeam
???? ?? ?????? ?????????? ??????? ?????????? ??
???? ???????? ?????????? ????????????
????????????.
IPS
???? ?? ?????? ???????? ??? ??????????? ???????
???????????, ??????? ?????????????????? ?
?????????? ???????.

• ?????????????????? ?? 10 ???????? ?? ?????? ?
  ????????????? ???????? ????? ????????, ?
  ?????????? ?????????????????? ???????????? ??
  ????? ?????????????????? ??????? ??????.
• ?????? ??? SIP, H.323, GTP ? ????? ??? 140
  ?????? ??????????
• ???????????????? ?????????? ? ????????? ????? ???
  ?????????? ???????

13
?????????? Proventia Network IPS

• ?????????? ????????? ????? ????????? ??? ??????
  (LMI)
• ??????????? ?????????? ????? Proventia Management
  SiteProtector
• ??????? ??????????? ????????? ??????????
• ????????? ??????, ????????? ???? ???? ?
  ?????????? ???????, ????????? ?????????
  ????????????
• ?????????? ?????? ?? ???????????? ???? ???
  ??????????? ??????????
• ?????????????? ??? ?????????? ??????? ?????????
  IPS

13
14
?????????? Proventia Network IPS

• ?????????? ? ????????
• SiteProtector
• Proventia Manager (LMI)
• ????????? ??????
• ?????????? ??????????
• ?? ?????? ??????????
• ?? ?????? ????
• ?? ?????? VLAN
• ?? ?????? ???? IP ???????
• ?????????? ????? ?????? / SNORT / TRONS

• ????????????
• ???????????
• ????????????
• ?????????? ? ??????? ??????????????
• Email
• ????????
• SNMP
• ?????????? ????????????

14
15
????? ?? ???????? ???????
Roadmap
???????? Proventia ??? Crossbeam

• Proventia IPS for X-Series
• ????????? ??????? ?? ????? ??????
• ????????? ??? ??????? ???????
• ?????????? ??????????????????
• Proventia IPS for C-Series
• ??????? ?????? Proventia ?? ?????????? 1U ? 2U
  ?????????? Crossbeam
• Proventia Enterprise Scanner
• Proventia ADS

????????????? ???????? ??? Crossbeam

• Mail/Web Security
• WebApp Protection Firewall

16
?????? ?? ????????????? ??????? IBM Proventia

• ???????????? ?????? ????????? ????? ? ?? ????
  ???????? ??????????????????? ?????? ? ????????
  ????
• ?????? ? ?????? ??????? ???? ?????? ?????????? ?
  ???????? ? ???? ? ????????? ??????????????
  ??????????? ??????????

• ???????????? ???????????? ????? ?????, ????????
  ?? ????????????? ??????? ????????? ??????????
• ??????????????? ????????? ? ??????? ???????????
  ?????????? ???? ?????? ??? ????????? ?
  ????????????? ????????? ? ?????? ???? ????

17
????????

??????? ????? ??????????? ?? ??????????????
???????????? Alexey.Ivlev_at_ru.ibm.com