Skip to main content

Addressing Emerging Threats and Targeted Attacks with IBM Security Network Protection

Redguide

thumbnail 

Published on 16 July 2014

  1. .EPUB (2.2 MB)
  2. .PDF (3.2 MB)

Apple BooksGoogle Play Books

Share this page:   

ISBN-10: 0738453862
ISBN-13: 9780738453866
IBM Form #: REDP-4826-01


Authors: Paul Ashley, Chenta Lee and Craig Stabler

    menu icon

    Abstract

    In networks today, organizations are faced with hundreds of new web and non-web applications that are available to their users. Social media applications, peer-to-peer file transfer applications, Voice over Internet Protocol (VoIP), web-based email, cloud data storage, and many others are all readily available. The ease and speed at which these new applications can be installed or simply accessed reduces the effectiveness of a perimeter-based security architecture and provides many new types of risks. These applications can be used by an attacker to obtain initial access into the organization and bypass any perimeter-based security.

    This IBM® Redguide™ publication introduces the solution, which is a (IPS) that extends the capabilities of traditional protocol-based IPSes by providing application visibility and control. By using IBM X-Force® Research And Development, this solution provides critical insight and control of all user activities by analyzing each connection to identify the web or non-web application in use and the action being taken. The IBM Security Network Protection solution can then decide to allow or block the connection, and can inspect even those connections that are encrypted by SSL. Additionally, the X-Force IP Reputation information can be used to understand whether sites that are accessed are hosting malware, are BotNet Command and Control servers (C&C servers), or are phishing sites, and other important information.

    The IBM Security Network Protection can record connection information, including user and application context, and can use this information for local policy refinement, including bandwidth management. Alternatively, the connection information can be sent to a (SIEM) for security analysis and longer term storage.

    The IBM Security Network Protection consolidation of the traditional IPS function, in combination with sophisticated user-based application control and IP Reputation, can provide an integrated security solution. This approach allows for faster deployment and simplification of the administration that is associated with the deployment of multiple products, reduces the cost of ownership and complexity, and provides for better return on investment (ROI).

    The target audience for this publication is business leaders, decision makers, network managers, IT security managers, and IT and business consultants.

    Table of Contents

    Executive overview

    Introducing the current threat landscape

    Protecting your network against threats with protocol-aware detection

    Gaining deep insights into network applications and users

    Obtaining granular control of your network applications and users

    Implementing intrusion prevention and application control by using IBM Security Network Protection

    Summary

     

    Others who read this also read