Technique | Network visibility

Mike Hamilton, Seattle's chief information security officer, didn't know what he was missing. It was obvious that development of new applications was outstripping acceptable-use policies for the city's network, but no one had guessed by how far.'We knew that some of this stuff was going on,' Hamilton said. 'We knew instant messaging was going to be a problem for us.'Then he hooked up a beta version of a new type of application-aware firewall from Palo Alto Networks to a segment of his network.'We didn't expect the extent to which we were going to find peer-to-peer and soft voice-over-IP phones and the extent of instant messaging,' he said. 'This Web 2.0 stuff is out of control. At lunch, we're using 30 megabits/sec to perpetuate YouTube. And YouTube is rife with security problems.'Bandwidth consumption and security vulnerabilities are not the only concerns about unauthorized applications. When employees use tools such as instant messaging for city business, those messages become official records that are not being managed and archived as required by law. It is not that workers are intentionally using out-of-channel routes to avoid those controls, but by using a new application to help do their jobs, they are moving beyond what current policies envision.That is why the founders of Palo Alto Networks thought it was time for a new kind of firewall.'The primary concern is restoring visibility and control of the enterprise,' said Dave Stevens, the company's chief executive officer. 'The applications have become pretty good at bypassing the traditional security infrastructure.'The heart of that security infrastructure has been the firewall, a descriptively named device that sits between the enterprise and the outside world, passing judgment on traffic coming into the network. There are many ways to filter traffic, but source and destination port numbers are among the most common and probably are the easiest ways to configure and enforce policy. This technique was efficient when there was a dependable relationship between port number and application.But 'the relationship between port and application doesn't really exist anymore,' Stevens said. Applications looking for network resources often masquerade or tunnel through a port. Port 80 used to be simply Web browsing, but today that can also mean instant messaging, peer-to-peer connections, VOIP or any number of applications.This is not necessarily malicious, but it can open the network to hacking exploits and make it difficult to enforce meaningful policies.Networks are not completely blind. Firewalls can be tuned in a variety of ways, and intrusion-detection and -prevention systems can extend the perimeter defenses.But these often cannot control new applications as they are developed. Palo Alto's chief technology officer and founder, Nir Zuk, wanted to build an appliance that would identify and enforce traffic policies by application type. The firewall was the logical place to do this because it remains the choke point through which all traffic passes. The first two products in this category, the PA-4050 and PA-4020, announced in June, can identify more than 400 applications at speeds of 10 gigabits/sec and 2 gigabits/sec, respectively. The 4050 model lists for $60,000, the 4020 for $35,000.'We look into all the packets until we have a definitive answer as to what it is,' Zuk said. 'In most cases, you can do it in the first few packets,' but sometimes it takes longer. When Secure Sockets Layer encryption is used, the packets have to be decrypted before inspection.'The challenge was mostly how to do this at 10 [gigabits/sec],' he said. At a rate of about 10 million packets a second, 'that leaves you little time to look at each packet. The way we did it is with dedicated hardware.'The appliances contain network processors, processing power to run policy rules, and a matching engine to identify applications and malicious code. They use a proprietary technology called App-ID to classify applications.Hamilton was not looking for a new firewall for his network when he was approached by Palo Alto to become a beta user. 'I didn't want it,' he said. 'All they wanted was my input,' because there are not a lot of cities that have a chief information security officer.He got permission to put it on the city's network where it connects with the state's intergovernmental network, which provides primary connectivity to many of the state's smaller communities. But Seattle is large enough to maintain its own network, so the link is not a major connection for the city.Nevertheless, 'we couldn't believe what this thing was telling us,' Hamilton said. 'When you see the actual application traffic and the extent of the bandwidth being used.' That thing is such a cesspool.'The new firewall is being used now in monitor mode only, he said. 'I would be strung up if I suggested putting this thing inline and blocking traffic.'But 'this has helped in identifying the extent of the problem, which had been addressed only somewhat by our acceptable-use policies.'The city probably will initiate a request for proposals for advanced firewall protection, Hamilton said. The project would be bid, and there is no guarantee that the Palo Alto Network products would win. But the products will likely be among those considered.