Ed Amoroso | The big picture of network security

Why add intelligence to the network? In the mid- 1990s, we watched business networking gradually move'onto the public Internet. Every business, every federal agency had a connection to the Internet. It wasn't terribly mission-critical in those days. This is when the firewall was introduced. You had your enterprise network. People had a pretty good grasp of their largely private-line infrastructure. They had their set of carriers that they dealt with. And they had an Internet connection with a firewall. It felt very manageable. There wasn't a great deal of complexity.But over time, two things have happened: One is that the one Internet connection became thousands and thousands of connections. And second, that firewall has expanded to include intrusion-detection and -prevention systems, antivirus and anti-spam measures, [Web page] filtering, and threat management policies. Where is this all going?We think the big mess that sits at every Internet gateway can be virtualized. When I say virtualized, I mean it can be pushed out onto the network.In the late 1990s, the idea [of dumb networks] was made very popular by writers like George Gilder in his book, 'Telecosm.' Very influential book. He argued that telecommunications equals physics and that really all you need to do is roll out fiber and push all the work off to the edge. A lot of people did that. So you [have] a very dumbed-down infrastructure in many companies and a very intelligent edge.Now we're seeing a trend of embedding all these security functions into the network. In fact, the entire [General Services Administration's] Networx [telecom contract vehicle] includes a good, healthy smattering of network-based services, the most common being spam filtering. How would spam filtering work on the network? The way it works now for most places is that XXX@federalagency.gov would be the e-mail address for some federal employee. All the Internet message transfer agents would point all the e-mail [addressed to @federalagency.gov] to some federal agency gateway, which would be running an e-mail server. Let's say an agency gets 1 million messages a day. Out of that million messages, I would guess 850,000 of them are spam messages, and right there at the edge, you would filter all that spam and only deal with the 150,000 good ones.[Now,] all of that [garbage] is coming through the network, filling up your pipe.What we would do ' and what the simplest thing is ' is that you would point all that e-mail to a server living off in the AT&T cloud that does exactly what your spam box is doing in your data center. Only the 150,000 good messages get forwarded to you, and so now your inbound connection sees less traffic.You can get rid of your own box in your own data center. Now you have a cleaner, simpler connection with less equipment to manage. You see how you can take something from a dirtier, more complex environment to an environment that is, from an agency perspective, much cleaner. How would a firewall work at the network level? A firewall simply is a device that allows certain traffic coming in and blocks certain traffic trying to come in, and it allows certain traffic to go out and blocks certain traffic from going out. You set up a bunch of rules, put it in your firewall and you're done.Well, our network can do exactly the same thing. We can codify those requirements in the cloud. If inbound Telnet is something you don't want, well then, we won't forward you inbound Telnet. If'you want to make sure your employees are staying off certain sites, then that kind of [Web address] filtering can be provided as well. We can configure your firewall as a network service; we've done it for many customers. You're a big proponent of stemming leaky data. What does AT&T do to ensure the integrity of in-transit data? We tend to see leaky data as an [information technology] problem first.It is driven by applications ' you have applications that are just flat-out broken or misdesigned, and they are spilling out sensitive data from one gateway or another. Or it could be the way people are mishandling data in a company ' putting it on laptops or attaching data to e-mails.Chief technology officers will always start with encrypting computers, doing awareness programs and having strong policies with consequences, like getting fired. But after all that is attended to, you would like your network to complement those efforts.So we've started some research and development programs around data leakage. The idea would be to contract with agencies and then learn what the leakage requirements were.Data may be marked with the words top secret or secret or confidential. There might be certain agency-sensitive keywords we'd be looking for.We could do it either through proxy or the kind of filtering we do right now for spam. We can pick these things up in the network and provide some notification back to customers.Again, this is a complementary service. It is much more important for people not to be mishandling data. So the data [AT&T intercepts] should be the exception and not the norm. We're hearing more about agency use of Multiprotocol Label Switching. What are the security implications around the use of MPLS? Like any new technology, there are security issues that need to be worked out.First off, in the positive sense, MPLS introduces labeling to IP packets. Those labels are good in that they allow you to sort traffic and keep labeled traffic streams separate. MPLS makes it easy to set up virtual private network tunnels, which from a security perspective is awesome.Where there may be challenges is that there are lot of architectures that are huband- spoke.There may be a data center and a lot of spokes connected into the data center, and those spokes may be private lines, which is the way people have been doing it over the past 10 or 15 years. When you're introducing MPLS, you're going to a VPN arrangement. Instead of huband- spoke, you might see a spoke-to spoke ' or many-to-many ' arrangement. It is less easy to swap out all your security protections in the data center to do a many-to-many type protection. You have to have VPN security protections in place if you want to do the traditional VPN/MPLS type of services.That network firewall is something that is available for MPLS customers. Instead of the data center being the security firewall, now the cloud can be the security firewall.