ISS Announces "Proventia" Products

Internet Security Systems launched a new product line this week, called the Proventia "all-in-one protection product." From the press release:

"Today Proventia unifies firewall, virtual private network (VPN), anti-virus, intrusion detection and prevention into one engine, under one management system, to protect at the network and the gateway. In the future, Proventia will add application protection, content filtering and anti-spam functionality to the unified engine to extend protection across servers, desktops and laptops. Proventia’s simplified protection for every layer of business infrastructure eliminates the complexity associated with today’s legacy security products and greatly reduces the total cost of ownership for security – making protection affordable for enterprises."

ISS offers three Proventia products:

I looked at the produce demo site and made a few observations. Site Protector remains the overall management product. The Proventia M series offers "content blades" which can be enabled or disabled in software.

The Proventia A series IDS offers products like the A1204 which can monitor and make sense of redundant or load-balanced links.

ISS offers a newsletter called "Connect," with the October issue (.pdf) devoted to Proventia.

What's the competition for ISS' product? Symantec announced its Symantec Gateway Security 5400 Series last month. Cisco announced "integrated network solutions" in Feb 03, but they're not a "converged solution." You need a product finder to make sense of Enterasys's offerings. While I still believe Sourcefire has the superior detection solution, I can see the allure of these "single box" appliances.

Don't be fooled into thinking a single box can serve all of your security needs. While the ISS demos stress their products can complement firewalls, I don't trust putting prevention and detection functions into a single system. Almost by definition, the detection aspect will not detect some attacks, leaving no record of intrusion. Why? If the product could detect the attack, why didn't it prevent it? (That's what customers say they want, correct?) So, there needs to be an independent, network-audit product to evaulate how well the prevention product performs. That's network security monitoring my friends. NSM recognizes that prevention will always fail, and that when it does defenders need a way to quickly scope the extent and impact of a compromise.

Popular posts from this blog

Zeek in Action Videos

Image
This is a quick note to point blog readers to my Zeek in Action YouTube video series for the Zeek network security monitoring project .  Each video addresses a topic that I think might be of interest to people trying to understand their network using Zeek and adjacent tools and approaches, like Suricata, Wireshark, and so on.  I am especially pleased with Video 6 on monitoring wireless networks . It took me several weeks to research material for this video. I had to buy new hardware and experiment with a Linux distro that I had not used before -- Parrot .  Please like and subscribe, and let me know if there is a topic you think might make a good video.
Read more

MITRE ATT&CK Tactics Are Not Tactics

Image
Just what are "tactics"? Introduction MITRE ATT&CK  is a great resource, but something about it has bothered me since I first heard about it several years ago. It's a minor point, but I wanted to document it in case it confuses anyone else. The MITRE ATT&CK Design and Philosophy document from March 2020 says the following: At a high-level, ATT&CK is a behavioral model that consists of the following core components: • Tactics, denoting short-term, tactical adversary goals during an attack; • Techniques, describing the means by which adversaries achieve tactical goals; • Sub-techniques, describing more specific means by which adversaries achieve tactical goals at a lower level than techniques; and • Documented adversary usage of techniques, their procedures, and other metadata. My concern is with MITRE's definition of "tactics" as "short-term, tactical adversary goals during an attack," which is oddly recursive. The key word in the tacti...
Read more

New Book! The Best of TaoSecurity Blog, Volume 4

Image
  I've completed the TaoSecurity Blog book series . The new book is  The Best of TaoSecurity Blog, Volume 4: Beyond the Blog with Articles, Testimony, and Scholarship .  It's available now for Kindle , and I'm working on the print edition.  I'm running a 50% off promo on Volumes 1-3 on Kindle through midnight 20 April. Take advantage before the prices go back up. I described the new title thus: Go beyond TaoSecurity Blog with this new volume from author Richard Bejtlich. In the first three volumes of the series, Mr. Bejtlich selected and republished the very best entries from 18 years of writing and over 18 million blog views, along with commentaries and additional material.  In this title, Mr. Bejtlich collects material that has not been published elsewhere, including articles that are no longer available or are stored in assorted digital or physical archives. Volume 4 offers early white papers that Mr. Bejtlich wrote as a network defender, either for technica...
Read more