About Me

Archive

Archive

Read More

Enterprise Blogs

Feeds & Podcasts

Meet the Bloggers

Archive

Tags

#McAfeeFOCUS, #MFETrivia, #SecChat, #SecurityLegos, 12 Scams of Christmas, 2012, 2012 Security Predictions, Acquisition, Advanced Persistent Threat, Android, android antivirus, Android Malware, Android security, android security app, anti-phishing, anti-theft, anti-virus, antivirus, APIs, App Alert, Apple, application blacklisting, application developers, application security, app protection, apps, app safety, ATM scams, attacks, authentication, automotive, Bad Apps, balanced scorecard, best practices, Big Data, BlackBerry, Black Hat, Blackhat, black hat hackers, botnet, Brazil, breach, Business IT, car hacking, certification, Change Control, China, CISO Executive Summit, Citrix, class action lawsuit, cloud, Cloud city, Cloud computing, Cloud Expo, cloud security, Cofer Black, collaboration, Compliance, Conficker, consolidation, Consumer, consumerization, consumerization of IT, Content Protection, counter identity theft, credit card fraud and protection, credit card skimming, critical infrastructure, CSP, cyber attack, Cybercrime, cyberespionage, Cyber Insurance, Cyber Intelligence Sharing and Protection Act of 2011, cybersecurity, cyber security, cyber security awareness, Cyber Security Mom, cyber threat, cyberthreats, data, database activity monitoring, database security, data breach, Datacenter, data center, data center security, Data Classification, data loss, Data Loss Prevention, Data Protection, Data Protection Act, Dave DeWalt, Dave Marcus, dedicated security appliances, Deep Command, Deep Defender, DeepSAFE, DefCon, DefCon Kids, Department of Commerce, device, Device Control, devices, dewalt, DLP, Dmitri Alperovitch, easter, Ecuador, Eelectric Vehicle, Email & Web Security, Email & Web Security, email security, embedded, embedded devices, Embedded Security, Emerging Markets, Emerging Market Security, EMM, encryption, Endpoint Protection, Endpoint Security, enterprise, enterprise mobility, enterprise resource planning, enterprise scurity, enterprise security, epayment, epo, ePO Deep Command, ePolicy Orchestrator, ERP, ESM, espionage, EV, exploit, exploits, facebook, Facial recongnition, Family Safety, FDCC, file sharing, Financial Security, firewall, FISMA, Fixed Function Devices, Focus, Focus11, FOCUS 2011, forrester, Foundstone, Friday Security Highlights, Garter, Gartner, Gartner Security and Risk Management Summit, George Kurtz, Global Cybersecurity, Global SecurityAlliance Partner Summit, global threat intelligence, google, government, GTI, Hackers, hacking, Hacking Exposed, Hacktivism, HB1140, Healthcare, Heuristics, HIPAA, host intrusion prevention, Host IPS, HV, Hybrid Vehicle, ICS, IDC, identify potential cyber-threats, identity protection, identity theft, IDF 2011, Incident Response, Information leak, Information Protection, Information Security, Information Warfare, Insider Threats, Integrity, Integrity Control, intel, intellectual property, Internet Explorer, internet security, Interop, IntruShield, In vehicle Infotainment, IP, iphone, IPS, IT, IT Security, japan earthquake safe donation, japan earthquake scams, kurtz, labs, laptops, Larry Ponemon, law, legal, legal risk, linkedin, live-tweeting, lizamoon, Lockheed Martin, mac, Mac OS X, malware, Malware research, managed security services, Management, Mariposa, mass sql injection, mastercard, Maturity Model, McAfee, McAfee Application Control, McAfee Cloud Security Platform, McAfee Data Loss Prevention, Mcafee DLP, McAfee Email Gateway 7.0, McAfee Enterprise Mobility Management, McAfee ePO, McAfee ePolicy Orchestrator, McAfee Firewall Enterprise, McAfee FOCUS, McAfee FOCUS 2011, McAfee Identity Protection, McAfee Labs, McAfee Mobile Security, McAfee MOVE AV, McAfee Network Security Platform, McAfee NSP, McAfee Policy Auditor, McAfee Risk Advisor, McAfee Security Journal, McAfee Security Management, McAfee Security Webinars, McAfee SiteAdvisor, McAfee Vulnerability Manager, McAfee Vulnerability Manager for Databases, mcafee wavesecure, Microsoft, Microsoft Security Bulletin, Mid-Market, Mobile, mobile antivirus, mobile app, mobile data communications, mobile device, mobile devices, mobile devices and security threats, mobile malware, mobile phone spyware, mobile security, mobile security app, mobile smartphone security, mobiles security, mom, MS12-020, MySQL, NACACS, near field communication, Network Perimeter Security, Network Security, Network Security; Email & Web Security; Security-as-a-Service, network security server security, new year resolution, next-gen IPS, Next Generation IPS, NFC, Night Dragon, NIST, NitroSecurity, OMB, online banking, Open Source, operational risk, Operation Aurora, Optimized, outages, OWASP, passwords, password security, patch, Patch Tuesday, Patmos, PCI, PCI Compliance, PCI DSS, Peer to Peer file sharing, perception, personal information over mobile phones, phishing, PII, Ponemon Institute, PostScript, Potentially unwanted program, power grid, power loss, Pre-detection, Pre-Installed Malware, Printers, privacy, protection, Public-Private partnerships, Public Sector, pup, QR codes, reference architecture, regulations, reporting, reputational risk, retail, risk, Risk Advisor, Risk and Compliance, Risk Management, ROI, Rookits, Rootkits, RSA, RSA 2012, SaaS, SaaS security solutions, safe searching, Saviynt Access Manager, SCADA, scam, SCAP, SEC Guidance, SecTor, secure cloud computing, secure container, security, Security-as-a-Service, Security and Defense Agenda, security attacks, security awareness, security breach, security conferences, Security Connected, Security Connected Reference Architecture, Security Influence, security management, security metrics, security optimization, security policy, security threats, Sentrigo acquisition, Shady RAT, SharePoint, shortened URLs, SIA Partners, SIEM, SiteAdvisor, Situational Awareness, Small Business, smartphones, smartphone security, SMB, social business, social media, social networking, social networks, Software-as-a-Service, spam, Spearphishing, sql attacks, SQL Injection, State of Security, stealth attack, stealth crimeware, stealth detection, Steve Jobs, storage, Stuxnet, Support, Symbian, T-Mobile, Tablet, tablets, tablet security, targeted attacks, TCO, technology development, Telecommunications, threat reduction, TJX, TPM, Trusted Computing Module, trustedsource, twitter, Twitter online security, U.S. Cyber Challenge Camps, urchin.js, Vericept DLP, ViaForensics, Virtualization, VIrtual Machines, visa, Vontu DLP, vPro, vulnerability, Vulnerability Manager, vulnerability manager for databases, Web 2.0, Webinar, web protection, web security, Websense DSS, Web services, white hat hackers, Whitelisting, wikileaks, Windows 7, Windows Mobile, Wind River, Xerox, youtube, Zero-Day, zeus
Enterprise : Network Security :

Is Your Firewall Application Aware?

Tuesday, May 4, 2010 at 1:33pm by Archive
Archive

Firewalls permit or deny applications based upon a set of rules and other criteria. And for the longest time, the ‘set of rules or other criteria’ was simply source and destination IP address and port number. FTP traffic was on port 21, telnet 23, SMTP 25, and on and on—The Internet Assigned Numbers Authority (IANA) maintains an exhaustive list for any security guru who doesn’t know it by heart. At one point, a list like this formed the basis of the very cutting-edge in enterprise network firewall technology. But times have changed.

Today many applications are designed with the ability to hop between ports. AOL Instant Messenger has assigned ports that can be found on the IANA well-known port numbers list, but it can and will revert to port 80 if these are blocked by a network firewall. And no matter how badly a security admin wants to control AIM traffic, blocking port 80 is simply not an option. AIM is by no means the only application using this method to bypass traditional firewalls, and attack traffic has also evolved to hop between ports. It’s begun spreading via Internet and Intranet links using applications like streaming audio, VoIP and P2P file-sharing. If a firewall lacks the ability to look deeper than standard port numbers in order to determine the true nature of the traffic being inspected, then the protection provided by this firewall is woefully inadequate.

McAfee’s AppPrism technology has the ability to distinguish AIM traffic running over port 80 from regular HTTP traffic, and it goes a step further. In Version 8 of McAfee Firewall Enterprise, AppPrism allows a security administrator to go beyond simple identification of traffic and enables a granularity of control that truly allows for the construction of a ‘set of rules’ capable of protecting today’s enterprise network. An example of this can be seen in a recent video review in which David Strom highlights McAfee’s ability to allow IM traffic while specifically disallowing its file transfer capabilities in order to enforce corporate policy. The video can be seen here and is a perfect example of McAfee Firewall Enterprise’s ability to identify applications, control functionality, protect the enterprise and enforce corporate policy.

Bookmark and Share

Tags:

Submit your own comments / message for this post

Your email is never published nor shared. Required fields are marked *

CAPTCHA Image

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>

Comments (4)

  • Barbara Kay July 26, 2010 6:56PM

    Gartner claims mashups and personalized portals may be reborn as the next big IT thing after social networking. Will the firewall/AppPrism be able to set effective policies for these sorts of complex streams (which could certainly include IM and VoIP)?

    Reply
    • Willam Beltane October 20, 2010 4:12PM

      Barbara-
      McAfee knows that enforcing corporate policy and providing real protection hinge on the ability to distinguish between protocols and address the security of each as necessary. I believe their commitment to real security will be evident and that their application signatures will keep pace with the evolving communications landscape.

      Reply
  • Willam Beltane July 19, 2010 9:16PM

    Hi Joe-

    Very interesting comment. I’d say that DLP today is more about stopping people from accidentally leaking information rather than those trying to do so deliberately. You’re right about the PSTN though, and I’d never thought of it in quite that way.

    Thanks-

    William

    Reply
  • Joe ODonnell June 24, 2010 5:01PM

    William
    In addition to the apps you mention bypassing the FW infrastructure…we see something even more persistent and more pervasive….in the enterprise the whole voice infrastructure by-passes the packet based security in place. Whether it be DLP via modems, voice, fax…it is a pervasive way to circumvent millions of dollars of perfectly good packet only security techniques. We see it in every customer we have assessed and sold to. Is it MFE’s intent to address the PSTN as an untrusted global network? Ok…so it’s narrowband…but nodally there are more vectors of ingress or egress than an enterprise’s Internet data centers.
    Great post by the way!
    Joe

    Reply