Threat-Focused NG-Firewall – Who Cares? Part 3

This is Part 3 of our blog series about NG-Firewalls. See Part 1 here.

Part 3: Challenges of the Typical NGFW

What good is a malicious verdict on something that had already penetrated the system?

There is no system in the world that can stop 100% of attacks/attackers 100% of the time, so infection is an inevitability that must be anticipated. Something WILL get through and when it does, the quality of your threat system and incident response plan will surely be tested. The Cisco Firepower Threat-focused NGFW is designed to understand what has happened through the entire life cycle and to be able to make immediate and automatic adjustments to contain the threat and provide the Practitioner with the forensic details necessary to manage and respond to the incident.

Typical NGFW solutions add on extra defense systems (malware sandboxes, URL gateways, etc.) in an attempt to avoid this altogether with the focus on point-in-time prevention. Whether a Typical NGFW or a Threat-focused one, all use technologies like Threat Intelligence cloud lookups of known malware signatures, or even sandboxing to allow the full progression of an ‘unknown’ to operate in a contained environment and ultimately determine if clean or malicious so it can be given an accurate disposition at the initial point-in-time. How they are used is the critical point. While a threat-focused firewall integrates these functions into its core, the Typical NGFW leverages less-integrated add-on components in order to go back to step 1 and try to deny what shouldn’t get through at first sight – attempting to prevent everything with that binary decision. Great idea, except for a few critical deficiencies: First, most modern malware is sandbox-aware and only used once. Therefore, if it runs in a sandbox it may not execute the same way as it would in the wild. Signatures are only good for the 2^nd time malware is seen, so a cloud lookup isn’t, with or without sandboxing, enough to confirm an unknown that only ever has one instantiation.

The second deficiency exists in the NGFW itself – a threat must pass-through the box for anything to happen, and the NGFW must know everything it may need to all at once, at that point-in-time, for a typical NGFW to deny a threat. Having to wait for a sandbox detonation or locating (or building) a signature means that either the system blocks all unknowns – potentially dropping legitimately clean data, or it must wait while these systems do their analysis – which ultimately slows the system and/or network down. Once again, Speed kills, so some NGFWs will just let unknowns pass to keep performance up, while awaiting background systems like sandboxes, to do their work. Some Sandbox systems will actually let the initial data through at the same time it is being analyzed, so if it ends up being malicious, it can deny the data the next time it is seen somewhere – IF it is seen again. This is called the ‘Sacrificial Lamb’ concept and you can imagine that there is much cleanup work to follow – especially since many threats have the ability to replicate and morph.

Integrated Threat Defense

The Threat-focused NG-Firewall has successfully identified the threat, even retrospectively for complex and evasive malware, has dynamically adjusted the system to prevent further damage, known as ‘Adaptive Security’ and has correlated a ton of information to create a very detailed view of the threat progression and everywhere it ended up on your network. A great start and certainly more than any typical NGFW was designed to do.

How then are the evasive threats contained?

This is where the intelligence from the endpoint comes into play. Firepower, Cisco’s threat-focused NG-Firewall, can do its job without needing to run an endpoint agent on each client, using AMP for Networks, which is built into the system at its core. Adding an agent (AMP for Endpoints) sweetens the process of containment and remediation as we saw in the previous example. However, the Firepower approach passively discovers and collects detailed information from EVERY endpoint on the network; including network infrastructure devices, printers, mobile and pc-based systems, virtual systems, IP Phones, etc. Information collected includes details on every application that runs locally on each system, the local services and OS version and all related vulnerabilities*, a complete history of every user that used the system, and of course, behavioral analysis of activity such as all inbound and outbound connections, intrusion and file events, including file copy operations, which can provide reliable Indications of Compromise (IoC) to the overall Security system.

Once this much information is known about every client on the network, you can imagine how much more accurate and effective detection and response turns out. The high-confidence that comes from knowing that 61 of my 2,340 systems are running a vulnerable version of FireFox when a critical exploit to that vulnerability is seen, makes the accuracy and ‘actionability’ of detection very high. This is where the impact assessment flag comes from – events that are highest criticality and are confirmed IoC is another missing piece that the typical NGFW just cannot produce. It doesn’t have enough information, nor was it designed to collect it. I have seen a couple of NGFW vendors try, but it ends up just being clever naming for an informational element that once again, makes the naïve feel safe and informed. How do you know a host is compromised if you know almost nothing about that host, for instance. That folks is called the game of marketing. Threat actors absolutely Love Marketing – makes their job easier.

In order for any security system to be effective, dynamic introspection into every system on the network (not just PC-based) is the critical first piece of impact assessment. What the systems do, apps they run, typical and unusual behaviors, connections they make to other systems (that do not traverse the NGFW), you get the idea. Doing this without the need to run agent software on each client is an absolute requirement – we will likely never have the same level of tools across all of our mobile and PC platforms, and with IoT becoming our next generation, this is even more obvious. From all of that data collected, the Practitioner gains a very rich quarom of data to work with – but remember we mentioned that ‘Noise is the enemy of protection’ without capability to intelligently assess risk and impact; this is where Impact Assessment becomes an absolute requirement for a Practitioner and for a modern security system – especially a threat-focused one.

Impact Assessment is a crucial piece for the Practitioner to know what to focus on,– turning data into actionable information. Of the thousands or millions of tracked events that will occur on Enterprise networks, knowing what is high criticality is an imperative. Then the ability to use continous analysis to track a file (and related host behaviors) AFTER it reaches the end systems is a critical function of the Threat-Focused platform, so as a Practitioner, I immediately know a malicious file has somehow morphed into something that can attack others through lateral movements, other applications or process, etc. Threat trajectory adds to this by combining the advanced visibility with continuous analysis, which allows the threat-focused platform to provide REAL risk assessment and prioritization for the Practitioner, while logging all of the forensic details needed for a more complete view during post-mortem.

I personally find it extremely naïve how often folks try to compare Firepower Threat-Focused NG-Firewall side-by-side with the typical NGFW. I suppose that is exactly what good marketing is supposed to do. Change the evaluation criteria. If all you want is a Firewall with some extra visibility for the lowest possible price, your best route may be the typical NGFW – certainly what the modern attacker is hoping for. You will then rely on the Security Practitioner’s to invest in all of the other tools needed to protect your resources and data. As we called out earlier – Tool-Rich, Information-Sparse.

Like it or not, the NGFW by itself has become less and less relevant as the primary defense against modern threats. This is evident by the number of partnerships and acquisitions that typical NGFW vendors are making to try and fill the gaps in their solution.

Cisco not only has an advantage with Firepower Threat-Focused NG-Firewall, which includes the aforementioned Practitioner tools built-in directly into its core, but also has the advantage of the additional integration with the network. Especially powerful when your network is Cisco-based. Routers, switches, Wi-Fi, mobility, SP, Carrier and Data Center-class network equipment have all been a part of the Integrated Threat Defense flight at Cisco. Integrated Threat Defenses allow us to use the network for both a sensor and enforcer, without having to rely upon a point of pass-through (like a NGFW) for visibility and protection.

In future episodes we will explore the individual security components of Cisco Firepower Threat Defense even deeper; things like outbreak controls and behavioral Indications of Compromise, network, file and device trajectory, as well as threat hunting and remediation. Technologies that you may not even know are integrated into the threat-focused system like AMP ThreatGrid, Cognitive Threat Analytics and Talos, the Cisco Threat Intelligence and Security/Threat Research component. We will dig deeper into the ‘lifetime of an attack’ and how the Cisco Firepower Threat Defense system is helping you to get from day-zero to incident closure in the shortest possible time, actually compressing the Attack Chain to benefit your Security Incident Response process. We will also explore how to integrate with key technologies like OpenAppID and AMP for Gateways as well as how the network itself is used for more than just moving packets around.

*While vulnerabilities are automatically detected through integration with public vulnerability information (feeds), Firepower Management Center can also integrate bi-directionally via Open APIs with commercial vulnerability management systems such as Qualys, Nessus and others.