SeCaaS

 

Security as a Services – 

A business model in which a Managed Security Service Provider(MSSP) integrates their security services into a corporate infrastructure on a subscription based NGFW/UTM offering creates a powerful, single security solution consisting of the following-: Appliance bundles all hardware and services needed for comprehensive network protection along with managed Services. SeCaas Model is successful because there are lots of SMB/SME/Enterprise organization who doesn’t have the skilled resources to manage/configure/support the UTM/NGFW devices which really helps every organization to protect their important information.

Benefit-:

1. No Customer IT Staff required.
2. No Upfront Investment.
3. Low TCO.
4. Comprehensive network security
5. Managed security Services from a certified partner.

Before starting any discussion about SeCaas more first we should know about what is Cyber-Security and why it is essential for every organization in today’s world.

 Cyber Security

In today’s environment we all are connected to internet, whether from a mobile device or a system or while working in an organization, we keep exchanging digital information from one end to another end, now, what if somebody Record/Edit/Steal/Encrypt/Misuse our data, to protect our data we need to protect on various levels like System, Network, Application and so on. Now a days its not limited to Enterprises to secure their network from Cyber Crime, all Enterprises, SMB and even a single mobile need solutions to protect their digital information, approximately 9.32 billion malware attacks in 2017, approx. 18.4 percent year-over-year increase, average organization will see approx. 900 file based attacks per year hidden by SSL/TLS encryption, therefore it is required that TLS/SSL encrypted packet should inspected by DPI SSL to check vulnerability, that’s why stateful packet inspection is not enough to protect in today’s environment from sophisticated malwares.

Let’s have a broader view to understand Cyber Attacks. Attacker or Hacker uses various methods to disrupt computers operations, gather sensitive information or gain access to your private computer information, in modern terminology they do social engineering as well on the victim to gain access to his PC, Automation and Artificial Intelligence (AI) fuels automation possibilities, some examples are mentioned below.

Ransomware :-  Traditionally malware uses to halt system, corrupt system files, replicate itself, disabling access to system tools, but now a year’s attackers have become sophisticated and business-minded, they uses malicious program designed to block access to system or system resources encrypt documents and data files and ask for ransom to provide them decryption code.

Email Spoofing: - Fake emails sent to recipient in such a manner it seems legitimate (from legitimate domain and content), and the time, user trust the email and follow its instruction he is accessible to hacker.

SMS Spoofing: - Attacker uses SMS as well to full fill their purpose, like if they get to know you purchased something, and again you get a sms that follow the link to get some cash back, and the time user click on link, he got infected or he received a sms from his contact list which looks like legitimate and can ask to money deposit in urgent situation or something else.

Mobile Phone Spying: - Hacker can uses readymade tools or other scripts to gain access to victim’s mobile.

Malicious software (Malware) is software created by hackers to disrupt computer operations, gather sensitive information, or gain access to private computer systems.

Malware includes computer viruses, worms, trojan horses, spyware, adware, most rootkits, and other malicious programs.

 

Different Method Used to Protect against cyber threat

•  When we secure our endpoint system by patching or any other Security/AV software is known as System Security.
• When we secure our network by firewall or any other security device it is known as Network Security.
• When we secure applications, it is known as application security.
• When data is made secure it is known as Data Security.

Example of Various Methods used to Secure digital information

• Authentication: – By applying user name and password
• 2 Factor Authentication: – To further secure, we can have 2 factor authentications like OTP.
• Other Type of Authentication: – After having OTP (something we have), we can use “something we are” FPR, Retina Scan and Face Scan.
• Encrypt end to end traffic.
• SOC team uses some tools like SIEM (Security Information and Event Management), Splunk and Honeypot (it’s a server which attract attackers to attack).
• Using Security Devices and software like Firewall, Anti-Virus Software, DLP etc.
• And of course, end user awareness plays vital role, they are the first one who allow attackers, due to their unawareness.

UTM/Firewall Role: -

In this topic we discuss about Sonicwall feature sets and technology as the threat landscape increasing faster than any one individual can keep up with. Sonicwall CGSS (Comprehensive Gateway Security Suite) provide security against uncertainty and complexity associated with the malware we must fight in convenient and affordable package, Ranging from Sonicwall TZ Series Appliance (For small Networks), Sonicwall NSA Series (Medium Size Business) and Sonicwall E-Class and Super Massive Firewalls (For Large Enterprises). Sonicwall CGSS keeps our network safe from viruses, intrusions, botnets, spyware, trojans, worms and other malicious attacks. As soon as new threats identified and often before software vendors can patch their software, SonicWALL firewalls and Cloud AV database are automatically updated with signatures that protect against these threats. Inside every SonicWALL firewall is a patented Reassembly-Free Deep Packet Inspection® engine that scans traffic against multiple application types and protocols, ensuring your network has around-the-clock protection from internal and external attacks and application vulnerabilities. SonicWALL solution also provides the tools to enforce Internet use policies and control internal access to inappropriate, unproductive and potentially illegal web content with comprehensive content filtering and Application Rules. Brief Features of SonicWall UTM devices which help in optimization in cyber security are mentioned below.

Zero Day Protection – SonicWall Capture Advanced Threat Protection service is a cloud-based multi-engine sandbox designed to discover and stop unknown, zero-day attacks such as ransomware at the gateway with automated remediation.

Deep packet Inspection SSL: - Detect and prevent advanced encrypted attack that leverage SSL or SSH.

Bi-directional inspection: - Scan Inbound and Outbound traffic simultaneously to ensure that the network is not used to distribute malware and does not become a launch platform for attacks in case an infected machine in brought inside.

Multi Engine Sandboxing: – The multi-engine sandbox platform, which includes virtualized sandboxing, full system emulation, and hypervisor level analysis technology, executes suspicious code and analyzes behavior, providing comprehensive visibility to malicious activity.

Rapid Deployment of Signatures: - When a file is identified as malicious, a signature is immediately deployed to firewall with SonicWALL capture subscription and Gateway Anti-Virus signature databases and the URL, IP and domain reputation database within 48 hours.

Intrusion Prevention: - Tightly integrated IPS leverages signatures and other countermeasures to scan packet payloads for vulnerabilities and exploits, covering a broad spectrum of attacks and vulnerabilities. Some additional features are Intra-zone IPS protection, Zero-day protection, Anti-evasion technology and Automatic Signature Update.

Threat Prevention: - Gateway Antivirus, Cloud AV Malware protection, Around the Clock security updates, Anti-Spyware, Anti-Botnet, RBL Filter provides protection against threats.

Application Intelligence: - Provide control over application being used, approx. 3500 application signature and continuously expanding to enhance network security.

Content Filtering: - Enforce acceptable use policies and block access to content that are objectionable or unproductive with Content Filtering Service.

DDoS/DoS attack prevention: - Protect against DoS/DDoS through Syn/UDP/ICMP flood protection and connection rate limit.

Management and Reporting: - GMS/Analyzer monitoring and reporting feature allow us to investigate what is going on the network.

 Difference between Antivirus and Next Gen Firewall 

Now a question raised, “I have antivirus program installed on my machine, why do I need a Firewall”, Antivirus and Firewall both are fundamentally different, but kind of complimentary security solution. Where antivirus is a program scans files for vulnerabilities, firewall scans Network Traffic, antivirus should be installed on each endpoint and firewall installed at Gateway level. Antivirus detect harmful vulnerabilities which is already installed or about to be installed on the machine where firewall protect against bad protocols at network level like DDoS attacks. So we can say a security solution should have both firewall and antivirus in place to provide better protection against threat.