Host-based Versus Network-based Security

The argument is an old one; are you better off with a network-based detector, assuming all hosts will eventually communicate, or should you look at each host to determine what they are up to?

Over five years ago, the network was far simpler. There was a clear perimeter – us versus them, if you will. You could examine all traffic at the egress point (so-called North/South traffic) for potentially hostile patterns while pretty much ignoring local traffic (so-called called East/West traffic) as usually benign. This is usually done with the help of attack signatures which are updated periodically. In other words, classic network-based, signature-driven detection.

This applied to firewalls. You could be network-based and/or have one for each host. The attraction of the network-based firewall is simplicity; one device to deploy and manage versus the hassle of configuring one firewall per host. Notice that this depends on the traditional (simple) network with a clear us/them perimeter. But that is a pretty simple, traditional model that is vanishing fast. Applications are moving to the cloud and the perimeter is porous. You pretty much need a micro-fortress around a host or location.

So, what arguments are the network-based passive monitoring solutions making for themselves? And how do they stack up against a host-based managed solution? Let me count the ways…
 
Claim Response
Passive network monitoring has no impact on endpoint performance A well-designed, user-space host-based solution has virtually no impact on the endpoint 
A network-based solution is transparent to system users The host-based sensor runs as a service and is also invisible to users
Network monitoring is invisible to attackers Insiders know of its existence because they have access to the network diagram; every external attacker assumes that network traffic is being monitored and seeks to be stealthy
Network-based monitoring can listen to all endpoints, regardless of type; no specific sensor is needed A host-based sensor must be provided for each endpoint type; the common ones are Windows and Linux
Passive network monitoring devices are easy to install When host-based sensors are provided as a managed service, they are also simple to install
When monitoring at the egress point only, endpoints can move or be added with no extra effort Endpoints are usually not added/moved randomly, but through a defined process; extending this process to accommodate sensor deployment is no more work than deploying patches or anti-virus
 
And then here are challenges with network based monitoring…
 
Challenge Problem
Network-based signatures are always out-of-date or lagging Zero-day attacks are not detected, maybe worse; detection is limited to attacks with signatures only
Packet inspection is blind to encrypted traffic North/south network traffic is increasingly encrypted
Packet inspection is hard to scale as network speeds increase OTOH host-based approaches scale neatly both up and down; we're going to need a bigger boat
Network monitors can’t handle switched networks; it requires span ports Now you need span ports, more hardware, and networking skills
Network monitors usually can only see north/south traffic Insider threat, anyone? Remember Nyety? It spread laterally. Here’s an article about how to detect.
Network monitoring is blind to host activity; new processes, removable media Remember Edward Snowden?
 
Network monitoring does no log collection; therefore, it can’t meet compliance requirements
 
PCI-DSS, NIST 800-171, and all other compliance standards mandate log collection and retention for 1+ years to be able to perform forensics
 
And now, the advantages of a host-based solution…
 
Advantage of a Host-based Solution
Collect audit trail; meets compliance needs
Develop detailed understanding of user behavior; fight insider attacks
Scales well; no single choke point
Detect subtle patterns of misuse which can’t be seen at a higher layer (first-time-seen, zero day)
Effective for encrypted traffic as well
Sees all actions including east/west
Effective against removable media
Works even in switched networks
 
And to be fair, how to address the challenges…
 
Challenge Response
Sensor deployment to nodes SIEMphonic is a managed service; leave the deployment/configuration to us
Sensor can impact node performance The EventTracker Windows sensor consumes 0.1% of memory/CPU resources and 0.001% network bandwidth
Adding nodes means adding sensors It’s no more complicated than deploying anti-virus
Can’t see all network traffic; only those where a sensor is installed The next-gen firewall you already paid for does see this traffic; we get all of its logs, so why duplicate effort/cost
Sensor must be available for chosen platform An EventTracker endpoint sensor is available for Windows, Linux, AS/400, and IBM iSeries
 
Don't bring a knife to a gunfight. Passive network monitoring may be attractive because of deployment simplicity, and the fit and forget promise, but it is not capable of solving today's network security ad compliance challenges.