All About Sourcefire; The Cybersecurity Warrior

During the recent partners and media appreciation night, 9th Mar 2012, Dean Frye (Technical Director of Sourcefire APAC) explained that Sourcefire has an open source heritage.

Sourcefire was founded in 2001 by Martin Roesch, the creator of Snort, is a free and open source network intrusion prevention system (NIPS) and network intrusion detection system (NIDS).

Over the period of more than 10 years, Sourcefire has continued to maintain Snort for the open source community while leveraging on those open source experiences to benefit the commercial version of intrusion prevention system (IPS).

Dean explained that having open source heritage explains Sourcefire’s originality as well as the robustness of the system in terms of meeting expectation, tested by community and simply being in touch with community all the time.

This is a good strategy for startup companies to emulate. And Sourcefire proves that this strategy is a worthy best practice.

As of today, Sourcefire has the following products:

• Next Gen IPS – Intrusion prevention system.
• Next Gen Firewall – sits on top of IPS, leverage on IPS for protection.
• Centralized Management – Management console; It provides a powerful, easy-to-use interface for categorizing events, generating recurring reports, scheduling automated Snort rule updates, configuring policies, and displaying customizable dashboards to quickly communicate sensor feedback.
• FireAmp – Advanced Malware Protection
• FirePower – supports a range of Sourcefire security solutions with unmatched performance and energy efficiency.
• FireSight – built into all Sourcefire next-generation security solutions—NGIPS and NGFW—to provide the network intelligence and “context” you need to respond to changing conditions and threats; to enable visibility

It is important to take note that Sourcefire solutions are deployed as appliances, means hardware and software bundled into customized boxes that look like stack servers. And hence, one has no way of downloading free trial of the software to be installed on server acting as IPS, the best trial that one could get is Snort, the open source version of Sourcefire IPS.

I also aknowledge this as a good strategy because deployment of server-based software is best done in a box in order to ensure performance which are optimized up to hardware level.

With the full suite capability of Sourcefire network security technology, the best thing that I like about it and as what KY has explained is that Sourcefire technology allows one to perform visibility before acting and it is agile and comes with automation. This simply demonstrates the fundamental behind Sourcefire technology architecture which is based on the four pillars of principal.

1. See – visibility
2. Learn – correlate
3. Adapt – optimise defense
4. Act – action!

Sourcefire FireAmp is a newer product added to Sourcefire security suite. It has the ability to detect Malware and act upon it at the endpoint with the fastest speed ever, by leveraging on analytics capability hosted on cloud environment. How it works is by taking a fingerprint (SHA hash) and send out to the analytic engines for analysis in split seconds, fast enough to perform outbreak control in order to intercept damage at endpoints during run time.

In other words, it is designed to solve Malware problems at the endpoints and there is no need to have a forensic team for such purpose.

Sourcefire technology also support virtualization. The Sourcefire Virtual 3D Sensor and Sourcefire Virtual Defense Center™ are available for VMware, XEN, and Red Hat platforms. These virtual appliances enable you to inspect traffic between virtual machines (VMs) and simplify your deployment and management of sensors at remote sites where resources may be limited.

Another interesting concept is known as quad stacking. The 3D8000 series now allows quad stacking so that customers can grow throughput to deliver over 40Gbps of IPS inspection in 10Gbps performance stages. This throughput scalability enables customers to purchase a device based on current performance requirements, and then easily expand throughput as needed. With its new 40 Gigabit Ethernet support, the 3D8000 family also makes Sourcefire the first network security vendor to offer programmable fail-open 40 GbE interfaces to the IPS market.

So why is network security becoming so critical for organizations these days ?

The first thing to take note is the trend of consumerization of IT. This trend simply defines that individual end users are able to influence enterprise IT road-maps based on the availability of lower cost and greater adoption of common and powerful consumer applications, social media applications and powerful mobile gadgets with enough computing power to perform corporate assignment.

The happening of this trend creates more threat vulnerabilities for the network because consumer devices come with unpredictable nature.

And since individual end users are going to decide the what they want to use in the working environments, it is important to have capability of control without compromise. For instance, how to allow access for Facebook but disallow gaming ? All these can be done with deployment of Sourcefire technologies.

Sourcefire Malaysia is currently headed by country manager Ivan Wen.