VIAVI Solutions

Application Note

Next GenerationFirewall Validation

Security Hardening for Next Generation Firewalls

The new security threat agenda
As networks and functionality evolve, so too does theThe new security threat agenda....................... 1

cyber threat landscape. Today, networking is undergoing

Understanding the attack target................................2

a massive transformation, with many network functions

Introducing TeraVM...........................................................3

now being offered as a virtualized appliance. The keyquestion for many now - is how robust and reliable are
the next generation of firewalls.

Validation challenges for
Next Generation Firewalls .................................4
The Challenge – validate what? .................................4

The goal of this application note, is to deliver a simple
validation methodology which will be understood by
all, ensuring that the applied security provides
protection for the latest emerging threats. Threatsand malware now manifest themselves in many uniqueforms and do not discriminate between applications ofWork Smarter not harder!...............................................4
Security hardening
validation methodology.....................................6
Uncovering weakness with high probability ofbreach exposure..................................................................6

network functions.

When and where to patch thesecurity appliance?............................................................ 7

Attack variance and ferocity can take many forms e.g.

Shoring up defenses to block malware ...................8

Cross-site Scripting, Data Manipulation, DenialConclusion .............................................................9

Of Service, etc and are delivered using a range of
network protocols:yy UDP: (using a variety of ports)

yy RTSPyy FTPyy TCP: (using a variety of ports)

yy POP/SMTP

yy DNSyy SSHyy ICMP

yy DHCPyy SSLyy IGMPyy SIP/SDPyy HTTP

Source: TeraVM Cybersecurity Database

Cybercriminals looking to gain access will adopt a range of attack strategies, looking to pinpoint weaknesses inorder to breach the security perimeter. A fundamental defense methodology will begin by ensuring the basic
security practices have been adopted i.e. the next generation firewall has been patched for latest threats.

Understanding the attack target
Understanding the level of security vulnerability that is potentially at play, is to understand who the likely threattarget is and the applications in use. As everyday users of common software packages, it’s fair to say that all of us
are exposed and are potential targets, it’s clear from the list highlighted below that attackers are looking to use
widely used applications in their relentless pursuit of exposing security vulnerabilities:
yy Browsers: Chrome, Firefox, Internet Explorer, Opera, Safari
yy Email: Outlook, Thunderbird
yy Photographs: StudioLine, Adobe Photoshop
yy Word Processing: OpenOffice, Microsoft Word
yy Data Processing: Microsoft Excel
However, exploit strategies are not isolated to just consumer like applications, network or server side applications
are now also a target. For example take a web hosting service - offering end users simple web sites for business (orindeed personal use), as part of the hosting service package there are common administration tools and services,which are also being targeted e.g.
yy Operating System Choices: Linux, Windows Server
yy Server side language tools: PHP, JS
yy Content management systems: Joomla, PHP-Fusion, Wordpress
Indeed anything that is connected to an IP network becomes a target and this includes network appliances:
yy Dell SonicWall
yy Cisco ASA
yy Juniper Junos
Clearly from the samples above, there is a huge diversity of attack types and potential exploits. Hence to assure
security hardening the best approach is to cover as many scenarios as possible.

2 Next Generation Firewall Validation

Introducing TeraVM
TeraVM is an application emulation and security performance solution, delivering comprehensive test coverage forapplication services, wired and wireless networks. TeraVM is offered as a virtualized solution enabling the flexibility
to run anywhere - lab, datacenter and the cloud, with consistent performance coverage, ensuring that highly
optimized networks and services can be delivered with minimal risk.
TeraVM offers a wide range of application emulation and performance validation for system under test (SUT) ideal
for VNFs, physical appliances and/or hybrid deployments which may use cloud bursting techniques.
TeraVM Cybersecurity Database
TeraVM delivers a comprehensive cybersecurity database of up to 12 thousand unique threats. Each and every
one of these unique threats has violated an application or service and are independently researched, verifiedand packaged to provide the most comprehensive coverage of real world exposure of vulnerability, in a safe andcontrolled environment.
A significant portion of the TeraVM threats have a common vulnerabilities and exposures (CVE) number. However,many of the newly researched threats have yet to be CVE classified. This unique foresight enables users of TeraVM
the opportunity to validate security with the latest threat activity.
Over half of the total threats in the TeraVM Cybersecurity Database have a Common Vulnerability Scoring System(CVSS) in excess of 7 (with 10 being the most severe). CVSS is an open industry standard which approximates theease of exploit and the impact of exploit. Industry reports show once vulnerabilities are published, they are mostlikely to be recorded as a security breach.

99.9% of the exploited vulnerabilities were compromised
more than a year after the CVE was published.
Source: Verizon Data Brach Investigation Report

3 Next Generation Firewall Validation

Validation challenges for Next Generation Firewalls
The Challenge - validate what?
For many the challenge is to define a robust methodology to validate security performance. This can be a daunting
task, with uncertainty of what/how the security perimeter should be validated. On top of this, the challenge isfurther complicated by the need to maintain the relevance of the test methodology, as the cyber threat-scapecontinually adopts.
Work Smarter not harder!
Cobham Wireless addresses these unique challenges through TeraVM. TeraVM enables users with acomprehensive cybersecurity database (CSDB) with thousands of unique threats. Each of the unique threats has
been researched and validated by a third party (Idappcom) in which each of the threats have been shown tocause security breaches.

Figure 1 TeraVM Cybersecurity Database user interface

4 Next Generation Firewall Validation

The TeraVM CSDB is delivered as an easy to use HTML5 web based interface enabling ease of selection ofthreats, resolving the “how to” challenge. The intuitive filtering solves the user problems of understanding as towhat to validate with. Users simply select from any one of the many filters, the threats they wish to use in thevalidation run.
The most effective test is to validate the security appliance or system under test (SUT) by running all the threats,
looking to see the level of exposure on the current patching/version of the security system.
However, a more efficient way is to know the potential target and applications running behind the securityperimeter. By selecting the right TeraVM CSDB filters, users can quickly assess for potential exposures at a numberof levels from protocol layers to application types.

Figure 2 Example TeraVM CSDB filter in action - selection example is for SSH based threats

NOTE: The TeraVM CSDB is updated regularly with the latest threats; sourced from industry expert groups e.g. CVE,Bugtraq, ISS and Idappcom. These independently verified threats are packaged into TeraVM ensuring no malice tothe user’s environment.

5 Next Generation Firewall Validation

Security hardening validation methodology
So far the application paper notes the challenges associated with enabling performance validation for the security
perimeter and presents a solution, in this section a simple methodology is presented.
A suggested goal of the methodology is to efficiently use the security professional’s time so as to maximize thetime spent patching all discovered vulnerabilities.
The counter attack plan is simple – patch, patch and patch:
1. Uncover exposures with maximum probability of a breach i.e. CVSS = 10
2. Patch
3. Repeat step 1 for CVSS = 9 to 7
4. Patch
5. Repeat for medium probability exposures i.e. CVSS = 6 to 4
6. Patch
7. Evaluate security effectiveness to stop malware (port scan and blacklist rules)
8. Patch
Our counter attack plan is as such that the security professional spends 90% of their time hardening thesecurity perimeter.
Uncovering weakness with high probability of breach exposure
Using TeraVM’s CSDB simply select the CVSS filter and enter a value of 10, execute the test run. It really is thatsimple with TeraVM!

Figure 3 TeraVM CSDB CVSS filters set to 10

6 Next Generation Firewall Validation

When and where to patch the security appliance?
Once the test commences, the test will cycle through each of the individual threats. A key time saver with TeraVM(which enables a user to patch on the fly) is that it provides visibility in real time of the state of each of the threats
i.e. blocked or not. A fail in the TeraVM UI suggests that the security perimeter is vulnerable as the threat was
not blocked.

Figure 4 TeraVM CSDB presents live Pass/Fail criteria during the test execution

With the initial first steps completed in the methodology approach, the security professional can be confident thatthey have blocked the most severe of threats. The next 4 steps of the methodology is essentially repeating theprocess above and by the end the security professional has a very robust security

7 Next Generation Firewall Validation

Shoring up defenses to block malware
The final piece of the security hardening exercise (step 7) is to ensure that no unnecessary ports are open, by runninga simple port scan for the listening ports. By locking down the port range, this helps to ensure that any malware that
may have been delivered through a benign source such as a document file format does not have the ease to connect
to a command and control server.
Clearly a number of legitimate ports must remain open, at this point the aim is to ensure that the security perimetercan block traffic trying to connect out to the command and control server. An effective validation approach is takepublic and/or commercially available URL blacklists and attempt to connect to them again from the safety ofthe TeraVM.
Blacklist blocking validation
Connecting to TeraVM’s central test library, users can download both a domain name service (port 53: DNS lookup) use
case and/or web service (port 80/443: HTTP) use case. Both these simple test cases provide the user of TeraVM withan easy way to assess that the hundreds of thousands of blacklisted urls are being blocked. User’s simply upload theurl list into TeraVM, executes the test and sees the effectiveness of the security perimeter to block the bad, all withina few minutes!

Figure 5 Import and validate the ability to block hundreds of thousands of blacklisted urls

8 Next Generation Firewall Validation

Conclusion
The application note provides for an efficient and effective methodology to help assess and harden security. The
application note highlights the challenges we all face when it comes to implementing good security; that is ofunderstanding the threat-scape and the time to implement good security policies to cover all eventualities.
Understanding what is being protected is essential to help to define the possible threat-scape. It enables thesecurity professional to quickly define an efficient validation methodology to assess the security perimeter.
Efficiencies are further gained by selecting the right tool such as TeraVM. TeraVM provides for a simple and easy
to use interface which reports live all the possible vulnerabilities that the current policies/patch version that are
running on the security appliance may have. The TeraVM cybersecurity database offers thousands of unique andindustry proven threats, which have known and documented exploits.
The live threat reporting, which is only available in TeraVM, means the security professional can spend more timeworking on the key job of security hardening (rule creation and/or patching). Furthermore, TeraVM provides for aneffective means to assess the security perimeter’s ability to block potential malware exploits through validation
with hundreds of thousands of the latest blacklisted URLs. This helps to ensure that the attacker’s command andcontrol servers don’t get easy access to the inside of the security perimeter.
A further security challenge and headache is to stay ahead of the game. Security best practices highlight the needto stay up to date with regular patching. TeraVM as the prime security validation solution provides for regular
updates through the TeraVM strike center. With the added advantage, that the already existing test cases become
even more robust, as the latest threats are added to the cybersecurity database. All of which helps to ensure
maximum protection for the future.
By selecting the right validation partner today, helps to maximize the overall return on investment for securityhardening and validation, for many years to come!

To reach the VIAVI office nearest you,visit viavisolutions.com/contact© 2018 VIAVI Solutions Inc.
Product specifications and descriptions in thisdocument are subject to change without notice.
firewallvalidation-an-wir-nse-ae
30187420 900 0818

viavisolutions.com/wirelessvalidation