Quick Network Security trial

Leverage Network Security's comprehensive Intrusion Prevention System (IPS) to actively monitor traffic and get assistance meeting requirements for PCI 11.4. This quick trial guide provides information on:

• Deploying Network Security Edge protection to intercept inbound and outbound traffic, and route it to the Network Security virtual appliance for inspection using AWS's VPC Ingress routing. Learn more about Edge protection and other deployment options.
• Creating a web server to simulate a sample cloud environment using a CloudFormation template.

Deploying protection

Follow the steps below to use the CloudFormation template to create a test stack:

1. Log in to your AWS account.
2. Click this link to create the CloudFormation stack.
3. Make appropriate changes to the following parameters:
   • SSH Key: - Learn more about SSH keys in AWS documentation.
   • C1API Key: - Learn more about creating a Trend Micro Cloud One API key.
   • CIDR: - The default setting 0.0.0.0/0 allows anyone on the internet to access to your EC2 instance. Restricting access to your IP address is highly recommended. Learn more about verifying your internet address.
4. Click Create stack. Allow enough time for the process to complete. The resources below are deployed upon successful stack creation:

The architecture diagram below provides a visualization of a Network Security Edge deployment.

Note: This demo does not include High Availability components such as SNS topic, CloudWatch alarms or Lambda functions. Use the Get Started Wizard described under Next Steps to enable these resources in your cloud environment.

Attack simulation

To see your Network Security virtual appliance intercepting attacks in action, you can execute a few simple commands that simulate an attack.

Inbound attacks

Network Security's virtual appliance provides virtual patching, protecting vulnerable infrastructure against inbound attacks, by sending alerts when ingress traffic matching a known vulnerability is observed. You can perform these attacks from your local host, targeting the web server instance that was deployed with your CloudFormation stack as shown below:

16798: HTTP: GNU Bash HTTP Header Remote Code Execution Vulnerability

From the local host command line shell, execute the following command targeting the web server instance: curl -H "User-Agent: () { :; } ; /bin/eject" http://<web server ip>

The virtual appliance detects suspicious traffic and blocks the request. A log event indicating the successful block of the attack is also generated.

Follow the steps below to view log events:

1. Navigate to Services > CloudWatch in the AWS portal.
2. From the left navigation menu, select Logs > Log groups.
3. In the Log group c1_network_security_logs, open the Log stream ipsBlock_<instanceId>. You will find entries matching each of the filter IDs and descriptions.

Outbound attacks

Network Security's virtual appliance protects against outbound attacks, by creating an alert when egress traffic matching a known vulnerability is observed. To see this in action, run the attack simulation from the web server instance deployed with your CloudFormation stack. Use the login ID 'ec2-user' to Secure Shell (SSH) into the instance using the SSH key specified during deployment.

1292 : HTTP: wguest.exe Exploit

From the local host command line shell, execute the following command targeting the web server instance: curl 'http://www.example.org/server/cgi-bin/wguest.exe?template=c:\boot.ini'

The appliance detects suspicious traffic and blocks the request. A log event indicating the successful block of the attack is also generated.

Outbound attacks using Malware filters

To efficiently run the outbound attack simulations below, you will need to verify that you have the latest threat intelligence packages installed. To ensure that your threat intelligence system is up to date, navigate to Policy > Sync Management on the Network Security home page. Click Sync Manually to download the latest packages. Learn more about Network Security threat intelligence packages.

Note: The appliance relies on up to date threat intelligence information to detect and block attacks, like those simulated below. Ensure that synchronization is complete before proceeding.

Follow the instructions below to run the attack simulation:

Follow the instructions referenced above to view log events.

Note: It may take a few seconds for the events to propagate to CloudWatch.

Learn more about these attacks.

Under Network Security, select Policy > Intrusion Prevention Filtering. Enter the filter ID in the search field, to see more details.

Next steps

Now that you have had a chance to experience the inbound and outbound protection offered by Network Security, take the next steps to protect your cloud infrastructure.

Use the Get Started wizard in the Network Security management interface to begin deployment. This generates a new CloudFormation template that deploys Edge protection in your network using information obtained from your cloud account.

If Edge deployment is not right for your environment, you can also learn more about all the available Network Security deployment options available in AWS.