Cisco Adaptive Security Appliance goes beyond blocking ports. Is that a Microsoft-only defense?

I recently installed my first Cisco ASA-5500 security box. It is a very impressive piece of equipment, with a bewildering array of capabilities. The feature that find most intriguing is that it goes above (in the ISO/OSI sense) the IP, TCP and UDP layers, presumably inspecting whether a message or packet contains a virus or other malware.

What I would like to clarify, because is a matter of dispute among some colleagues, is exactly what applications and operating systems are being inspected. My buddies claim (more like a wild or hopeful guess) that not only is port 1521 of an Oracle server blocked but the ASA knows about Oracle exploits, and similarly it can check for weaknesses on behalf of Linux or other Unixes. I find that very hard to believe, and my counterclaim is that only Windows or other Microsoft products have reached a level of disseminated infections to grant the depth of attention by the security software.

Comments?

-Ramon F Herrera

Reply to
Ramon F Herrera
Loading thread data ...

Looking at the data sheets, it just looks like it uses typical trend micro stuff to look for malware. If they can point to something that specifically mentions Oracle, let us know.

Most of us don't even use port 1521 anymore.

Be afraid:

formatting link
Hey, maybe that means they do know what to look for!

jg

-- @home.com is bogus. Burn me once, shame on you. Burn me twice, shame on me. Burn me enough times you have to reformat the output for number of times burnt, shame on Microsoft!

Reply to
joel garry

Why don't you test it out?

That starts by constructing a test case and determine how this device allows/prevents/alerts ...

Reply to
hpuxrac

Please clarify. Are you claiming that most folks are simply using another port different from 1521 in hopes of confusing the attackers (due respect, but that would be a rather poor defense) or are they using a non-TCP mechanism to communicate with the server?

-Ramon

Reply to
Ramon F Herrera

I would have to open port 1521 in my firewall to see if I can compromise it remotely. Then try to break into my Linux machines, and similarly for the Macs. I simply don't have the resources. It would be so much simple if Cisco published it explicitly: "all the anti-malware tools we have is for Microsoft products".

-Ramon

Reply to
Ramon F Herrera

Search metalink and Oracle security related sites for the minimum necessary hardening. The proof of concept worm that was floating about not long ago got everyone in a tizzy about changing 1521. See

formatting link
petefinnegan.com pointed to this:
formatting link
jg

-- @home.com is bogus.

formatting link

Reply to
joel garry

I believe ASA is extremely limited right now and also requires a firmware update to improve its detection. I seem to recall it has about 30 application layer checks versus Juniper's 100 application layer checks and versus Check Point's 1,700 application layer checks. I'm more familar with CP and it definitely knows about different exploits for many vendors products.

Ray

Reply to
JJ

Perhaps instead of talking to Cisco you should talk to F5 Networks.

Reply to
DA Morgan

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.