Plug and Protect Your Network

Overview

Arxceo’s PnPro, or Plug and Protect, architecture encompasses a combination of both hardware and software innovation that provides the underpinnings for the most robust implementation of intrusion prevention in the areas of Anomaly Intrusion Detection, Protocol Enforcement, Anti-Reconnaissance, and Address Authentication. Products based on PnPro are quick to deploy, easy to administer, and extremely difficult for attackers to detect, much less compromise.

The PnPro architecture starts with a Layer 2 bridge implementation using dual network interface cards (NICs) that do not use a network stack for receiving or sending network packets. The exact type of NIC card, including performance and features, differs depending on the particular product model type. For instance, Arxceo’s Ally IP100 provides a pair of 100BaseT, or 100Mbit, NICs and the Ally IP1000 provides two pairs of 1000BaseT, or 1Gigabit, NICs. One of these 1000BaseT NICs also has the ability to continue passing traffic if the device fails or loses power – as if the device was never installed in the first place. Arxceo’s feature of passing traffic during a “crashed state” is called NetFailOpen™ and administrators can choose to fail open or closed based on their specific needs or preferences.

Inline Appliances

Arxceo’s PnPro architecture uses an inline design, joining two disparate segments of a network, such as connecting a company LAN to the Internet. The only way for traffic to enter the LAN is by passing across, or through, the inline device. In this position, the device is able to review and act upon traffic in real time, before any potentially harmful traffic passes to the protected segment.

No Network Stack -- It's Tough to Target What is Not Seen

PnPro does not implement a network stack on the NICs used to bridge the protected side of a LAN from a non-protected, or public, WAN (or Internet). Many attacks exploit the design of industry-standard protocols, such as TCP, UDP, and HTTP. By avoiding the use of traditional network stacks, the PnPro architecture is safe from those types of vulnerabilities and is essentially invisible. Attackers cannot target or compromise the device itself. Devices implementing the PnPro architecture do not have IP addresses at all, nor do they recognize or respond to assigned MAC addresses. Additionally, such devices do not decrement TTL or increment Hop Counts – thus running in an invisible fashion that prevents attackers from seeing the devices by tracing traffic patterns or packet-routing.

Additionally, administration tasks such as hardening or patching the operating system (OS) and monitoring for device compromise can be drastically reduced or eliminated. The PnPro architecture removes the need for hardening or patching the underlying OS. Other than minimal use of the OS for booting and writing events or alerts to a log file, the PnPro architecture is a self-contained, hardened environment that eliminates OS and network protocol exploits.

Tag-UR-IT

Tag-UR-IT's intuitive and adaptive pre-processing engine entirely eliminates address spoofing and other network abuses such as Denial of Service (DoS), Distributed Denial of Service (DDoS), Distributed Reflective Denial of Service (DRDoS) and other resource floods designed to overload network hardware and software to cause massive system outages. In addition to its ability to track and report network reconnaissance attempts against a company's network, Arxceo's products obfuscates or confuses would be attackers by generating random and misleading network information. Tag-UR-IT implements a patent-pending methodology that randomizes vital network and computer information such as the initial sequence number (ISN), source ports, internet protocol ID, operating system fingerprints and DNS transaction IDs. And all of this protocol hardening is transparent to users, applications, routers, firewalls and servers.

This methodology has been proven to provide a 0.0000001% chance of predicting any of these values. Tag-UR-IT offers a range of features and their related benfits such as:

Protocol Fortification - Tag-UR-IT fortifies network protocols by strengthening or hardening legacy protocol vulnerabilities and eliminating exploitable holes available in various network protocol standards to eliminate abuses such as covert channeling, DNS cache poisoning, fragmented packet 'exploit injections' and raw-frame Ethenet data leak transmissions. This fortification provides a hardened network stack guarantee on connection-oriented (TCP) and connection-less based protocols, like UDP, for every device protected by an Arxceo Ally appliance.

Transparent Connection Authentication - Tag-UR-IT provides for transparently authenticating end-user TCP connections without requiring any client software to communicate or authenticate the session. This authentication elminates address spoofing, which is a common method used in both network reconnaissance and network attacks -- including the range of Denial of Service abuses.

Anti-Reconnaissance Countermeasures - Arxceo's patent-pending Tag-UR-IT implements a randomness methodology, along with various techniques that obfuscates packet scanning, to confuse reconnaissance results of tools typically used by would-be attackers. These tools derive information such as operating system and versions of the targetted device to be attacked. The results of various reconnaissance tools return different information to further delay or thwart a successful network scouting session. Results even change from session to session when using the same tool repeatedly.

Security, Convenience AND Performance - Arxceo's Tag-UR-IT based products offer consumers easy to use and install security appliances with the highest level of connectivity protection. There are no complex configuration or management inteventions required, nor any learning modes that can cause severe false positives at different times of the day, week, month, quarter or year. And all of this simplicity comes with an unheard of breakthrough for a security product -- improved overall network throughput. Traditionally, security devices, such as deep packet inspection firewalls and signature-matching IPSes pay a performance penalty in order to successfully perform their functions. As Tag-UR-IT rapidly performs its protocol fortification, exploit eliminations, and packet filtering tasks, it is also cleaning up and elminating a large amount of traffic, thus freeing up these other devices to focus on the job they do best. Therefore, overall network throughput is improved throughout the entire security 'enforcement' process. Plus, all the devices' log files are much smaller due to elimination of any spoofed traffic which is useless in an auditing procedure.

Preventing DNS Cache Poisoning, Covert Channel Tunneling and Worm propagation - Tag-UR-IT detects and prevents the misuse of traditional protocols and quickly shuts down any session or IP address attempting such an abuse. Tag-UR-IT provides covert channel protection and mis-use of protocols such as DNS that can be used to usurp security policies, along with scan detection and automatic blacklisting to mitigate worm propagation.