{"id":710,"date":"2018-04-13T19:53:38","date_gmt":"2018-04-13T19:53:38","guid":{"rendered":"https:\/\/live-infoblox-blog.pantheonsite.io\/?p=710"},"modified":"2020-07-30T08:34:59","modified_gmt":"2020-07-30T15:34:59","slug":"infoblox-dns-security-mcafee-web-gateway-superior-protection-for-customers","status":"publish","type":"post","link":"https:\/\/www.infoblox.com\/blog\/security\/infoblox-dns-security-mcafee-web-gateway-superior-protection-for-customers\/","title":{"rendered":"Infoblox DNS Security + McAfee Web Gateway = Superior Protection for Customers"},"content":{"rendered":"

\u201cWork together or find yourself left behind,\u201d is how one Chief Information Security Officer (CISO) put it at a recent breakfast event as he was talking to a handful of security vendors. Nothing can be closer to the truth.<\/p>\n

In today\u2019s age of highly complex networks, ever-evolving threats, and constantly overburdened Security Operations Center (SOC) teams, organizations are using best of breed solutions that are optimal for a specific security purpose. However, they want to ensure that these best of breed solutions are tightly integrated, complement each other and automatically share data and insights for holistic protection and faster response to threats.<\/p>\n

Most security teams are familiar with Secure Web Gateways. They offer protection for web traffic and filter unwanted software\/malware from user-initiated Internet traffic. These gateways usually support URL filtering, malicious-code detection and content filtering, and application controls for popular Web-based applications.\u00a0 However, these web gateways alone cannot completely secure organizations.<\/p>\n

The Need for DNS Security<\/h1>\n

DNS is used by 91% of malware1\u00a0<\/sup>to communicate with command and control (C&C) sites and for data exfiltration. Existing security tools don\u2019t inspect DNS traffic making DNS a huge security gap in most organizations. Hackers have long sensed this opportunity. A recent survey2<\/sup>\u00a0showed that 46% of respondents experienced some sort of DNS tunneling or data exfiltration via DNS. However, DNS can be turned from a liability into an asset and be used as a first (and fast) line of defense against malicious activity. A combination of reputation (aggregated, curated threat feeds), signatures, and advanced behavioral analytics applied at the DNS level can be valuable in detecting malware like ransomware as well as zero-day threats like DNS data exfiltration and fileless malware (think DNSMessenger).<\/p>\n

DNS Security + Web Gateway => Superior Protection<\/h1>\n

Combining DNS layer security with a web gateway solution can provide protection for web and non-web protocols, while ensuring holistic visibility and faster detection of malicious activity, including DNS based threats. And integrating leading solutions enables customers to take advantage of the superior capabilities from each solution while having them work seamlessly as one.<\/p>\n

Bringing Infoblox and McAfee Together<\/h2>\n

Infoblox and McAfee recently launched a joint DNS security + Web Gateway solution. The integration includes Infoblox\u00a0ActiveTrust\u00ae Cloud<\/a>\u00a0and\u00a0McAfee Web Gateway<\/a>\u00a0Cloud Service products, unifying domain blocking and HTTP security to provide broader protection for mutual customers. Infoblox ActiveTrust Cloud detects and prevents DNS-based data exfiltration, blocks DNS communications with command-and-control servers (C&Cs) and botnets, and automatically blocks access to content not in compliance with the policy. McAfee Web Protection uses secure gateway technology to protect every device, user, and location from sophisticated threats, providing web filtering and anti-malware scanning to deep content inspection and granular control over how cloud applications are used.<\/p>\n

Here is how the joint solution works:<\/p>\n

    \n
  1. ActiveTrust Cloud will detect and block malicious activities including zero-day threats like data exfiltration at the DNS layer.<\/li>\n
  2. It then conditionally redirects suspicious (but not confirmed as malicious) traffic to McAfee Web Gateway.<\/li>\n
  3. Web Gateway does the additional inspection, SSL, and malware scanning, thus expanding the protection.<\/li>\n<\/ol>\n

    \"Infoblox<\/p>\n

    This integrated solution allows customers to:<\/p>\n