Consider deploying a quarantine solution to meet the demands of network isolation

But then things take a turn for the worse. The Ministry of Internal Affairs and Communications' Local Government Information Security Measures Study Team's report, ``Toward Drastic Strengthening of New Local Government Information Security Measures'', proposed a ``three-layered measure''. Separate the three networks of the internal system that uses the business system and the Internet system that uses email and the Web, and try to make harmless communication without the risk of virus infection when exchanging between the internal system and the Internet system. guidelines have been announced. Mr. Yasunobu Fukasawa, Manager of the Information Policy Section of the General Affairs Department of Fuji-shi, said, "It was a sudden story, so we were surprised. You can, but simply separating them will greatly reduce the convenience of your business.Therefore, we have developed a mechanism for safely exchanging files between networks. I thought we needed a quarantine solution that would move the files to the agency system after confirming that they were free of virus infections," he recalls.

Therefore, the city consulted with Macnica, the distributor of the FireEye NX series, which the city had already decided to use, and they suggested using the FireEye FX series as a quarantine solution.

“We considered a product that uses signatures to quarantine, but we were concerned about dealing with unknown attacks, so we wondered if it would be possible to use the Box product’s functionality to achieve safe file transfers between networks. We were introduced to the FireEye FX series, and decided to adopt it because we decided that its file, content, and security functions matched our objectives." (Mr. Fukasawa)

Evaluate the simplicity of the quarantine system and the short time it takes

Fuji-shi introduced the FireEye FX series in December 2015. Quarantine is performed by placing it on the internal network of the agency and scanning the file server from there.

The specific flow of quarantine is as follows. First, files that users obtain via e-mail or websites are stored in the "file server 1" that connects to the Internet. The FireEye FX series analyzes these files and classifies them into three levels: "Good", "Bad" and "Unknown". Then, only the files in the Good folder are moved to the "file server 2" in the office system as "harmless files", and finally released to users. Conversely, files created by the internal system of the agency are delivered to the outside via the reverse route.

“Quarantine with the FireEye FX series only needs two entry and exit points for the file, and the mechanism is simple and easy to understand. Just put the file in the specified location and it will be automatically quarantined. It is also easy for users to understand.If it is a normal file size, it will take only a short time to quarantine, and there is no loss of convenience." (Mr. Fukasawa)

Defend against unknown attacks with unique virtual execution engine "MVX"

Mr. Fukasawa says, "The unique virtual execution engine 'MVX' installed in the FireEye series is extremely excellent, and can defend against unknown attacks that cannot be detected by other security products, and has actually stopped attacks many times. It also judges the degree of danger of detected threats on a five-point scale, and since it can be viewed later as a record, verification is easy,” says the evaluation of its performance.

In general, with Box products, frequent false positives and false positives put an excessive burden on the person in charge, but FireEye only issues alerts for really dangerous threats, so there is no need to worry about that. However, since it is expected that there will be more situations where security measures will be required in the future, the city plans to train personnel who can analyze the alert information output from the FireEye NX series and FireEye FX series. “With FireEye, which has a somewhat formatted flow of operations, I think it would be possible to complete training in a short amount of time. In addition, attack phases can be easily checked using keywords, and failures can be isolated, so it is easy to understand security. I think it would be easier for the person in charge to judge the situation,” said Fukasawa.

As the FireEye FX series begins full-scale operation, the city has high hopes for Macnica 's support. "In response to our request for a quarantine solution, we were able to receive the most suitable proposal at the right time. Once the actual operation begins, we will be able to consult with you on various issues such as dealing with problems and testing samples. I believe that this will become a reality, so I ask for your continued support in the future.'' (Mr. Fukasawa)

To meet these expectations, Macnica will continue to support Fuji-shi 's security efforts.

User Profile

*Information at the time of interview.