Jeff Bardin has a post up as his CSO Online blog which has a nice metaphor for data security by comparing it to vehicular traffic on highways. The metaphor comparing data to cars is pretty good (and not unique to the security space, lots and lots of traffic management and queuing strategies are well understood in terms of highways and cars) and I kind of like the way he suggests that a tool can just send 'red' (i.e. bad) cars for detailed inspection etc.

However the limits of the metaphor (how do you know the red cars are the bad ones?) show the limits of the solution he praises. Far better, it seems to me to think of a highway border crossing. Now this may be less familiar to US citizens but there are plenty of these sorts of crossings here in Europe so I am very familiar with them. The big difference between a border crossing and a toll barrier is that at the border crossing every vehicle is briefly stopped and everyone has to show a passport.

Not every car is fully inspected - in fact few are, most show a passport and are waved through - but the customs people have a list of suspects updated all the time and when they spot one they direct them into the 'red' channel for a full inspection.

This is exactly how a firewall running ThreatSTOP works. ThreatSTOP provides a regularly updated list of bad IP addresses and the firewall looks at the packets exiting (or entering) to see their destination (or source). If the address is on the "persona non grata' list then the packet is either dropped (the usual case) or directed to a security device for deeper inspection. Meanwhile all the other packets pass through with no hold up.

Becuase this system is proactive, rather than reactive, we block data loss and advance persistent threats (APT) rather than warn afterwards that some data may have leaked. As I blogged at the time, it looks like we would have detected and stopped the RSA spear-phish attack - or at least provide an alert the first time something internal tried to call home to one of the servers the criminals were using.

There is of course one obvious downside to our proactive list approach - which is that new threats will take a while to be detected. We have two fairly simple answers to that firstly we are demonstrably faster than other services and secondly that no security system in isolation is perfect. Moreover as the border metaphor shows you really want to make sure you have IDed the bad guys and not got some good guys on the list by mistake - think of all the jokes about the DHS's no-fly list. In today's world where Internet access is key being unable to contact legitimate external systems is a major cost and we take the time to exclude false positives as part of that process.