Chief blogging officers debating NAC

"Chief Blogging Officers" at two security vendors have a highly technical and meaningful debate:

http://www.nevis-blog.com/2007/08/wondernac-i-lik.html
http://www.stillsecureafteralltheseyears.com/ashimmy/2007/08/more-on-the-won.html





Add to Technorati Favorites

Microsoft's trusted ecosystem vision and its review at Dark Reading...

One of the technologies Bill Gates mentioned as part of Microsoft’s “trust ecosystem” was IPSec. [http://www.microsoft.com/presspass/exec/billg/speeches/2006/02-14RSA06.mspx ]. Tim Wilson at Dark Reading believes that it is an unproven technology ;) and SSL is better. I would like to point out to him that IPSec has been around for a very long time and there are hundreds of good products around. The only reason why SSL became more popular as a VPN method in recent years is because web browsers have it builtin and a lot of applications people were interested in were web based. If Microsoft had provided an easy to use IPSec client in Windows from the beginning it could have been different. As far as core technology is concerned there is both IPSec and SSL use pretty much the same cryptographic algorithms and therefore are equally secure. Since it runs at the network layer IPSec can support almost all applications while SSL is restricted to those that use TCP. While that covers a lot of applications, it does not cover VoIP which uses UDP. In addition IPSec scales well as it does not require the device to terminate TCP. It allows multiple sessions on a single channel resulting in better scalability in terms of the number of concurrent channels a VPN terminating device has to support and the number of key exchanges that need to be done.
Tim claims that IPSec is insecure because it connects the endpoint to the whole network whereas SSL connects it to only a specific application. While there is some truth to this, IPSec VPN devices generally allow policies to be configured that can restrict access to specific applications.
One of the new frontiers in the security war is the internal corporate network. To secure them one of the things that need to be done is to authenticate endpoints connecting to it and enforce policies. This is being done by NAC (pre and post admission) but the authentication aspect is insecure today because in the absence of a cryptographically secured connection, endpoints can spoof their addresses and fool the NAC devices. I believe IPSec holds promise as a standard and proven technology to fix this problem. I am glad that Microsoft is thinking about this and if they integrate IPSec with 802.1x into Windows seamlessly, it will encourage switch vendors to add IPSec termination to switches and secure the corporate LAN.




Add to Technorati Favorites

On Internal LAN security, switches and IPSes

I have heard some security researchers claim that since anti-virus (and anti-spyware and other anti-X software) software exists on hosts, the network just needs to make sure that it is working properly. That is indeed a core idea behind NAC (or NAP if you prefer) but as the more pragmatic security professionals will observe, security needs a layered approach. This is because no individual layer of security is foolproof; there is always a chance that it will fail. Consider for example, rootkit based spyware that can avoid detection by anti-X software on a host but a network based monitor (a specialty appliance or embedded in a switch, router, firewall or IPS) can detect it by looking at the network traffic from/to that host. Indeed rootkit based spyware and anti-X software evasion are expected to be dominant problems this year [ http://searchsecurity.techtarget.com/tip/0,289483,sid14_gci1238948,00.html?track=NL-494&ad=577800&Offer=SEbpd124&asrc=EM_UTC_938379&uid=5726676 ] Multiple layers reduce the chances of security failure because the probability that all of them will fail at the same time is low. Of course, adding layers increases the cost and complexity while making management difficult so we cannot have hundreds of them. But it is fairly easy to see that we need at least two layers: one in the network and one on the host. It would be a mistake however to assume that these two layers will have completely complementary, non-overlapping functionalities. Both will tend to use similar algorithmic techniques like pattern matching (aka signatures) for known malware, protocol anomaly detection and behavioral anomaly detection for unknown malware. They may differ in their set of patterns, protocols or behavior models and in platform specific implementation optimizations but for engineers building them they are essentially similar techniques. They may differ in their input sources e.g host based systems will scan memory and files whereas network based systems will scan network traffic. So my point is that we will see the role of the network in NAC get augmented with more IPS-like features. Firewall and IPS vendors will start getting traction in the internal network (they are mostly deployed at perimeter today) but will face new challenges unique to the internal network like higher performance requirements, need for integration with other intranet infrastructure (like switches, directory servers etc.) and a difference in the application landscape (like CIFS, CVS, J2EE etc which are mostly not seen as much in the perimeter). On the other hand switch vendors will start adding firewall and IPS-like features to their switches but face challenges developing switch architectures to allow the "programmability" and "deep processing" that is needed.



Add to Technorati Favorites

Welcome to my blog !

Hello Readers,
I am an engineer who has been developing security products for about 7 years. In this blog I will write about information security from the point of view of an engineer who builds security products. I would love to hear your comments and opinion (especially from those who use these products) on my small essays.

Cheers,
Mohit