Big News for Check Point Firewall Customers

Today, Check Point Software Technologies, one of the old guard in the world of information security, announced they are purchasing Nokia's security appliance business. This is welcome, if late, news to Check Point's customers who use Nokia hardware.  For many years, Nokia was the de facto hardware platform for deploying Check Point firewall software.  Check Point/Nokia shops have been struggling for months to decide how to respond to Nokia's announcement that they would rid themselves of this troublesome (think non cell phone) business.  For customers with sometimes hundreds of Nokia appliances, the fear of potentially unsupported hardware, or of a big firewall replacement project, were equally disturbing.

This new agreement spawns a couple of interesting questions: 

What will happen to the appliances that Check Point is now shipping? With the purchase of a hardware company, Check Point may want to change their outsourcing relationships with existing hardware manufacturers. Customers who recently purchased Check Point branded hardware appliances may want some type of formal clarification regarding the future of their chosen platform.

How will this affect Check Point's own operating system, SecurePlatform?  The Nokia OS, IPSO, has always been a bit of a bear to use, in my opinion.  It is based on a BSD-type OS but is not ubiquitous enough to have the elegance of other members of its family.  SecurePlatform, however, is a Linux-derivative and is very Linux friendly.  Will Check Point merge some of the best features of IPSO, such as its routing capability, into a more robust SecurePlatform or will SecurePlaform go away and be replaced by the next generation of IPSO?

This is clearly a good move from the Check Point customer perspective.  It would seem to signal continued Nokia support and better upgrade options for long-term Check Point customers.  Check Point always used to point out that "Software" was in their name and they would never become a hardware company.  Perhaps a name change is also in their future?

Another Microsoft critical out-of-band security patch

As the day draws to a close on December 16, 2008, Microsoft issued an advance out-of-band security advisory, #961051, and an emergency patch to follow the next day.

The vulnerability behind this advisory is a critical remote-code-execution vulnerability within Internet Explorer (IE). All currently supported versions of IE are affected. The vulnerability is related to an invalid pointer used in the data binding element within IE’s code base. This vulnerability allows remote execution of arbitrary code. If a vulnerable browser visits a malicious Web site, this Web site can instruct the browser to execute arbitrary code with the same privilege as the user itself.

 

Microsoft first became aware of this vulnerability when anonymous reports of the vulnerability surfaced on a Chinese Web site. On Tuesday, December 9^th, Microsoft’s response center saw an increasing number of attacks utilizing this vulnerability. This prompted Microsoft’s taking the extraordinary action of issuing an out-of-band security advisory and an emergency patch for IE.

 

So far, the attacks Microsoft has seen are for IE 7 only. They reported that approximately 0.2% of Windows users may have been affected by these attacks. Microsoft has issued emergency patches for all supported versions of IE and all languages.

 

What should you do about it? As a consumer, if you have automatic Windows Update turned on, you should receive the patch automatically. If not, we recommend that you enable automatic updates from the control panel. As an organization, many already have automated procedures to install vendor patches. This is, however, a critical patch which must be attended to immediately.

 

What is Microsoft doing to avoid similar vulnerabilities in the future: Microsoft is saying that the particular nature of this vulnerability made it difficult to be detected by automated tools. As such, their SDL process failed to catch it. However, as we understand it, Microsoft’s SDL process goes beyond the use of automated tools. Why threat modeling, code reviews, and extensive testing did not catch this critical vulnerability is not an easy question to answer, and we are eagerly awaiting more information from Microsoft.

The Numerous Meanings Of "Data Protection"

In my coverage of business continuity and disaster recovery, I talk to both IT infrastructure and operations professionals as well as IT security professionals and I've found that the term "data protection" means something different to each. This comes as no surprise and I think for a long time it didn't really matter because IT operations and security professionals operated in independent silos. But as silos break down and "data protection" is a shared responsibility across the organization, it's important to be specific and to understand who is responsible for what.

For IT operations professionals, "data protection" means creating a duplicate copy of data for the purposes of restore/recovery in the event data is destroyed due to a total site failure (i.e. flood takes out your data center), system failure, drive failure, accidental deletion etc. You can create a duplicate copy of your data either locally or at a remote location via backup, snapshot, replication etc. You are protecting your data from destruction. This is why backup companies such as CommVault, EMC, IBM Tivoli, HP, and Symantec (the former Veritas) refer to their backup applications and other offerings as "data protection software." The name of HP's backup application is HP Data Protector. Ironically, these "data protection" offerings sometimes make your data less secure because it is backed or replicated to tape or over the Internet to another site in a clear text format. Which is why all these vendors now offer the ability to encrypt the data as it's backed up to tape or replicated.

For IT security professionals, the term "data protection" means ensuring that only authorized individuals have the appropriate level of access to your organization's sensitive data and that all access is tracked for audit. You deploy perimeter security, end-point secruity, data encryption etc. to "protect" your data from breaches, "leakage," crimeware/malware, physical theft etc. Thus we have security vendors and offerings such as McAfee's Total Protection For Data and Mobile Armor's Data Protection Suite.

You could argue that holistic data protection requires both recoverability and security and I would agree. Data storage is one area where IT operations professionals and security professionals need to work more closely together particularly in the area of encryption and secure data erasure. Right now, storage architects and administrators are evaluating new data storage encryption functionality available in tape drives, appliances, storage networks, disk drives, and path failover software. They're also looking at secure data erasure services from the major storage vendors. These are services that ensure the data is wiped clean before an entire storage array or individual disk drive is returned to the vendor or to an asset disposal company and refurbished.

I'd be interested to know whether the term "data protection" has led to any confusion in IT shops and also how well security professionals know about the vulnerabilities in enterprise disk storage and tape and if storage teams are relying on their expertise to solve some of the challenges.

Thomson Reuters Gets A Jump On Holiday Shopping, Acquires Paisley

Keep an eye out in the next week for Forrester’s GRC Trends 2009 report, which will take a look at how a decidedly rocky end of 2008 will impact those responsible for various aspects of corporate governance, risk management, compliance, audit, and finance... as well as the product and service firms that serve them.

One trend that we call out in the report is the impending consolidation of the GRC technology landscape, which is a top-of mind issue for many leading vendors in the space.

Wednesday, Thomson Reuters got an early start on this trend with a definitive agreement to purchase Paisley. A leader in the GRC platform and audit management markets, Paisley will be a strong addition to the company's Tax and Accounting group.

Concern among businesses about their risk management practices and impending regulatory actions will be a major driver for growth in the GRC market, and considering this significant potential, we expect other attractive acquisition targets in the space to be scooped up over the next 12 months.

The new math: Does RSA + MSFT = the future of data-centric security?

[Written by Thomas Raschke and Bill Nagel]

On December 4, 2008, RSA and Microsoft jointly announced the imminent release of a collaboration that integrates RSA's Data Loss Prevention (DLP) product into Microsoft’s enterprise offerings. Initially, this means an integration between RSA's DLP 6.5 and Microsoft’s Active Directory Rights Management Server (AD RMS). The DLP product identifies and classifies sensitive information and RMS automates policy enforcement based on a company's existing AD structure. The integration is admittedly relatively basic to start, but in the long term the two companies expect DLP to be tightly woven into the fabric of Microsoft's enterprise products — identity-enabled data protection sitting deep within a company's Microsoft infrastructure.

What it means: All things considered, this is good news for every CISO. Microsoft has the broadest technology base by far; teaming up with a true security front-runner like RSA mitigates the fact that Microsoft has also had arguably the largest selection of security challenges in the past. The partnership addresses today's prime security challenge: By and large, firms tell us that the need to protect sensitive information leaking to people and places inside and outside the corporate perimeter is the single biggest obstacle they face.

CISOs' current strategies on how to go about implementing data-centric insider threat protection take a number of different forms. Some use encryption (mainly of the full-disk variety) as a kind of basic, "one size fits all" approach. Others have started looking into digital rights management (DRM). But DLP still garners the most awareness and attention by far. DLP is certainly the most capable and promising technology for safeguarding data — but it’s also the hardest, most complicated option to get right.

So this announcement allows many companies to get over the first hurdle — discovering and classifying sensitive data in their environment — less painfully. RSA DLP leads the market in this respect. And many firms rely on Active Directory to define user-based access rights and policies. Bundling these two and cross-integrating the respective features into each others' solutions is a logical first step. And both offerings (RSA DLP and Microsoft AD RMS) will certainly benefit from the initial integration boost.

Going forward, Microsoft and RSA are relatively vague about the timeframe in which they hope to realize their ambitious plans for tight and pervasive integration. In general, they're certainly moving in the right direction — but the devil's in the yet-to-be-revealed details. For example, the two firms claim that both products can do classification work and feed the results into a central policy engine for enforcement. This sounds great on paper, but conflicts are bound to arise in practice. Also going largely unanswered is the question of how the combined solution will solve the most pressing DLP challenge: Getting business managers to commit to risk-based information classification. After all, the biggest challenges of making DLP successful aren't down to technology, but process: Identifying and classifying what exactly is "sensitive data" and getting the resources necessary to carry out such a project. This is a puzzle whose solutions go beyond templates based on common scenarios and major regulatory regimes.

Finally, we see this as helping fulfill our predictions of DLP market consolidation. The standalone DLP market will largely disappear and integrate into adjacent technology domains both inside (client security, security appliances) and outside (information, content, and storage management) of security. The RSA/Microsoft announcement will indeed put pressure on the likes of Symantec (Vontu) and McAfee (Reconnex + Onigma, SafeBoot, ePO), and IBM (via its partnership with Verdasys and Fidelis) to speed up their respective integration strategies.

Overall, this is a good move by the two firms, even if the most of benefit in the short term is conferred upon the vendors rather than the end users. But it's a harbinger of things to come. It should renew end user interest in DLP, benefit those looking to begin the move toward integrated data-centric security options, and kick-start a second round of consolidation.