Blue Coat: Creating An Economic Advantage For Users In 2009?

Last week, Blue Coat gathered analysts in New York City for its Application Delivery Network Briefing Event to showcase its newest offerings, some of which are not yet released, and give the analyst community an update on where things stand following the company’s acquisition of Packeteer, completed in June of 2008.

Long story short? The vendors’ roadmaps have merged and it seems Blue Coat is doing a solid job of integrating the visibility and deep traffic inspection messages of the PacketShaper products with its caching, optimization, and security messages. Prior to the Packeteer acquisition, while Blue Coat offered a solid secure gateway and caching story, the true level of traffic visibility and optimization it could provide was limited.

Interesting for IT Operations and Security Professionals, the two product lines remain separate, though branding will merge in the second half of 2009. This could create either a dilemma or an opportunity for Blue Coat in the current economy when companies are being forced to show faster ROI with less investment upfront. The PacketShaper/ProxySG product split means that an organization can adopt one element of the solution at a time, dialing up investment as need dictates. That said, we’d like to see a converged appliance, though the processing power such a box would require, not to mention OS rationalization across at least three product-based operating systems would be complex at best. We’ll have to see how it all plays out.

For security and risk professionals, being able to create alliances with the IT OPS folks may allow exiting Blue Coat proxy customers expand their deployments beyond web content filtering and caching. The fact that the Mach 5 wan optimization features are built into ProxySG’s base OS means that both Security and OPS may be able to leverage the same hardware in these economic times. For companies just now looking at web proxy and wan op solutions, Blue Coat may have serendipitously timed the market just right.

We’re looking to the future to see whether Blue Coat moves more aggressively to offer virtual products aimed at networking infrastructure vendors that are looking to virtualize more services on fewer pieces of hardware – no word on this yet. Such a strategy, paired with a cloud-based offering, where companies can pay by the drink, especially for optimization services, would truly differentiate Blue Coat, who has seen its product line - already working to gain traction around the idea of an application delivery network, as a departure from pure WAN optimization, in the wake of other players in the market such as F5, Cisco and Citrix - gain competition from the recent Riverbed-Mazu acquisition.

By Chris Silva and John Kindervag

Check out Chris' research

Check out John's research

Last week, Blue Coat gathered analysts in New York City for its Application Delivery Network Briefing Event to showcase its newest offerings, some of which are not yet released, and give the analyst community an update on where things stand following the company’s acquisition of Packeteer, completed in June of 2008.

Long story short? The vendors’ roadmaps have merged and it seems Blue Coat is doing a solid job of integrating the visibility and deep traffic inspection messages of the PacketShaper products with its caching, optimization, and security messages. Prior to the Packeteer acquisition, while Blue Coat offered a solid secure gateway and caching story, the true level of traffic visibility and optimization it could provide was limited.

Interesting for IT Operations and Security Professionals, the two product lines remain separate, though branding will merge in the second half of 2009. This could create either a dilemma or an opportunity for Blue Coat in the current economy when companies are being forced to show faster ROI with less investment upfront. The PacketShaper/ProxySG product split means that an organization can adopt one element of the solution at a time, dialing up investment as need dictates. That said, we’d like to see a converged appliance, though the processing power such a box would require, not to mention OS rationalization across at least three product-based operating systems would be complex at best. We’ll have to see how it all plays out.

For security and risk professionals, being able to create alliances with the IT OPS folks may allow exiting Blue Coat proxy customers expand their deployments beyond web content filtering and caching. The fact that the Mach 5 wan optimization features are built into ProxySG’s base OS means that both Security and OPS may be able to leverage the same hardware in these economic times. For companies just now looking at web proxy and wan op solutions, Blue Coat may have serendipitously timed the market just right.

We’re looking to the future to see whether Blue Coat moves more aggressively to offer virtual products aimed at networking infrastructure vendors that are looking to virtualize more services on fewer pieces of hardware – no word on this yet. Such a strategy, paired with a cloud-based offering, where companies can pay by the drink, especially for optimization services, would truly differentiate Blue Coat, who has seen its product line - already working to gain traction around the idea of an application delivery network, as a departure from pure WAN optimization, in the wake of other players in the market such as F5, Cisco and Citrix - gain competition from the recent Riverbed-Mazu acquisition.

By Chris Silva and John Kindervag

Check out Chris' research

Check out John's research

The truth about the new attack on MD5 signatures

In December 2008, a group of researchers demonstrated a credible attack against MD5 signatures. Since then, Forrester received a number of client inquiries regarding the security strength of their MD5 certificates. There seems to be much confusion over what the attack is about and its actual consequences.

To properly understand the security consequence of this attack and the impact on certificates, we need to understand how the attack works. The researchers demonstrated a successful attack against the RapidSSL certificate authority, which uses MD5 signatures to sign certificate requests. This is how the attack worked: the researchers first got the RapidSSL CA to sign a particular certificate request, issued for a domain in their control. This request and the ensuing signature are completely legitimate. The researchers then demonstrated that they were able to create a second certificate bearing the same signature, for a separate made-up entity. In essence, they were able to find two certificates with the same valid signature. In cryptographic parlance, this is a hash “collision” attack.

How bad is this attack? It’s important to understand that the researchers were able to create a collision attack for a “particular” original signature, namely a signature that is under the attacker’s control. Not for “any” original signatures. If you have a MD5 valid RapidSSL certificate, the chances are good that no one will be able to create a fake certificate that has the same signature as yours. However, this attack put forth an increased risk of encountering fake MD5 certificates on the Internet.

VeriSign, the owner of RapidSSL CA, has stopped using MD5 signatures altogether by the end of January 2009. VeriSign is moving to SHA-1 signatures, which is the current standard. Although SHA-1 has also been found to be vulnerable to collision attacks*, finding a collision with SHA-1 requires much more computational power and therefore it is safe to assume that SHA-1 is more secure than MD5. Again, if you currently have a valid MD5 certificate, there is no need to panic and no need to upgrade right now. You can simply let your certificate expire at the end of its lifetime and then move to a SHA-1 certificate.

What is the long term consequence? It’s likely that even SHA-1 will be broken by ordinary means some day, as computational resources become cheaper every day. We at Forrester will do our best to bring you the latest in terms of new attacks and threats. But as an organization that conducts secure business online, you should remain aware of advances in cryptographic technologies and new crytoanalysis methods.

*Two papers detailed the attack on SHA-1 algorithm were presented at Crypto 2005 rump session:  "Efficient Collision Search Attacks on SHA-0" and "Finding Collisions in the Full SHA-1Collision Search Attacks on SHA1” by XiaoYun Wang.