What hardware firewall are you using? And why?

Q: What hardware firewall are you using? And why?

Cisco, Sonicwall, Watchguard? What model?

If Cisco, do you like it, is it easy to admin?

Any thoughts appreciated.


A:
Hi ...,

Let begin with classification:
By hardware firewall we do mean that the firewall software is running on the unified platform where hardware and software is purpose built.

Models do vary. In order to recommend a model, you need to define your requirements. Here is a high level of inputs that you may list for a better recommendation:
1- Aggregated throughput
2- UTM features that will be enabled (deep packet inspection, AV , content filter etc)
3- Dynamic routing requirements
4- Failover , HA, load balancing requirements
5- Total number of physical segments needed, interface types, link aggregation requirements
6- SO-HO features like dial-back, wireless, ADSL, WAN interface support
7- VPN requirements, remote access VPN required?
8- Integration requirements (SEM/SIM, Backup, Network monitoring, MSS, desktop security IPS)
9- Your existing environment (all Cisco, all Check Point etc.., routing)
10- Primary function (e.g. Web Farm Protection, Internet Access, VPN, Server Farm Protection etc)

If you send more data on your planned firewall deployments with the hints for the questions above, I can be more specific on the comparison

Sonicwall and Watchguard fit the bill when all you need is a security appliance. They offer not only the firewall functionality, but several other network security features like content filtering, deep packet inspection or AV...They are more often called as UTM (unified threat management) instead of a firewall. Management is rather easy since the interface is unified, and central management servers do exist. Model selection is usually based on performance and interface requirements.


I would prefer Sonicwall on the enterprise (high-traffic) side if you have demanding infrastructure, performance wise multi-core parallel processing will help you a lot...

In Cisco world you have options for models... You can go with ISR series, ASA appliances, good old PIX boxes and the 6509 blades. Performance wise you can never get close to core since multi gig performance is limited unless you choose FWSM. (more blades maybe but not the ASAs ,ISRs etc)
I have managed several Cisco Systems in the past.. Administration is not miraculous when you compare with other systems; there are local GUIs, central management systems, 3rd parties, network management tools... Cisco is actually trying to unify the management piece... CiscoWorks VPN/Security Management Solution (Big bundle), CiscoWorks Management Center for Firewalls (VMS), Cisco Security Manager(this is the new one), Cisco Router and Security Device Manager (SDM) ,Cisco Adaptive Security Device Manager [ASDM]), PIX Device Manager (PDM), command-line interface (CLI) are the just few names in Cisco Firewall management space ..Overall the GUI is not miraculous but it works. If you are the CLI guy you will be happy. Managing a Cisco firewall on any of the models is no more difficult than managing routers. If you like scripting, you can automate 90% of the tasks. Cisco is already integrated with all network management products so you won’t have problems. Base code is stable lately and it does support enterprise features like VOIP or multicast up to a level... New additions to transport mode VPNs will help a lot …Upgrades downgrades are usually easy, backup is simple. Downside with Cisco is the segregation of duties, if your entire infrastructure is Cisco, it won’t help a lot to add one more layer of Cisco for firewalling esp. on the perimeter.

I can give more details on ISRs , ASAs, FWSM and PIX based on your specific questions.

If you are looking at hardware only firewalls you should also be looking at Juniper and Fortinet as well. Check Point/Nokia, Check Point/Crossbeam, Check Point UTM-1, Stonesoft, Secure Computing, Palo Alto Networks and Symantec are other players in the firewall space.

Let me know if you have any questions,
cheers,
- yinal ozkan

What is the best single sign-on solution?

Q: What is the best single sign-on solution?
We have a few website products that use different sign-on applications with different requirements (account# versus username).

Single sign-on definitely looks like the way to go. What are some of the solutions we should be looking at? I've seen OpenID, and it looks very promising (http://openid.net/).

Thanks
...............


A: Hi ......,
As you already know, the best single sign on solution (SSO) is the one that fits best on your existing infrastructure.

There are 2 main SSO approaches: SSO at the back office and SSO managed by the end-user.

So if you are in charge of multiple systems that utilize different authentication systems (user silos) and you want to integrate all sign-on process to these systems you need SSO with the back-office. Users authenticate to one system and then all systems are synchronized about the credentials…

If you are an end-user and you'd like to use your stored identity with different systems, you are looking at user-centric digital identities. If you are looking at OpenId, I assume that you want user-centric SSO architecture. You can get more information on cross-domain identity management with searching “identity federation”. With OpenId, you can look at personal identity providers (IdP) and relevant initiatives such as Liberty Alliance, WS-Federation, IGF, LID, SXIP, Inames, Yadis, Higgins, Bandit, Shibboleth etc... If you need more information on this area please let me know.

But, if you are looking at implementing SSO at your back office for your systems, a good start would be looking at your
- Existing application types/development environments (web based, java based, client/ server, .NET vs. J2EE, Ajax, LAMP, MS vs. *nix etc),
- Application architecture (server platform, application servers, XML gateways...etc)
- User repositories (Internal proprietary, Active Directory, Radius, LDAP, Novell, Mainframe etc),
- Back office Integration (SAP, Siebel, Oracle etc)...
- End user type (technical/non-technical, internal/external, public/controlled etc)
- End user platform (mixed browsers, mobile browsers, PDAs, IE only, VB client, Java Client etc)

I do recommend that you do set the scope first before choosing the platform. That way, you will have a better decision tree. Sometimes a structured password synchronization policy delivers partial SSO functionality.

Single sign-on usually integrates with entitlements management and so the identity management (IdM) systems. I do recommend checking SSO subsets of existing Identity Management systems

You will notice a lot of “product” solutions in SSO IdM area. All of them are nice and they serve to a specific niche. If you need a larger solution set that you may extend the SSO functionality in the feature, the solution provider name list is narrower (not the price tag). I have worked with CA; CA family includes all single sign on solutions integrated with other pieces of identity management. Esp., the netegrity family integration with policy based management is a well established solution. But I see good solutions from all major identity management providers (CA, IBM Tivoli, BMC, Novell, EMC (RSA), SUN, Oracle and Microsoft)...You can also check other SSO solution providers if they are not acquired by one of the big shops named above (ping identity, imprivata, passlogix, courion etc)

Let me know if you have a specific question,
- yinal

Where can I get consolidated list of IT best practices for Finance industry?

Q:Where can I get consolidated list of IT best practices for Finance industry?

A:In US, the best path is to go with FFIEC. The FFIEC IT Examination Handbook is the source for technology related risk management considerations for financial institutions. You can get a lot of documentation from the following URL:
http://www.ffiec.gov/ffiecinfobase/index.html

In some countries the banking regulation and supervision agencies enforce Control Objectives for Information and related Technology (COBIT) which is developed by the IT Governance Institute (ITGI). . You can find more information on the following URL:
http://www.isaca.org/cobit/

As discussed above ISO forms the standards and best practices in information security. There are several standards. The following URL will be very helpful to understand what is out there for ISO. It also discusses SSE-CMM and ITIL in security:
http://www.unob.cz/spi/2007/presentace/2007-May-02/01-Novak-Standards.ppt

That being said BASEL-II will be a global requirement for risk management in financial services. Basel II encourages banks to identify the risks, and to develop or improve their ability to manage those risks..You should check that one.

SOX and JSOX still apply to publicly traded companies in US and Japan. COBIT is the framework.

PCI DSS is the framework where credit card data is stored, transmitted and processed.

US government entities use NIST best practices. Check the following link for references:
http://csrc.nist.gov/publications/CSD_DocsGuide.pdf

Let me know if you have any specific questions,
regards,
- yinal ozkan

Functionality or ROI?

Q: When you look at new IT projects what do you consider first: Functionality or ROI? EWeek just published an article stating that in 2008, CIOs would be looking at functionality and strategic purpose and down playing extensive ROI calculations. What do you as an IT professional think about that?

A: Hi ..,
I think the ROI calculations are just a part of the full governance in IT projects and CIOs must govern the projects. I simply do not recommend going with ROI alone, terms of return must be defined in advance. It is not feasible to compare functionality vs. ROI since both of them may include each other. Full life-cycle of the solution should be interpreted into evaluation for CIOs. When you look at all IT projects, you may classify them in 4 main categories or a mix these 4:
1- Projects that increase efficiency
2- Projects that reduce cost
3- Projects that reduce risk
4- Projects that increase competitiveness

A CIO must have a grand plan with targets (tactical/strategic) and this plan must be carried out with a structured program. Any new project should be weighted against the program where ROI is just an initial evaluation item. The programs are not static, and the governance of the program itself should be structured as well.

Let me know if you have a specific question,
regards,
- yinal

Security Consultant: How do you define your scope?

Q: Security Consultant: How do you define your scope?
As I make my foray into the security consulting world of side work, I am wondering how other security consultants out there have defined their scope as to what services they offer and where they know to draw the line and/or keep a client within the bounds of what the scope actually is. I know it has a lot to do with your areas of expertise, but what helps you (anyone who might wish to answer) make this definition?

A: Hi ....,
This is a good question. And there is no silver bullet.

I have been managing hundreds of information security SOWs (statement of work documents) every month for the last 5 years..This is a lot about security; it is more about the delivery. Here are a few things that we learned by tough experience (in no particular order):

1- Do not make it one security consultant's job to define scope and the deliverables of the SOW. Build a workflow with multiple check points for peer review. If one consultant defines the scope, make sure that others review it. Peer review is the harshest part for every security project. I think that it is easier to criticize than doing the actual job so you ca get a good reality check prior to sharing your draft scope with client. Engineers/Consultants have a tendency to omit their own mistakes. Shortcuts are always favored by engineers (by nature). Use different teams, e.g. security consultants define the scope, delivery team verifies it...

2- Always share draft versions of the scope with the client. Verbally communicate deliverables. Give client a chance to review to the draft SOW and allow changes. Use change control on the SOW documents.(make sure all revisions are recorded)

3- Create an internal risk document; where you internally discuss possible risks about the project in advance. Make sure that risks are addressed prior to final approval

4- Keep all parties involved. Make sure that your process is transparent to all key stakeholders including project management, client, account management, finance, legal, consultants, engineering, support, vendors etc.

5- You may try using pre-defined scopes with predefined deliverables. Even if this is the ideal, it rarely works, every client is unique. You may better have standard methodology documents and customized deliverables based on top level methodology document. I may elaborate more on the à la carte scoping with prebuilt blocks for security, based on the security project type (e.g. policy /compliance consulting is different than hardware/software deployment or deployment is different than assessments etc)

6- Put everything is writing. No verbal communication will help when there is a dispute. All deliverables should be clearly defined. I like the following clause from our SOWs: "The scope of this project excludes all services and related issues that are not mentioned in this SOW and any additions or changes will be done as set forth in the change control procedures contained herein. Any services not part of this SOW are considered Out of Scope and additional charges may apply"

7- Make the security consultants are responsible for the delivery. They should understand what is easy what is not on the field. They should be able to perform actual deliverables on time, and they should be liable when their scope does not match the reality. Continuous audit of deliverables and the improvement is a must. Make sure that you have post mortems on failures and all of the failures are addressed.

8- Share your internal workflow with the client; make sure that the client understands how you work. Share service descriptions, SLAs, professional service agreements in advance. Make sure that your security consultants relay this information properly. Clients will understand whatever they would like to hear, so you need to cover all bases for confidentiality, deliverables, lead times, cutover times, success criteria, privacy, change management, costs, points of contact, project management, test plans etc.. If they are not written, client's expectations may certainly be different than your consultants’...

Well I think we have a limit on the answers page, but let me know if you have a specific question.

regards,
- yinal ozkan

BPO market

When I was managing a FWTK firewall in 1994, I was pretty sure that the firewall market will be larger than anything... Every office would need 1 firewall when they were connected to Internet. And every firewall required 1 administrator…..

The server installation, configuration, maintenance, administration, everything was complex with the slackware based firewall. It required dedicated, highly educated manpower for the management.

1 security engineer per firewall seemed pretty reasonable in 1994.

Today, when I look at the BPO industry and the projections for growth such as “McKinsey Report Predicts Robust Growth For Indian IT Services and IT Enabled Services Industry”, I have some sort of déjà vu… There is a belief that more jobs will be created in linear with the market growth, and the BPO cities will be big job markets, and the countries with access to larger human capital will be more successful. That is a dangerous assumption. Job markets will not grow with market especially the low-end/low-cost BPO market. Job markets will shrink with the advancement of technology, there will be need for less people, even the highly trained ones


My “1 firewall 1 administrator” idea was not realistic neither the job market projections for BPO are. From 1994 to 2000, we really worked hard to centralize management, automate operation and improve efficiency with a tremendous investment in high technology services and products. The things done were unbelievable for firewall market, all software moved to appliances, virtual inline firewalls were invented, every type of high availability solutions were integrated, log management became easy with high end event management tools, software got more stable, people needed less support, self service systems were delivered etc….And the result was the elimination of the workforce component. Today 1 group of firewall administrators (e.g. 2 per shift) can manage hundreds/thousands of sites. We do not need a dedicated firewall wizard per site, which was expected. I do expect the similar results in BPO markets, the more technology will be available, the more low-cost routine work BPO jobs will be out of the picture,

BPO industry will continue to grow regardless of the access to low-cost human capital. The need for massive numbers of workers in the industry will shrink regardless.

Creative / well educated minds will always be on demand, but that will take away the advantage having hundreds of thousands of poorly educated engineers. I strongly support the initiatives in India and China on increasing the technical quality of the delivery, and powering the creativity, instead of increasing the low-cost human capital based offerings... In the mean time we may see more Ukraine, Hungary or Egypt as a competitive outsourcing centers.

What are your thoughts on Key Performance Indicators or Criteria for Information Security?

Q:What are your thoughts on Key Performance Indicators or Criteria for Information Security?

A: Hi ...,
I strongly believe that key performance indicators for information security have 2 major categories:

1- Risk Related
2- Business Related

There are several readers on this page who can elaborate more about the risk related KPIs. A security KPI can only indicate something relevant only if it is tied to a risk measurement framework. You can measure any metric delta in any of the systems that you can get data from (viruses blocked, attacks succeeded, malware identified etc), but only the metrics that create the risk visibility and the naturally the business impact will help you to have the right measurement. Long story short, good KPIs are the ones that show delta in your risk status. A change in number of the spam e-mail received on a certain domain may mean nothing if it is hosted and filtered at a remote provider and the domain is not in use by your operation.

Second and important category is naturally your business. There are times when your security initiatives are driven by tactical and strategic business needs. I can list hundreds of them but if you want to categorize here are the main business drivers.

1- Reducing cost
2- Increasing efficiency
3- Competitive Advantage’

You may try to map the 3 items into a risk framework but I would rather not. You need to share the same goals with the business (the old aligning IT/Security with the business problem). And if your security related activities can create qualitative/quantitative metrics on how you reduce cost, increase efficiency and create competitive advantage, there you have the good KPIs. e.g. “We moved our e-mail cleansing to a 3rd party, now our cost is lower, we have more resources to focus on core projects, we have due diligence with e-discovery requirements, and now we have a greener data center :) here are the KPIs….”
Let me know if you have a specific question,
regards,
- yinal ozkan

EMC should buy Check Point - How to Secure Virtual Machines ?

Virtualization security is an interesting topic. For years many security vendors tried to focus on hardware security, assuming that all network world will be appliance only soon (It is a small Cisco world after all) Now the times are changing, there is a new phenomenon on the market which pushes all software platforms into a single virtual platform...

In the old world of 1 server per blade designs, many enterprise shops have done the right segmentation, by building multiple server farms segregated by beefy firewalls. Server to server communication control was always a challenge. Only a few enterprise shops were lucky enough to deploy firewall appliances and blades between servers. And even less could find out a way to deploy a multi gigabit IPS. Playing with switch ACLs, VLANs inline firewalls were the instant remedies, that didn't really answer the real security question.

Nowadays, 1 server per blade racks are out. It is a green world (and a datacenter) where we have multiple virtual systems (VMs) on 1 box. Segmenting these servers, checking the traffic flow and detecting/blocking malicious activity in between VMs is close to impossible. The nice chic ASIC appliances do not fit there. There are solutions like Bluelane, but there are problems...
- The security solution should be on the vmkernel…
- The security solution must cover CPU virtualization, and memory virtualization issues.
- The security solution should not be another VM (that acts like a virtual switch/router) where the server-to-server communication is filtered. Too much overhead, too many VMs
- Security solution must be trusted, tested approved, and must have certifications from 3rd parties.
- Existing legacy security licenses should be portable (firewall to virtual firewall, ips to vips.
- Security solution should cover virtualized crypto devices (hardware accelerators, host security modules)
- Security solution should be managed by a different console and access right system, probably a different company for risk management and segregation of duties purposes etc... Basically VMware is not the right solution developer (integrating Determina VIPS was a good idea though)
- …..and the list goes on.

EMC may certainly develop a new security solution for the VMware spin-off using parent company links, or acquire another security company after RSA and Network Intelligence.

But there is one another company who sticks to software only security with a full portfolio of security products... I think it is a good match. Being an IT Security Professional (my main expertise is not the M&A area) and knowing Gil Shwed’s expansion plans, (I do not own any stocks) the "EMC should buy Check Point" idea may not fly. But Check Point would a good and quick response to address VMware security concerns with lots of new expansion possibilities for both operations

Disclaimer: Blog posting on this site are my own and don't necessarily represent my employers' positions, strategies, or opinions