Archive for October, 2006

NEA is Now an Official IETF Working Group

Thursday, October 26th, 2006

After a fair amount of debate, Network Endpoint Assessment (NEA) is now an official working group in the IETF. The group is initially chartered with only defining the requirements though. From Russ Housley’s email announcing the group:

Second, only the milestones related to the requirements document are approved. The idea is to get going with the architecture, requirements, and security analysis. These are all included in one document. The other milestones will be approved by me (not a re-charter action) once the IETF Last Call demonstrates that the NEA WG is moving in an direction that the community can support.

The timeframe for final requirements is April of 2007 at which point the other milestones may be approved. There seems to be some hesitancy in the IETF around this topic hence the staggered milestone approach.

Technorati Tags:

More Identity-Centric NAC Momentum

Thursday, October 26th, 2006

Building on the identity-centric NAC talks at Digital ID World, there’s been more buzz about why identity needs to play a significant role in NAC. Andrew Braunberg at Current Analysis has an article up on the topic which makes a sound case for expanding the definition of NAC.

The benefit of user identity awareness within NAC solutions is really a no-brainer. It’s interesting that NAC solutions are so commonly positioned as security solutions because they are only tangentially about security. As originally envisioned, NAC did not provide any additional security functionality, but rather it ensured that organizations were fully leveraging their existing security investments (e.g., check that the antivirus software is installed, turned on, and updated).

Full disclosure, he also has a nice plug for my company’s partnership with Oracle in there somewhere.

Technorati Tags: ,

Insightix’s NAC Approach

Wednesday, October 25th, 2006

Tim Greene from Network World has an article up highlighting the Insightix NAC solution. Insightix is the company co-founded by Ofir Arkin, who got some notoriety by showing how NAC could be “bypassed.” I wrote about his presentation a while back so I won’t reiterate any of that. But I found this snippet from Greene’s article interesting:

Insightix NAC software can block unauthorized devices from network access via address resolution protocol (ARP) spoofing, which tells the device it is ineligible to send traffic to the network. Alternatively, it can block access to switch ports using SNMP commands to switches that deny access.

Let’s see … the co-founder of a NAC company attacks existing NAC approaches and releases his own approach based on ARP and SNMP. I’ll leave any jokes here as an exercise for the reader. If you want a hint, check out Alan Shimel’s analysis.

Technorati Tags:

Cisco’s Supplicant Strategy

Wednesday, October 25th, 2006

Cisco has announced the branding of the Meetinghouse 802.1X supplicant. The “Cisco Secure Services Client” is now available. I wrote about the Meetinghouse and Cisco deal a while back. I was right when I predicted that Cisco would pull Meetinghouse out of the TCG / TNC; that happened pretty fast. However, I was wrong when I predicted that Cisco might sell their client for substantially less than Juniper’s offering or even give it away for free. My reasoning was that Cisco had far more to gain by selling switch migrations enabled by a supported supplicant, than they did in trying to recognize revenue per seat in connecting to those switches.

I still stand by that. However, there is some subtlety here. just because something costs between $30 and $40 a seat depending on volume (very similar to Juniper’s supplicant), doesn’t mean that Cisco will charge that to its biggest customers. The minute a major account manager has a giant Catalyst switch deal on the line if they can remove the supplicant objection, I think the cost will be reduced if not eliminated. That’s just good business.

However, if Cisco’s goal was to ensure that 802.1X succeeded only on Cisco kit, their strategy seems more plausible but is still flawed. A Cisco supplicant which was almost free to Cisco networking customers but not for anyone else would prevent non-Cisco network customers from freely using the Cisco supplicant. The flaw comes in with respect to 802.1X’s wired deployability in general. Cisco succeeds when the network gets more intelligent. 802.1X is still in its nascent stages on the wired side and Cisco’s competition isn’t really HP ProCurve (regardless of how much HP would like that to be true). Their real competition is dumb networks in general. Vista’s security infrastructure doesn’t require the use of networking as enforcement. It doesn’t have the 802.1X supplicant complexity as a required element. While their security model is incomplete, it is also mostly free to organizations deploying Microsoft on the server and client side–which is just about everyone. For more evidence on Microsoft’s stance on wired 802.1X see this article which was originally titled “802.1X on Wired Networks Considered Harmful.”

Rather than trying to differentiate Cisco vs. the other network vendors, Cisco should instead be trying to rally the networking industry to compete with the onslaught of host and application oriented security solutions. I’ve often stated that security is a system and that there are roles for the network and the host to play. However, business goals and security architecture aren’t always aligned. Cisco should be championing open standards to make the network more intelligent, not looking for ways to keep such systems proprietary. They already have the market share and if customers see them as innovators and embracing standards (which is how Cisco got to where it is today) they will continue to buy Cisco. This bears on their supplicant pricing decision as well as their involvement and willingness to drive standards around NAC.

When IPsec VPNs for remote teleworking became viable, Cisco bought a company called Altiga. Altiga became the Cisco VPN 3000 Concentrator and it was quite a success. The client for connecting to the concentrator was given away since the money they wanted to make was in the hardware. However, there were proprietary extensions to the client from Cisco and other VPN vendors like CheckPoint and Nortel. Microsoft had their own IPsec client in Windows, but because its configuration was clunky; it wasn’t used. IPsec never really converged on a standard, open, and interoperable client. As a result, SSL VPN seems to be the technology with long-term staying power in no small part due to the client being ubiquitous. With 802.1X / NAC, Cisco has proprietary technology and is charging for the client. I’ll be surprised if the outcome is better and not at all surprised if it turns out worse.

This further reinforces the need for an open supplicant as I’ve wrote about before. The next 18 months will be very telling for 802.1X as a ubiquitous authentication mechanism rather than a deployment necessity for secure wireless.

Technorati Tags: , , ,

Pogue’s Poor Position on Privacy

Thursday, October 12th, 2006

New York Times journalist David Pogue recently posted about a cool service which is giving away free international phone calls. He then got a fair amount of comments from folks worried that this service might be giving away the calls for a more nefarious purpose such as data mining. I love Pogue’s posts and articles in The Times but I think his response to these comments was a bit short-sighted. He gets some things right when he talks about the privacy we’ve already sacrificed in our daily lives, but he gets it wrong when he describes the value of, for example, listening in on phone calls:

All of the much smaller potential abuses make a whopping assumption: that somebody actually *cares a whit* about you and your mundane daily communications. Yes, of course someone at the phone company could look over your phone records and figure out whom you call. But who would ever be so bored, and–forgive me–what could ever be so boring?

True enough for mundane communications. However, what’s a mundane checking of your bank balance to you is instant identity theft for an adversary. If network security taught us anything it is that an attack which is trivial to manually execute is usually trivial to automate. Imagine someone selectively tapping calls only to a bank’s customer service phone number? How many account numbers, mother’s maiden names, birth dates, and–at least portions of–social security numbers could be harvested? If you went without any voice analysis at all and just listened for the touch-tones you’d already have a wealth of information. Think dsniff for telcos.

Pogue is right however with respect to this specific service. There is nothing new to worry about. We’ve had plenty to worry about all along. Whether that worry is “neurotic” as Pogue describes, I’ll leave to my readers. I’d use voice encryption if it was an option, but until it is I’m not changing the way I live my life.

Technorati Tags: ,

The Visitor Network Way-back Machine

Friday, October 6th, 2006

Ed Vielmetti’s daily del.icio.us post alerted me to an ancient (in networking terms) article on visitor networks and various strategies for their deployment. It was published in Cisco’s Internet Protocol Journal back in 2002 and it is surprising how much the technology for deploying visitor networks has not changed. The core goal of being client-less remains and the techniques around captive portal are still very much in use today. This is great background information with plenty of application in today’s authenticated networks.

Technorati Tags: ,

Security through Obscurity in Voting

Monday, October 2nd, 2006

Bruce Schneier’s security blog alerted me to this seemingly funny, but ultimately tragic quote from an election official on their voting system:

The software developed for InkaVote is proprietary software. All the software developed by vendors is proprietary. I think it’s odd that some people don’t want it to be proprietary. If you give people the open source code, they would have the directions on how to hack into it. We think the proprietary nature of the software is good for security.

I think the lesson for those of us who work in security is this: just because a security principle is well documented, debated, and understood, does not mean that it is common knowledge. Now please excuse me while I go cry myself to sleep.

Technorati Tags:

Dave Kearns on NAP and Active Directory

Monday, October 2nd, 2006

Dave Kearns has a nice write-up on the directory implications of NAC / NAP. He says:

What I find extraordinary in all the material Microsoft has published on NAP and NAC (both Cisco’s NAC and the generic NAC) is the extremely limited (i.e., I couldn’t find any) references to Active Directory! But all of this is firmly based on having an up-to-date, schema-extended Active Directory forest as the basis for identifying and tracking all of the hardware that’s either on or attempting to attach to your network.

Getting a handle on AD is certainly a requirement before doing NAP but in talking to customers I’m finding things are even worse than Dave describes. Often there are multiple forests of AD through acquisition or merger. Also, many organizations have LDAP servers as well which house their own user repository for certain groups. Microsoft would like organizations to use a single forest of AD for all their users and devices but in reality while that may be a goal for an enterprise, there are plenty of things which prevent that from happening.

Network identity management is about more than just directories and AAA. It has to be about making those directories do something useful in their current state of deployment, not just their idyllic environment as envisioned by the vendor. Some of the things a virtual directory can do for application IdM are just as useful in the network context. Only when we can easily identify the user and their device can we hope to write meaningful policies around what those elements can do on a network.

Technorati Tags: ,

Lexmark Supports 802.1X

Monday, October 2nd, 2006

Along with HP’s support of 802.1X in its printing line comes Lexmark with its own announcement focused on federal security requirements. I’d really like to see more data from customers deploying wired 802.1X, but more support within the devices itself is not a bad thing.

Technorati Tags:

NAC, a Lament

Monday, October 2nd, 2006

Jeff Boles writes this about NAC:

What we should be left with in NAC is an evolutionary development of current architectures, such as 802.1x, that are standardized and fully interoperable. There’s some discussion afoot about interoperability, but in reality the market has greatly fragmented itself with a bunch of different solutions and poor definition of what NAC is. We’re left without a solution set, but a lot of different packaged up products.

I think Jeff has this right. Cisco, Microsoft, and other big players have often touted proprietary protocols as a way to seed the market with an in-demand capability. Cisco did this correctly with the Hot-Standby Router Protocol (HSRP) and with some of its early extensions to IPsec. However, 802.1X is relatively new without being further encumbered by NAC. Cisco sees this and has begun positioning Cisco Clean Access as an alternative to 802.1X-based NAC.

While there seems to be widespread agreement that standards are necessary to get a functional and interoperable NAC architecture, standards are slow going. The IESG within the IETF finally received a submission from the Network Endpoint Assessment (NEA) mailing list to form a working group today. The chairs of the mailing list are representatives from Cisco and Juniper, two companies with substantial stake and influence in how all this shakes out. While I hope specifications move more quickly than the initial formation of the working group did, I’m not hopeful that the IETF’s sluggish tendencies can be easily remedied.

Technorati Tags: ,