Today, many organizations enforce password length, complexity, and update rules, operating under the premise that passwords longer than seven alphanumeric characters take much longer to brute-force crack than shorter, simpler passwords. While this is true, the actual time required to guess real user passwords with cracking tools like L0phtCrack and John The Ripper can be far less.
Many users have dozens of passwords, defined independently, with conflicting rules regarding complexity, update, and reuse. It's human nature to pick passwords that are easy to remember, like birthdays or names of a spouse, child, pet, or sports team. To satisfy complexity rules, many users define passwords with a convention, like appending one digit to the same base string. These common practices can make passwords relatively easy to guess in just minutes using dictionary or partial-knowledge attacks.
For most people, remembering a complex password longer than 7 characters means writing it down it somewhere—like on a post-it note that could easily fall into the wrong hands. Some users save passwords in e-mail folders or files, but an unprotected password list is a security incident waiting to happen. Encrypted password "safes" are far better, but even those programs often depend upon one password to unlock the rest.
No matter what their length, passwords are easily compromised through social engineering. In the past, attackers would pose as tech support, calling users to assist with bogus problem resolution and, in the process, request their passwords. Today, attackers flood mailboxes with spam that "phishes" for passwords by luring users to phony websites where they are prompted to "confirm" their account parameters.
For these and many other reasons, password authentication provides a weak foundation for authorization and access control. Putting a weak password in front of an otherwise secure server, firewall, or VPN service is like putting a screen door on a bank vault. ISPs can reduce their own risk—and grow customer confidence—by employing stronger authentication methods.
Exploring The Alternatives
More secure authentication methods have been readily available for many years, including tokens, smart cards, digital certificates, and biometrics. While these methods vary in complexity, cost, and strength, all share a common goal: letting a user demonstrate that he is who he claims to be through one or more factors.
Authentication factors may include:
* Something you know, like a password or personal identification number (PIN).
* Something that represents who you are, like a finger, face, iris, or voice scan.
* Something you have in your possession, like a hardware token or smart card.
Credentials that you know—like passwords and PINs—are widely used because they are cheap and easy to implement. Passwords are free, users can generate them without assistance, and password authentication is embedded in just about every operating system and client/server protocol. In fact, the only significant operational expense is password reset/recovery. According to Burton Group and Gartner studies, password resets represent 30 percent of all help desk calls. The META Group estimates that each help desk call costs $25. Clearly, this "hidden cost" of password authentication can really add up. You may be spending more than you realize for a solution that's relatively weak.
Even so, stronger credentials are more expensive and more difficult to implement than plain old passwords. In some cases, there are material costs associated with hardware (e.g., USB tokens, biometric scanners). There are distribution costs, since a process is required to initialize credentials and bind them to user identities. There may be infrastructure costs associated with purchasing, installing, and maintaining new authentication servers and datastores. After deployment, there may be lost or broken hardware to replace—not as often as password resets, but at a higher per-incident cost.
http://www.isp-planet.com/technology/2005/beyond_passwords_1a.html
Wednesday, October 3, 2007
Beyond Passwords: Implementing The Vision
In Part 1 of Beyond Passwords, we explained the problem and showed why organizations are interested in improving on password authentication. In part two, we examine the solution.
Organizations that want to implement stronger authentication have a dizzying array of alternatives and products to choose from. To get started, let's break the alternatives down into categories and identify a few products in each category.
1. Digital Certificates
Digital certificates are based on Public Keys, a cryptographic system whereby pairs of keys are generated with a unique mathematical property: anything encrypted by one key can only be decrypted by the other key. In each pair, one key must be safeguarded and known only to the legitimate user—this is the Private Key. The other key is given freely to everyone who wants to authenticate the private key holder—this is the Public Key. If you encrypt a known value with your Private Key, anyone else can decrypt that value with your Public Key and compare those two values. If they match, you are considered authentic because you demonstrated that you hold the Private Key.
For authentication, your identity must be somehow tied to your key pair. This is the purpose of Digital Certificates. A certificate binds a public key to a named entity and some information about that entity (like company, state, and country). Although this binding could be supplied to each correspondent out-of-band, that would not scale well or let strangers authenticate each other. To solve this, certificates are issued by Certificate Authorities (CAs): trusted third parties that generate and "sign" certificates using their own private keys. In this way, everyone can know the public keys of a few trusted "root" CAs and accept as valid any certificate those CAs generate.
Digital certificates are the basis for the SSL server authentication widely used by e-commerce sites. Every web browser is installed with a list of well-known root CAs. For example, Thawte's certificate is included in Internet Explorer's trusted root list (below).
Click to view larger imageOrganizations may purchase certificates from these root operators, or they can install in-house CAs to generate, distribute, and revoke their own digital certificates. MSSPs that provide Managed PKI services generally use their own CA(s) to generate certificates for use by their customers.
For example, an MSSP might issue an "intermediate" CA certificate to YourCorp, and sign all of YourCorp's user certificates with that CA's private key. YourCorp must install that trusted CA certificate in every system. When a YourCorp user wants to authenticate, she presents her certificate, signed by YourCorp's CA, and a value (thumbprint) encrypted with her own private key. The recipient uses the CA's public key to verify the certificate is valid. He then extracts the subject name and public key from the certificate to authenticate the user.
Even from this brief description, we can see that Public Key Infrastructure can be complex. And we haven't even discussed the most challenging aspects of deployment, like expiring, renewing, and revoking certificates, publishing certificate revocation lists, and creating a business process for generating key pairs and certificates and making sure they are distributed securely to legitimate users. Larger enterprises often have the IT staff and security expertise to deploy a PKI, if they choose to do so. But many SMBs do not—and this is where MSSPs can step in to help to fill the gap. To roll your own CA, start with a PKI platform, available from many sources, including:
* Computer Associates
* Cybertrust/Betrusted
* Digi-Sign
* Entrust
* Kyberpass
* Microsoft
* OpenCA Project
* Netscape/RedHat
* Verisign
To learn more about Digital Certificates and deploying a PKI, consult these vendors' websites and third-party sites like this PKI Page. Today, digital certificates are widely used for server authentication—for example, site-to-site VPN gateway authentication. They can also provide strong user authentication—for example, in wireless LANs using 802.1X with EAP-TLS.
However, many organizations have been scared off by PKI complexity and cost. To date, most companies have pursued other options for stronger-than-password user authentication.
http://www.isp-planet.com/technology/2005/beyond_passwords_2a.html
Organizations that want to implement stronger authentication have a dizzying array of alternatives and products to choose from. To get started, let's break the alternatives down into categories and identify a few products in each category.
1. Digital Certificates
Digital certificates are based on Public Keys, a cryptographic system whereby pairs of keys are generated with a unique mathematical property: anything encrypted by one key can only be decrypted by the other key. In each pair, one key must be safeguarded and known only to the legitimate user—this is the Private Key. The other key is given freely to everyone who wants to authenticate the private key holder—this is the Public Key. If you encrypt a known value with your Private Key, anyone else can decrypt that value with your Public Key and compare those two values. If they match, you are considered authentic because you demonstrated that you hold the Private Key.
For authentication, your identity must be somehow tied to your key pair. This is the purpose of Digital Certificates. A certificate binds a public key to a named entity and some information about that entity (like company, state, and country). Although this binding could be supplied to each correspondent out-of-band, that would not scale well or let strangers authenticate each other. To solve this, certificates are issued by Certificate Authorities (CAs): trusted third parties that generate and "sign" certificates using their own private keys. In this way, everyone can know the public keys of a few trusted "root" CAs and accept as valid any certificate those CAs generate.
Digital certificates are the basis for the SSL server authentication widely used by e-commerce sites. Every web browser is installed with a list of well-known root CAs. For example, Thawte's certificate is included in Internet Explorer's trusted root list (below).
Click to view larger imageOrganizations may purchase certificates from these root operators, or they can install in-house CAs to generate, distribute, and revoke their own digital certificates. MSSPs that provide Managed PKI services generally use their own CA(s) to generate certificates for use by their customers.
For example, an MSSP might issue an "intermediate" CA certificate to YourCorp, and sign all of YourCorp's user certificates with that CA's private key. YourCorp must install that trusted CA certificate in every system. When a YourCorp user wants to authenticate, she presents her certificate, signed by YourCorp's CA, and a value (thumbprint) encrypted with her own private key. The recipient uses the CA's public key to verify the certificate is valid. He then extracts the subject name and public key from the certificate to authenticate the user.
Even from this brief description, we can see that Public Key Infrastructure can be complex. And we haven't even discussed the most challenging aspects of deployment, like expiring, renewing, and revoking certificates, publishing certificate revocation lists, and creating a business process for generating key pairs and certificates and making sure they are distributed securely to legitimate users. Larger enterprises often have the IT staff and security expertise to deploy a PKI, if they choose to do so. But many SMBs do not—and this is where MSSPs can step in to help to fill the gap. To roll your own CA, start with a PKI platform, available from many sources, including:
* Computer Associates
* Cybertrust/Betrusted
* Digi-Sign
* Entrust
* Kyberpass
* Microsoft
* OpenCA Project
* Netscape/RedHat
* Verisign
To learn more about Digital Certificates and deploying a PKI, consult these vendors' websites and third-party sites like this PKI Page. Today, digital certificates are widely used for server authentication—for example, site-to-site VPN gateway authentication. They can also provide strong user authentication—for example, in wireless LANs using 802.1X with EAP-TLS.
However, many organizations have been scared off by PKI complexity and cost. To date, most companies have pursued other options for stronger-than-password user authentication.
http://www.isp-planet.com/technology/2005/beyond_passwords_2a.html
KoolSpan: Bridging The Secure Access Gap
To counter security threats, many organizations have tried using traditional VPNs on 802.11 wireless LANs, often with disappointing results. Wi-Fi roaming tends to break VPN tunnels, disrupting applications and frustrating users. Many who tried IPsec as a WEP alternative have since moved to WPA-Enterprise, seeking a more reliable robust remedy. But WPA's heavy-weight combo of 802.1X and 802.11i has proven challenging to deploy and limited in scope. As a result, wireless-enabled workers are often required to use several different security measures: WPA at the office, VPN at home or hotspot, and unprotected Wi-Fi elsewhere.
Many new products have emerged to address this problem, ranging from mobility-aware wireless switches to proxy-based mobile VPN software. Amid a sea of seemingly-similar solutions, KoolSpan's SecurEdge is strikingly different. Instead of patching around VPN or WPA challenges, KoolSpan created a green field "Lock-and-Key" solution for simple secure access over any kind of LAN.
Starting from scratch
KoolSpan CEO Tony Fascenda believes that many secure access alternatives are fundamentally limited by their architecture. "Most users are proxied onto the LAN, through a perimeter firewall or VPN gateway," explained Fascenda. But running applications like VoIP through a firewall or proxy can be challenging. "Even if you get through NAT, you need to open dozens of ports, associated with changing IP addresses. The problem is that each of those ports then needs to be protected by another measure inside the LAN."
To avoid these and other network and transport layer obstacles, KoolSpan designed SecurEdge to sit at the data link layer. "What we've done is put a Lock inside the firewall, with a single port opened. The Lock doesn't proxy you onto the network like a VPN. Instead, the Lock bridges you onto the LAN. On the client, a virtual LAN adapter gets a local IP address, so the user is connected to the inside of the network, just like a local user," said Fascenda.
How do users obtain access through a SecurEdge Lock? By inserting a matching Key, of course. A SecurEdge Key is a USB token that contains a Smart Card. Users install SecurEdge Client software—a virtual LAN adapter—on Windows XP or 2000 PCs. To connect, each user plugs his or her Key into the PC's USB port, entering a text password when prompted.
Each Lock also contains a Smart Card. The Lock and Key use those Smart Cards to authenticate by RSA signature, establishing a 256-bit AES encrypted UDP tunnel between them. Whether the Lock is on the local LAN or on the far side of the Internet, the tunnel keeps all unicast and multicast LAN packets sent and received by the PC safe from eavesdropping, modification, insertion, replay, and other man-in-the-middle attacks.
Readers familiar with 802.1X port access control may note that Wi-Fi APs and Ethernet switches and SecurEdge Locks all bridge packets onto trusted LANs. But unlike 802.1X EAPOL, communication between the SecurEdge Lock and Key rides over a proprietary IP-routable tunneling protocol. This is why SecurEdge Locks can be placed in virtually any location that's reachable via UDP (port 53248, by default).
Nor is KoolSpan's proprietary protocol a derivative of standard IPsec, SSL, or L2TP VPN protocols. Under the covers, KoolSpan applies strong cryptographic measures like AES encryption, SHA-1 hashing, RSA signatures, and FIPS 140-1 certified Axalto eGate Smart Cards. But just as an automobile is more than the sum of its parts, KoolSpan combined these well-known measures to create a uniquely hardware-centric solution.
http://www.isp-planet.com/technology/2005/koolspan_review_1a.html
Many new products have emerged to address this problem, ranging from mobility-aware wireless switches to proxy-based mobile VPN software. Amid a sea of seemingly-similar solutions, KoolSpan's SecurEdge is strikingly different. Instead of patching around VPN or WPA challenges, KoolSpan created a green field "Lock-and-Key" solution for simple secure access over any kind of LAN.
Starting from scratch
KoolSpan CEO Tony Fascenda believes that many secure access alternatives are fundamentally limited by their architecture. "Most users are proxied onto the LAN, through a perimeter firewall or VPN gateway," explained Fascenda. But running applications like VoIP through a firewall or proxy can be challenging. "Even if you get through NAT, you need to open dozens of ports, associated with changing IP addresses. The problem is that each of those ports then needs to be protected by another measure inside the LAN."
To avoid these and other network and transport layer obstacles, KoolSpan designed SecurEdge to sit at the data link layer. "What we've done is put a Lock inside the firewall, with a single port opened. The Lock doesn't proxy you onto the network like a VPN. Instead, the Lock bridges you onto the LAN. On the client, a virtual LAN adapter gets a local IP address, so the user is connected to the inside of the network, just like a local user," said Fascenda.
How do users obtain access through a SecurEdge Lock? By inserting a matching Key, of course. A SecurEdge Key is a USB token that contains a Smart Card. Users install SecurEdge Client software—a virtual LAN adapter—on Windows XP or 2000 PCs. To connect, each user plugs his or her Key into the PC's USB port, entering a text password when prompted.
Each Lock also contains a Smart Card. The Lock and Key use those Smart Cards to authenticate by RSA signature, establishing a 256-bit AES encrypted UDP tunnel between them. Whether the Lock is on the local LAN or on the far side of the Internet, the tunnel keeps all unicast and multicast LAN packets sent and received by the PC safe from eavesdropping, modification, insertion, replay, and other man-in-the-middle attacks.
Readers familiar with 802.1X port access control may note that Wi-Fi APs and Ethernet switches and SecurEdge Locks all bridge packets onto trusted LANs. But unlike 802.1X EAPOL, communication between the SecurEdge Lock and Key rides over a proprietary IP-routable tunneling protocol. This is why SecurEdge Locks can be placed in virtually any location that's reachable via UDP (port 53248, by default).
Nor is KoolSpan's proprietary protocol a derivative of standard IPsec, SSL, or L2TP VPN protocols. Under the covers, KoolSpan applies strong cryptographic measures like AES encryption, SHA-1 hashing, RSA signatures, and FIPS 140-1 certified Axalto eGate Smart Cards. But just as an automobile is more than the sum of its parts, KoolSpan combined these well-known measures to create a uniquely hardware-centric solution.
http://www.isp-planet.com/technology/2005/koolspan_review_1a.html
Thinking Outside The (Windows) Box,
Over the past decade, Microsoft Windows has grown from a focused operating system into a desktop swiss army knife. Kick start any new Windows PC and you'll find a web browser (Internet Explorer), e-mail client (Outlook Express), and personal firewall (Windows Firewall). While these default applications simplify computing for end users, they are not always revered by network administrators. Internet Explorer and Outlook routinely make the SANS Top 20 list of Internet Security Vulnerabilities. As a result, many administrators are now taking a hard look at other alternatives.
Exploring other options
Microsoft went to court to defend its right to install Internet Explorer (IE) on every Windows desktop. But code bloat, complexity, and security vulnerabilities have crippled IE in a way that the US Justice Department could not. According to the SANS (SysAdmin, Audit, Network, Security) Institute:
"Internet Explorer contains multiple vulnerabilities that can lead to memory corruption, spoofing and execution of arbitrary scripts. The most critical issues are the ones that lead to remote code execution without any user interaction when a user visits a malicious webpage or reads an e-mail. Exploit code for many of the critical Internet Explorer flaws are publicly available. These flaws have been widely exploited to install spyware, adware and other malware on users' systems... In many cases, no patch was available at the time the vulnerabilities were publicly disclosed."
To reduce these concerns, SANS strongly recommends upgrading Windows PCs to Service Pack 2. This long-awaited update included numerous security patches, including an IE Pop Up blocker, an Add On Manager, and many explicit download warnings. For additional detail, see What's New for Internet Explorer and Outlook Express. If you cannot upgrade to SP2 immediately, SANS recommends that you stop using IE and move to an alternative browser.
In fact, IE's security woes have created a healthy demand for alternative browsers. In Part 2 of this series, we will explore several popular free web browsers. Changing browsers can help you avoid IE bugs, old and new. For example, Browser Helper Objects (BHOs)—add on programs executed along with IE—are frequently exploited to install hidden spyware and adware programs. Using an alternative browser can eliminate this BHO threat. IE ActiveX Controls or Active Scripting are also common attack vectors. Using another browser that lacks ActiveX support can effectively neutralize these attacks.
On the other hand, there are many websites that depend on these and other IE features (like Microsoft proprietary HTML tags) for data presentation and user interaction. Moving to another browser can inhibit your ability to use websites that were designed for (or tested only with) IE. To address this issue, many users still keep IE around for emergencies, when they really must access a website that requires IE-specific features intentionally omitted from alternative browsers.
Security is one big reason for using an alternative browser. Although SP2 is widely acknowledged as a significant security improvement for IE, its security model is still complex and intrusive. End users are constantly presented with security decisions, but lack the information or motivation to make sound choices. Too many of us routinely click "Ok" or "Accept" when prompted to continue a web connect or download request.
Furthermore, Microsoft has a big target painted on its back. Attackers have already started picking apart alternative browsers, as, for example, this Top 20 entry shows. But there is no reason to expect that new exploits against IE will diminish. And so the game will continue: exploit, patch, exploit, patch, ad infinitum. Even with automated updates, patching is time consuming and cannot eliminate "zero day" vulnerabilities—exploits for which no fix is already known. On the other hand, deploying an alternative browser to every desktop requires both patch management AND software distribution, so don't overlook these administrative costs.
Finally, there other good reasons why alternative browsers are rapidly gaining favor. Many have capitalized upon common IE complaints, turning them into opportunities for improvement. Alternative browsers can be smaller, simpler, and faster than IE. They can require (and allow) less end user configuration. They may offer more user friendly features like tabbed browsing and mouse gestures. Part 2 of this series will take a closer look at features that contribute to the popularity of other free browsers.
http://www.isp-planet.com/technology/2005/secure_windows_1a.html
Exploring other options
Microsoft went to court to defend its right to install Internet Explorer (IE) on every Windows desktop. But code bloat, complexity, and security vulnerabilities have crippled IE in a way that the US Justice Department could not. According to the SANS (SysAdmin, Audit, Network, Security) Institute:
"Internet Explorer contains multiple vulnerabilities that can lead to memory corruption, spoofing and execution of arbitrary scripts. The most critical issues are the ones that lead to remote code execution without any user interaction when a user visits a malicious webpage or reads an e-mail. Exploit code for many of the critical Internet Explorer flaws are publicly available. These flaws have been widely exploited to install spyware, adware and other malware on users' systems... In many cases, no patch was available at the time the vulnerabilities were publicly disclosed."
To reduce these concerns, SANS strongly recommends upgrading Windows PCs to Service Pack 2. This long-awaited update included numerous security patches, including an IE Pop Up blocker, an Add On Manager, and many explicit download warnings. For additional detail, see What's New for Internet Explorer and Outlook Express. If you cannot upgrade to SP2 immediately, SANS recommends that you stop using IE and move to an alternative browser.
In fact, IE's security woes have created a healthy demand for alternative browsers. In Part 2 of this series, we will explore several popular free web browsers. Changing browsers can help you avoid IE bugs, old and new. For example, Browser Helper Objects (BHOs)—add on programs executed along with IE—are frequently exploited to install hidden spyware and adware programs. Using an alternative browser can eliminate this BHO threat. IE ActiveX Controls or Active Scripting are also common attack vectors. Using another browser that lacks ActiveX support can effectively neutralize these attacks.
On the other hand, there are many websites that depend on these and other IE features (like Microsoft proprietary HTML tags) for data presentation and user interaction. Moving to another browser can inhibit your ability to use websites that were designed for (or tested only with) IE. To address this issue, many users still keep IE around for emergencies, when they really must access a website that requires IE-specific features intentionally omitted from alternative browsers.
Security is one big reason for using an alternative browser. Although SP2 is widely acknowledged as a significant security improvement for IE, its security model is still complex and intrusive. End users are constantly presented with security decisions, but lack the information or motivation to make sound choices. Too many of us routinely click "Ok" or "Accept" when prompted to continue a web connect or download request.
Furthermore, Microsoft has a big target painted on its back. Attackers have already started picking apart alternative browsers, as, for example, this Top 20 entry shows. But there is no reason to expect that new exploits against IE will diminish. And so the game will continue: exploit, patch, exploit, patch, ad infinitum. Even with automated updates, patching is time consuming and cannot eliminate "zero day" vulnerabilities—exploits for which no fix is already known. On the other hand, deploying an alternative browser to every desktop requires both patch management AND software distribution, so don't overlook these administrative costs.
Finally, there other good reasons why alternative browsers are rapidly gaining favor. Many have capitalized upon common IE complaints, turning them into opportunities for improvement. Alternative browsers can be smaller, simpler, and faster than IE. They can require (and allow) less end user configuration. They may offer more user friendly features like tabbed browsing and mouse gestures. Part 2 of this series will take a closer look at features that contribute to the popularity of other free browsers.
http://www.isp-planet.com/technology/2005/secure_windows_1a.html
Monday, October 1, 2007
Bolting the Back Door with NAC Part 4: Deploying the Juniper Networks UAC 2.0
In this series, we have examined the business needs driving NAC (part 1 and part 2) and compared today's NAC architectures (part 3). Here in part 4, we show NAC in action by taking one TNC standards-based solution for a test drive: Juniper Network's Unified Access Control 2.0.
We implemented our planned scenarios with only minor adjustments, proving that UAC can be successfully deployed in a heterogeneous network without major upgrades. But, as our test progressed, we learned that Juniper is still working to expand client-side options. Customers who want to combine Juniper's IC 4000 with third-party Linux, Mac, or Vista TNC Clients must wait just a bit longer.
Assembling the pieces
Juniper's UAC solution is based on the multi-vendor TNC architecture described in part 3. Thus, our first task was to identify the TNC components already present in our lab network and decide how to combine them with Juniper's UAC products.
We chose Juniper's Infranet Controller (IC) as our TNC Policy Decision Point (PDP). The IC4000 is designed for medium enterprises and remote/branch offices with thousands of users. Big-brother IC6000 delivers additional capacity and high-availability. We tested the IC4000 ($10,000) with a 100-user license ($5,000). That price tag includes an integrated Steel-Belted Radius server and UAC Agent software.
To exercise multi-vendor interoperability, we used a mixture of 802.1X-capable switches (HP, D-Link) and APs (Colubris, Cisco) as TNC Policy Enforcement Points (PEPs). After discussion with Juniper, we mixed in their SSG5 firewall for more granular policy enforcement. Using a Juniper firewall, VPN, or IDP to enforce layer three policies was not strictly required to meet our goals, but let us tap more of UAC's potential.
Our TNC Network Access Requestors (NARs) fell into three categories:
* Staff with Windows XP/2000 laptops and installed UAC Agents
* Guests with agentless devices (including Vista, Linux, Mac, and WinMobile)
* Customers using any device, with or without an agent
Agentless endpoints that were redirected to the IC's login portal could optionally execute Juniper's Host Checker, an endpoint integrity scanner invoked via ActiveX or Java. We required our managed Windows endpoints to auto-install Juniper's UAC Agent, a persistent program that bundles an 802.1X Supplicant and TNC Client with proprietary extras: a personal firewall, IPsec VPN client, and Windows single-sign-on support.
We had hoped to authenticate managed non-Windows endpoints using third-party 802.1X Supplicants/TNC Clients, but found this is not currently possible. In UAC 2.0, the IC4000 expects the 802.1X Supplicant to send EAP-JUAC, Juniper's pre-standard take on EAP-TNC. We therefore had to admit our own Linux and PDA endpoints as agentless devices. According to Juniper, this limitation will be lifted when UAC 2.1 (3Q07) supports additional inner EAP types to be spoken by third-party TNC Clients.
http://www.isp-planet.com/technology/2007/nac_4.html
We implemented our planned scenarios with only minor adjustments, proving that UAC can be successfully deployed in a heterogeneous network without major upgrades. But, as our test progressed, we learned that Juniper is still working to expand client-side options. Customers who want to combine Juniper's IC 4000 with third-party Linux, Mac, or Vista TNC Clients must wait just a bit longer.
Assembling the pieces
Juniper's UAC solution is based on the multi-vendor TNC architecture described in part 3. Thus, our first task was to identify the TNC components already present in our lab network and decide how to combine them with Juniper's UAC products.
We chose Juniper's Infranet Controller (IC) as our TNC Policy Decision Point (PDP). The IC4000 is designed for medium enterprises and remote/branch offices with thousands of users. Big-brother IC6000 delivers additional capacity and high-availability. We tested the IC4000 ($10,000) with a 100-user license ($5,000). That price tag includes an integrated Steel-Belted Radius server and UAC Agent software.
To exercise multi-vendor interoperability, we used a mixture of 802.1X-capable switches (HP, D-Link) and APs (Colubris, Cisco) as TNC Policy Enforcement Points (PEPs). After discussion with Juniper, we mixed in their SSG5 firewall for more granular policy enforcement. Using a Juniper firewall, VPN, or IDP to enforce layer three policies was not strictly required to meet our goals, but let us tap more of UAC's potential.
Our TNC Network Access Requestors (NARs) fell into three categories:
* Staff with Windows XP/2000 laptops and installed UAC Agents
* Guests with agentless devices (including Vista, Linux, Mac, and WinMobile)
* Customers using any device, with or without an agent
Agentless endpoints that were redirected to the IC's login portal could optionally execute Juniper's Host Checker, an endpoint integrity scanner invoked via ActiveX or Java. We required our managed Windows endpoints to auto-install Juniper's UAC Agent, a persistent program that bundles an 802.1X Supplicant and TNC Client with proprietary extras: a personal firewall, IPsec VPN client, and Windows single-sign-on support.
We had hoped to authenticate managed non-Windows endpoints using third-party 802.1X Supplicants/TNC Clients, but found this is not currently possible. In UAC 2.0, the IC4000 expects the 802.1X Supplicant to send EAP-JUAC, Juniper's pre-standard take on EAP-TNC. We therefore had to admit our own Linux and PDA endpoints as agentless devices. According to Juniper, this limitation will be lifted when UAC 2.1 (3Q07) supports additional inner EAP types to be spoken by third-party TNC Clients.
http://www.isp-planet.com/technology/2007/nac_4.html
Thinking Outside The (Windows) Box,Part 3: Free Mail Clients
Over the past decade, electronic mail has become a mission critical business application, surpassing snail mail, phone calls, and paging to dominate inter-office communication. Enterprise employees are usually stuck with IT-mandated clients used with groupware servers like Microsoft Exchange, Novell GroupWise, and IBM Lotus Notes. But small business workers and home users are often free to choose their own mail clients.
Outlook Express is factory-installed on Windows PCs, but as discussed in Part 1 of this series, there can be better, safer, faster alternatives. Here in Part 3, we take a look at several free mail clients for Windows PCs: MemeCode i.Scribe, Mozilla Thunderbird, Opera Mail, Pegasus Mail, and Qualcomm Eudora.
This freeware mail client can be used on Windows 98, ME, NT, 2000, XP, Linux (2.4 or higher), and BeOS r5, requiring a minimum 1.2 MB disk and 6 MB RAM. We ran i.Scribe version 1.88 from a USB fob, inserted into a Windows XP SP1 PC.
A Windows installer is available, but not really required. We just expanded the zip onto a 128 MB USB fob, ran the i.Scribe executable, replied to an initial mail folder prompt, and configured POP account settings. The freeware i.Scribe is limited to a one mail account; if you need multiple accounts or user identities, pay $20 to upgrade to InScribe.
Mail message encryption and signature authentication can be added to i.Scribe by installing a GnuPG plug-in, although the current version cannot encrypt attached files. "Over the air" SSL protection for SMTP, POP, and IMAP can also be obtained by placing OpenSSL libraries in the same directory as the i.Scribe executable. Mobile users running i.Scribe can run OpenSSL by adding DLLs to the same USB fob, but GnuPG appears to require installed software.
The i.Scribe contact list can hold plenty of data, including GPG signatures and custom attributes. The list can be imported from various sources (e.g., text files, Outlook, Eudora, Thunderbird, Netscape), but importing a Eudora name database yielded mixed results—some addresses were truncated; others were not. The i.Scribe calendar function provides basic event scheduling with advance notification. A separate Groupware Server (currently freeware) can be used to share contacts and calendars with other users.
Overall, we found i.Scribe quick and easy to use. Although it has all the basics, i.Scribe does lack some fancy UI features found in other (arguably more complex) programs. If you're looking for a lightweight mail client to carry with you on USB, give i.Scribe a try.
http://www.isp-planet.com/technology/2006/secure_windows_3a.html
Thinking Outside The (Windows) Box,Part 4: Free Windows Firewalls
Since the birth of the public internet, host firewalls have been sound practice. But high-speed broadband and wireless access have heightened risk and accelerated demand. Today, providers like AOL include host firewalls in client software bundles. Many large enterprises routinely install security suites containing firewalls on employee laptops. Last year, Microsoft even rolled a personal firewall into Windows XP SP2.
Integrated firewalls like these are great for those who already use—or have the budget to buy—the associated commercial products. But some regional ISPs and small businesses prefer to recommend freely-available programs that are not tied to a specific OS patch or AV/VPN product. In this article, we take a brief look at five Windows firewalls that won't cost individuals a dime: Check Point ZoneAlarm, Comodo Personal Firewall, NetVeda Safety.Net, Primedius Firewall Lite, and Sunbelt Kerio Personal Firewall
Integrated firewalls like these are great for those who already use—or have the budget to buy—the associated commercial products. But some regional ISPs and small businesses prefer to recommend freely-available programs that are not tied to a specific OS patch or AV/VPN product. In this article, we take a brief look at five Windows firewalls that won't cost individuals a dime: Check Point ZoneAlarm, Comodo Personal Firewall, NetVeda Safety.Net, Primedius Firewall Lite, and Sunbelt Kerio Personal Firewall
ZoneAlarm runs on Windows 98/ME/2000/XP, with 50 MB disk and 128 MB RAM (XP). For this review, we tried the free-for-individual-use version of ZoneAlarm (v6.1.737), a bi-directional desktop firewall that can enforce network and program rules. The commercial ZoneAlarm Pro ($49.95, not tested) adds anti-spyware, e-mail virus scanning, pop-up blocking, and automated firewall configuration features.
After installation, ZoneAlarm uses a short wizard to create initial firewall rules. For example, if the user plans to surf the web, the wizard creates a rule that lets the default web browser (iexplore.exe) and a related OS program (svchost.exe) access the Internet.
This learn-as-you-go approach makes ZoneAlarm seem awfully chatty—perhaps even a bit intrusive—for the first day or two of use. But once rules are created, these alerts die down and you may even forget that the firewall is there until something unusual occurs. If these alerts bug you, a less-secure learning mode can be used to silently auto-create rules as new programs run. To prevent trusted programs from being abused (e.g., overwritten by trojans), it is recommended that users run in high security mode. Unfortunately, that mode is only available in the Pro version.
Dig a little deeper, and you'll find that ZoneAlarm applies rules at two levels: firewall (network) and program (application). Program rules determine server (inbound) and access (outbound) permissions, depending upon whether a packet's origin/destination is located in the "trusted" or "Internet" zone. For example, the default web surfing rule gives IE "access" permission for both the trusted and Internet zones. If IE should load a web page with active content that unexpectedly opens a listening port, ZoneAlarm would ask whether IE should be given "server" permission as well.
By default, all adapters are placed in the Internet zone, with security set to high—the host operates in "stealth" mode, ignoring all unsolicited inbound requests. Trusted zone security defaults to medium, permitting Windows file and printer sharing. Any zone's security can also be set to low, disabling the firewall for subnets and hosts in that zone. Zone rules can be fine-tuned to permit DNS/DHCP in high security mode, or block servers altogether. However, you won't find granular protocol/port-level control in the free version of ZoneAlarm—for example, you cannot allow inbound ICMP ping but not ICMP redirect.
The free version of ZoneAlarm also alerts when AV stops running and can quarantine VB scripts received in e-mail. Many additional e-mail, privacy, and spyware defenses can be found in the Pro version, available by itself or in combination with sibling Anti-Spyware and Anti-Virus programs. Multi-user licenses are available in small business versions of ZoneAlarm. Zone Labs has been refining these firewalls for years, building a reputation in the market. The free ZoneAlarm is aimed at home users who really need GUI simplicity and alert advice. Users with more granular firewall requirements will need to spring for Pro or try another firewall.
http://www.isp-planet.com/technology/2006/secure_windows_4a.html
Subscribe to:
Posts (Atom)