Microsoft, Cisco Team on Network Access Protections
12127
10/19/2004 -- Microsoft and Cisco are teaming up to share security information across products, an effort that should ultimately make offerings from both vendors more secure.
328112
The ground rules of the tests of Cisco and Avaya systems.
300480
Security collaboration with Cisco will bump key network protection feature until 2007.
417584
(InfoWorld) - Cisco Systems and Microsoft will announce progress on a 2-year-old effort to link their separate technologies for network client health screening, commonly known as "network access control," according to sources familiar with the companies' plans.Â  The companies will use The Security Standard conference in Boston to unveil application program interfaces (APIs) in Microsoft's upcoming Vista operating system that will allow Cisco NAC-compliant switches and routers to evaluate the security posture of Vista systems. Network access control technology allows companies to perform health checks on endpoint devices such as PCs and mobile devices before they are granted access to company networks. For example, worker PCs might be checked to make sure they are not infected with a virus, have up-to-date antivirus definitions, and a desktop firewall enabled before being allowed onto a corporate LAN. Cisco first unveiled products that support its NAC architecture in June 2004. Since then it has slowly expanded NAC support from routers to switches and introduced a NAC appliance, formerly known as "Clean Access." Microsoft's Network Admission Protection (NAP) client health screening architecture has always been linked to its upcoming desktop and server operating system releases Vista and Longhorn, both due in 2007. In the face of strong customer pressure to simplify the competing architectures, the two companies said in October, 2004 that they would integrate NAC and NAP. However, the companies have been sparing with details of the collaboration during the two-year project, prompting speculation that the promised integration was more PR than reality. On Wednesday, the companies plan to show that they have made progress, putting features into Vista that allow companies with Cisco's Secure Access Control Server (ACS), Vista desktop systems, and a Longhorn network policy server to provide security status information from the Vista Security Center directly to Cisco switches, which can then evaluate the status against network policies. Systems that violate one or more security policies can be shunted off to quarantine for remediation, according to John Pescatore, an analyst at Gartner who has seen a demonstration of the system. The system will also allow companies to push out security updates, such as antivirus signatures, and actively monitor compliance, so users who turn off antivirus or firewall software after being granted access might have those programs automatically reactivated, Pescatore said. Cisco NAC and Microsoft NAP integration will make it easier for companies to deploy NAC technology, because they will not need to deploy any additional software client from Cisco, as is currently required, he said. "If you're a pure Cisco network and windows environment, and you're planning to go to Vista soon, you don't have to spend a lot of money," he said. However, the benefits of integrated NAC and NAP are at least a year away, as companies will have to wait for the delivery of Longhorn server and widespread adoption of Vista on enterprise desktops, according to Pescatore. "I think it's a 1990s announcement," said Jon Oltsik, an analyst at Enterprise Strategy Group. "They're treating the symptom but not the disease. Users want open solutions that support Linux clients and wireless and any kind of switch or router," he said. The integration between Microsoft and Cisco, while good for those companies, will hinder open standards efforts like the Trusted Computing Group's Trusted Network Connect (TNC) standard, Oltsik said. "I wish I had the money [Cisco and Microsoft] spent on this to get nothing," he said. "This is a big step back for client security."
638587
Cisco has discovered a security flaw in its Cisco Security Agent software (CSA. This could be exploited by attackers to circumvent the security provided by the host-based intrusion prevention product.
638955
Juniper Networks claims to have added an important piece of technology for delivering on its integrated network security strategy as part of the launch of its high-speed EX-Series of enterprise switches.With onboard capabilities aimed at extending security functions, including applications usage visibility and NAC (network access control), among others, Juniper executives said that the devices -- the company's first set of high-performance switches targeted directly at enterprises, versus its existing systems aimed at telecommunications providers -- allow the networking gear provider to address demands being made by large customers.As enterprises replace aging networks with new high-performance equipment, security capabilities are high on the lists of core features that buyers are requesting, said Mark Bauhaus, executive vice president and general manager of the Service Layer Technology Business Group at Juniper.?While the infrastructure-defense tools represent only one aspect of the larger push to make networks faster and more reliable to support business operations, they have become an increasingly central element of customers' long-term goals, the executive said.Increased integration capabilities established between the new switches and Juniper's existing access control, firewall, intrusion prevention and UTM (unified threat management) products is the most significant aspect of the devices' added security functions, according to Bauhaus. "This truly builds on our strength to do end-to-end security integration," he said. "We're not looking to become a pure-play security vendor, but these are features that customers are looking for in building high-performance networking infrastructure."In addition to allowing for more unified, integrated security throughout their networking architecture, Bauhaus said that customers are looking to onboard security functions as a way to save money and reduce complexity by replacing other devices, including inline NAC appliances. "Customers clearly want to collapse the sheer number of special-use security devices," he said. "And with the integration to our Unified Access Control technology, we think that this launch represents another important stepping stone by providing customers with the ability to utilize unified access with additional support from their infrastructure."While rival Cisco Systems has been positioning itself as much as a provider of security tools as a networking specialist for the last several years, at least in terms of its marketing image, Bauhaus said that Juniper is more interested in being viewed as a leading provider of high-speed gear that offers embedded security and standards-based ties to network-defense tools offered by other vendors. All of the security functionality being integrated into the EX-Series switches and Juniper's networking gear is focused primarily on fostering high-performance infrastructure for customers that is also safe and reliable, he said.Building its products around open industry standards, in particular the security tools, is crucial to allowing third party developers to take advantage of the features, Juniper executives repeatedly stressed at Juniper's Global Enterprise 2008 event held in New York on Tuesday.Officials from IBM, Microsoft, and Oracle took the stage to endorse the networking company's ability to foster stronger ties with their own products.Businesses applaud Juniper's move Calvin Choe, director of technical business development for the Enterprise Networking Group at Microsoft, highlighted the importance of Juniper's work to allow for tight integration between its infrastructure technologies and Microsoft's NAP (Network Access Protection) iteration of NAC, which will arrive next month with the introduction of the software giant's Windows Server 2008 software. NAP is also supported in Microsoft's Windows Vista operating system. "Used with NAP, this will allow network administrators to create policies around identity and assess users' state of compliance to enforce their own set of criteria," said Choe. "The support of standards is important because we wanted to make sure that customers had their choice of switching vendors."In addition to partners, Juniper also hosted several customers on stage, all of whom mentioned the EX-Series' security features as one of the core strengths of the new product line. "Security is one of the most important things to us, and we wanted an extra layer of access control to deliver defense-in-depth," said Frank Ziegler vice president of communications for the Philadelphia Stock Exchange.Some industry watchers said that the new EX-Series switches add a crucial piece that had been missing from Juniper's product portfolio from an integrated security standpoint. The new hardware should help the company differentiate from its rivals, including Cisco -- which has aggressively added to its own security holdings over the last several years, said David Willis, a communications market analyst for Gartner. "I think one of the more interesting elements of the launch is Juniper's work to integrate with third parties like Oracle; Cisco has announced similar intentions to do so, but it may take them years to get products ready -- and the size of Cisco's installed base may actually represent a problem in terms of getting products to market," said Willis. "With Cisco, it's also not unusual to run into customers who may have as many as 50 different versions of its OS on its devices, and from that standpoint, sometimes nothing beats a fresh start."The analyst that just said how much of an advantage the new products could represent on the enterprise market will likely depend on how seriously customers view Juniper's efforts to truly embed security throughout its networking gear versus merely adding individual features.Other experts said that the addition of the switches' security features could threaten providers of standalone devices, such as inline NAC appliance vendors like ConSentry and Autonomic Networks."Clearly the fact that Juniper hasn't had a switching product in this space has limited the reach of UAC, but with customers that have existing investments in Juniper firewalls and VPNs, this could be seen as good news," said Paul Roberts, analyst with The 451 Group. "There's always the question if anyone is really going to do a rip and replace to get NAC functionality, but for companies doing upgrades and looking for the features, this could be a viable option," he said. "In some ways, the new switches may give Juniper the ability to leapfrog Cisco, Extreme Networks, and other rivals with some of these features for access control and applications visibility."
671840
Security industry analysts and other market watchers are still working to understand the long-term viability of NAC (network access control) as a standalone technology, but some end-users contend that they are already seeing major benefits using best-of-breed tools.Experts may debate whether or not NAC will remain a standalone product set or be integrated into other networking and security systems, or whether it will be used to control access to internal IT systems such as enterprise applications, but some users say that they are already satisfied with the ability of exiting products to help keep their computing infrastructure protected.From companies building components for NASA's Space Shuttle program to regional college campuses, these IT administrators maintain that they have already found NAC to be a valuable method for keeping unauthorized users and infected devices from ever logging on to their networks.At Astrium North America, the Houston-based arm of European aeronautic defense and space giant EADS, NAC is being used to help safeguard product designs and sensitive data that the company maintains as part of its work on the Space Shuttle program, among other projects.While getting the tools into place was no simple trick, said George Owoc, director of business administration at Astrium NA, NAC has made it far easier for the company to work with all the business partners needed to collaborate on products that will someday travel into space."We have a lot of partners, including a fair number of people in Europe and foreign nationals without State Department clearance, so we have to be sure that we can protect our information, things like our engineering techniques, or we could lose the ability to participate in the Shuttle program," Owoc said. "Being able to manage access so that people who aren't authorized to get in cannot do so, or to ensure those who can don't bring in spyware is extremely important to our business, and NAC has allowed us to address that."As in many other industries, a number of the companies that Astrium NA partners with on its projects are also competitors in other business environments. Combined with complex government requirements about protecting sensitive NASA engineering data, Owoc said that it was a challenge to both grant access to partners and ensure that his company's informational assets were protected prior to installing NAC.Among the most significant challenges that Astrium NA faced in getting its NAC system, built by Lockdown Networks, into place was the structuring of the technology's rules for managing access to different areas of its network, Owoc said.However, over the last four years that Astrium NA has used the product, Lockdown has improved the usability of its technology significantly, and the company is now able to tailor its enforcement capabilities to meet its unique processes, he said.One of the main reasons the company chose to go with Lockdown over NAC products from larger vendors, specifically Cisco -- from which it buys the majority of its networking gear -- was that Owoc felt the smaller vendor would be more willing to listen to feedback about its products and make improvements over time.From that standpoint, the admin said that his company will stick with the best-of-breed approach and its current vendor as he feels that the standalone product works better than integrated tools offered by platform providers like Cisco.Using NAC as a teaching tool Astrium NA will also avoid opportunities to use NAC to control access to applications or other systems because it works well enough in its current format and the firm doesn't want to add more complexity to its system, Owoc said."I don't think NAC is something that can be part of a product that is trying to be all things to all people. In our experience, those types of products don't work as well as dedicated products that do one thing well, so we'll stick with best of breed," said Owoc. "I don't want to add any other functionality like applications access because it's not something we need right now, and it could just prove to be a huge performance issue."At Binghamton University in New York, home to more than 13,000 students and faculty members, Network Administrator Joe Roth said that the school was in desperate need of a better method for keeping malware from finding a way onto its network.Unlike a business, the university is forced to admit machines that it does not own or control, and students were continually dragging unwanted programs onto the school's network that they had picked up on their computers in other places, Roth said.After fighting its way through several major virus outbreaks, the school decided to install NAC applications made by Bradford Networks in 2004. Since that time, the institution has saved a significant amount of time and money that it was previously forced to exert to deal with the repeated outbreaks, he said."We were spending a lot of time trying to clean things up, and we needed to have some way to ensure that when a student tries to connect to the network, we know who they are and what they're doing, and make sure that they're not spreading infections to us," Roth said."I won't lie, [NAC] is a large system to get your head wrapped around, especially when you think about working with networks in a more traditional sense, doing switching and routing," he said. "If it is going to work you have to understand what is going on with your network, how it will interact with a client PC in terms of what types of anti-virus they have, but we've made it work."As with Astrium NA, Binghamton isn't planning to take NAC in any cutting-edge direction, but it does continue to roll out the system to include additional users, such as its faculty members, and it has begun using the system to grant wireless access to students on campus.One of the greatest benefits of using the system, in addition to allowing the school to better enforce its security policies, he said, was that it has made Binghamton's undergraduate community far more aware of the realities of today's computing environment and the nature of malware attacks."We're a teaching institution, and I think this is actually some valuable experience that our end-users are going through, as they're going to have to deal with this type of thing as they head out into the workforce," said Roth. "Every year when the students come back, we find that a lot of them don't even know what anti-virus is about or the threats themselves, so it has value from an educational standpoint as well."
484549
OCTOBER 14, 2004 (IDG NEWS SERVICE) - IBM and Cisco Systems Inc. unveiled product updates that will tie technology from the two companies more closely together in an effort to secure customer networks from worms and viruses.
382956
(InfoWorld) - Building a bridge is rarely a quiet affair. Just ask John Augustus Roebling and his son, Washington, whose Brooklyn Bridge took 13 years to complete and cost 27 people their lives. Nevertheless, for the past two years, IT titans Cisco and Microsoft have been engaged in a monumental and more-or-less silent bridge-building effort, as teams of engineers at both companies have worked to join two very different technologies that do the same thing: screen computers for security threats before allowing them to access a corporate network. Last Wednesday, the time had finally come to pull the covers off that integration, which one Cisco executive acknowledged took longer than expected. At The Security Standard conference in Boston, the two companies demonstrated interactions between Vista systems using Microsoftâs NAP (Network Access Protection) and network hardware using Ciscoâs NAC (Network Admission Control) architecture. They also released a white paper describing how the two network access control systems can interoperate and presented a road map for delivering interoperable NAC and NAP products to market. Still, serious questions remain about when interoperable NAC and NAP systems will be available and whether the solution will fit the needs of most enterprise networks. The announcement capped off a two-year integration effort that has been shrouded in mystery. Since saying in October 2004 that they would integrate NAC and NAP, the companies have been sparing with details, prompting speculation that the integration was more PR than reality. Bob Gleichauf, CTO of Ciscoâs security technology group, acknowledged that NAC-NAP integration took longer than the companies planned. However, the official silence about the integration project had more to do with the effort of harnessing resources at two notoriously bottom-line-focused companies than with the technical hurdles of integrating NAC and NAP, he said. Customers who use both Cisco and Microsoft products, and upgrade to both Vista on the desktop and Longhorn Server, will be able to use NAP, NAC, or an integrated NAP-NAC solution for client health screening, Microsoft said. Vistaâs NAP System Health Agent will send system health status reports to Microsoft NPS (Network Policy Server) running on Longhorn. A Cisco Secure ACS (Access Control Server) will instruct the NAP agent on the client system about how to access the network after the health check is complete, according to Gleichauf and Mark Ashida of Microsoft. However, Cisco and Microsoft face tough questioning about how their system will support third-party operating systems, network gear, and point security products. Ashida said Microsoft was focusing on NAC NAP for now but fully intends to support other 802.1x-compliant NAC infrastructure vendors. The benefits of integrated NAC and NAP are at least a year away for enterprises, with Longhorn server months away from availability and widespread adoption of Vista on enterprise desktops also well off in the future, said John Pescatore, an analyst at Gartner. Jon Oltsik, an analyst at Enterprise Strategy Group, said the Cisco-Microsoft partnership was creating uncertainty in an area that cries out for open standards and multivendor support. âTheyâre treating the symptom but not the disease,â Oltsik said. âUsers want open solutions that support Linux clients and wireless and any kind of switch or router.â The integration between Microsoft and Cisco, while good for those companies, will hinder open standards efforts such as the Trusted Computing Groupâs Trusted Network Connect standard, Oltsik said. âThis is a 1990s solution. Itâs a big step back for client security.â
533987
Network Access Control made easier Juniper Networks and Microsoft want to ease the burden on the tired souls tasked with deploying network access control in the enterprise, announcing plans to make Juniper's Unified Access Control (UAC) interoperate with Microsoft's Network Access Protection (NAP).â¦
350223
Well, here's your problem right here, ma'am Cisco, EMC, and Microsoft are joining forces to help the US government build a secure IT system for agencies to manage and share data.â¦
588198
IBM and Cisco Systems unveiled product updates that will link technology from the two companies more closely together to protect customer networks from security threats.
176001
Fujitsu and Cisco Systems announced that they have reached a fundamental agreement to enter into a strategic alliance focusing on routers and switches that will enable service providers and enterprises to build advanced Internet Protocol (IP) networks.
61682
Four small security software vendors have teamed up to develop a set of technical criteria for tools designed to secure Web applications. They also invited Cisco and other large IT vendors to take part in the certification program.
95773
Cisco Systems this week said it had co-developed with Microsoft an application that helps small and medium-sized businesses connect Microsoft&#39;s customer relation management
695305
Cisco Systems issued a security advisory warning that some networks using its routers may be vulnerable to denial-of-service attacks. Devices running Internetwork Operating System and enabled for the open shortest path first (OSPF) ...
315862
Ziff Davis - Security sources announce four mostly unrelated enterprise vulnerabilities in Cisco Unity, Cisco Guard, Veritas' Backup Exec, and Samba, the Windows file-sharing utility for Linux.