Microsoft, Cisco Team on Network Access Protections
12127
10/19/2004 -- Microsoft and Cisco are teaming up to share security information across products, an effort that should ultimately make offerings from both vendors more secure.
350473
Microsoft and Cisco Systems today said they will share security and network health technologies in an effort to stop, isolate and eliminate viruses and other malicious software on Windows-based networks.
100013
In a deal sure to bring smiles to the faces of enterprise security pros, Microsoft (Quote, Chart) and Cisco Systems plan to integrate technologies and push for an industry standard to power network security and health policy compliance.
509744
Letter: Setting the record straight on network location awareness and Vista Group Policy.
97924
This white paper by analyst Jon Oltsik from the Enterprise Strategy Group (ESG) describes the multitude of benefits associated with providing network access to various users in the distributed enterprise. However, this access comes with a price. The more endpoints and users that access the network, the more dangerous the network neighborhood becomes. Somehow, enterprises must strike a balance between network access and security for internal and external users as soon as possible.
620975
Cisco Systems and Microsoft&#39;s partnership in the small- and midsized-business market is bearing fruit. On Monday, Cisco announced a new software product that will link its voice over Internet protocol products
638955
Juniper Networks claims to have added an important piece of technology for delivering on its integrated network security strategy as part of the launch of its high-speed EX-Series of enterprise switches.With onboard capabilities aimed at extending security functions, including applications usage visibility and NAC (network access control), among others, Juniper executives said that the devices -- the company's first set of high-performance switches targeted directly at enterprises, versus its existing systems aimed at telecommunications providers -- allow the networking gear provider to address demands being made by large customers.As enterprises replace aging networks with new high-performance equipment, security capabilities are high on the lists of core features that buyers are requesting, said Mark Bauhaus, executive vice president and general manager of the Service Layer Technology Business Group at Juniper.?While the infrastructure-defense tools represent only one aspect of the larger push to make networks faster and more reliable to support business operations, they have become an increasingly central element of customers' long-term goals, the executive said.Increased integration capabilities established between the new switches and Juniper's existing access control, firewall, intrusion prevention and UTM (unified threat management) products is the most significant aspect of the devices' added security functions, according to Bauhaus. "This truly builds on our strength to do end-to-end security integration," he said. "We're not looking to become a pure-play security vendor, but these are features that customers are looking for in building high-performance networking infrastructure."In addition to allowing for more unified, integrated security throughout their networking architecture, Bauhaus said that customers are looking to onboard security functions as a way to save money and reduce complexity by replacing other devices, including inline NAC appliances. "Customers clearly want to collapse the sheer number of special-use security devices," he said. "And with the integration to our Unified Access Control technology, we think that this launch represents another important stepping stone by providing customers with the ability to utilize unified access with additional support from their infrastructure."While rival Cisco Systems has been positioning itself as much as a provider of security tools as a networking specialist for the last several years, at least in terms of its marketing image, Bauhaus said that Juniper is more interested in being viewed as a leading provider of high-speed gear that offers embedded security and standards-based ties to network-defense tools offered by other vendors. All of the security functionality being integrated into the EX-Series switches and Juniper's networking gear is focused primarily on fostering high-performance infrastructure for customers that is also safe and reliable, he said.Building its products around open industry standards, in particular the security tools, is crucial to allowing third party developers to take advantage of the features, Juniper executives repeatedly stressed at Juniper's Global Enterprise 2008 event held in New York on Tuesday.Officials from IBM, Microsoft, and Oracle took the stage to endorse the networking company's ability to foster stronger ties with their own products.Businesses applaud Juniper's move Calvin Choe, director of technical business development for the Enterprise Networking Group at Microsoft, highlighted the importance of Juniper's work to allow for tight integration between its infrastructure technologies and Microsoft's NAP (Network Access Protection) iteration of NAC, which will arrive next month with the introduction of the software giant's Windows Server 2008 software. NAP is also supported in Microsoft's Windows Vista operating system. "Used with NAP, this will allow network administrators to create policies around identity and assess users' state of compliance to enforce their own set of criteria," said Choe. "The support of standards is important because we wanted to make sure that customers had their choice of switching vendors."In addition to partners, Juniper also hosted several customers on stage, all of whom mentioned the EX-Series' security features as one of the core strengths of the new product line. "Security is one of the most important things to us, and we wanted an extra layer of access control to deliver defense-in-depth," said Frank Ziegler vice president of communications for the Philadelphia Stock Exchange.Some industry watchers said that the new EX-Series switches add a crucial piece that had been missing from Juniper's product portfolio from an integrated security standpoint. The new hardware should help the company differentiate from its rivals, including Cisco -- which has aggressively added to its own security holdings over the last several years, said David Willis, a communications market analyst for Gartner. "I think one of the more interesting elements of the launch is Juniper's work to integrate with third parties like Oracle; Cisco has announced similar intentions to do so, but it may take them years to get products ready -- and the size of Cisco's installed base may actually represent a problem in terms of getting products to market," said Willis. "With Cisco, it's also not unusual to run into customers who may have as many as 50 different versions of its OS on its devices, and from that standpoint, sometimes nothing beats a fresh start."The analyst that just said how much of an advantage the new products could represent on the enterprise market will likely depend on how seriously customers view Juniper's efforts to truly embed security throughout its networking gear versus merely adding individual features.Other experts said that the addition of the switches' security features could threaten providers of standalone devices, such as inline NAC appliance vendors like ConSentry and Autonomic Networks."Clearly the fact that Juniper hasn't had a switching product in this space has limited the reach of UAC, but with customers that have existing investments in Juniper firewalls and VPNs, this could be seen as good news," said Paul Roberts, analyst with The 451 Group. "There's always the question if anyone is really going to do a rip and replace to get NAC functionality, but for companies doing upgrades and looking for the features, this could be a viable option," he said. "In some ways, the new switches may give Juniper the ability to leapfrog Cisco, Extreme Networks, and other rivals with some of these features for access control and applications visibility."
137514
(InfoWorld) - Cisco Systems will begin offering IronPort's security filtering tools to its firewall customers after the networking giant's acquisition of the company closes on June 25. On tour to evangelize the benefits of the buyout to media, analysts and customers, top Cisco security executives and IronPort Chief Executive Scott Weiss said that the combined company will move quickly to create a software upgrade package that will provide content filtering functionality and behavioral reputation intelligence into the networking market leader's 2.5 million existing firewall systems. Once the deal closes on Monday, Weiss will assume a role as a senior security marketing executive with Cisco, he said. The for-pay security add-on derived from IronPort, which has maintained a San Bruno, Calif. headquarters, will allow customers to employ what the company has dubbed as "wide traffic inspection" at the firewall, arming users with more comprehensive network traffic analysis tools, the executives said. The content filtering package represents only the first of many opportunities borne of San Jose, Calif.-based Cisco's $830 million buyout of the firm, said Weiss and Mick Scully, vice president of product management at Cisco's Security Technology Group.Â  "The e-mail and Web filtering capabilities we bring into Cisco's self defending network vision will allow customers to do more granular filtering of traffic traveling across ports that have traditionally been left open by firewalls," Weiss said. "Today, most threats are coming into the network as links embedded in e-mail messages; putting this type of intelligence at the firewall will increase its efficacy in stopping those attacks." Through blending the malware-distribution data gathered by IronPort's SenderBase IP address reputation service into Cisco's Adaptive Security Appliance (ASA) firewalls, the devices will become more dynamic security filtering gateways that can detect a far greater number of potential attacks before they enter the network, the companies claim. "As Cisco takes what it has been doing at the network layer and adds content awareness, customers will be provided with a whole new set of traffic monitoring abilities," said Scully. "This is a new business model for us, but we believe we can take advantage of the fact that content filtering has traditionally been a highly-fragmented market." Scully estimates that the firewall market currently represents a roughly $5 billion annual sales opportunity. By integrating content filtering, which Cisco projects as a $2 billion per-year market that is growing at 30 percent per year, the executive said that the massive networking and security firm expects its products to serve a $10 billion per-annum segment sometime around 2011. For its part, Weiss said that IronPort is expecting to report growth of 70 percent for its current fiscal year, pushing its revenues over $200 million. After moving to integrate the filtering specialists' tools into its firewall business, Scully said that Cisco would begin adding IronPort's technologies into its Integrated Services Router (ISR) products. "We'll be integrating IronPort's content and e-mail filtering technologies into our switching and routing products over the next several years," said the colorful Cisco security executive. "This is a strategy that reaches beyond the current wave of Web 2.0 technologies and services oriented architecture technologies into the next decade and beyond as customers demand more integrated security features." Weiss said that another immediate benefit of the merger will be an opportunity for Cisco to expand its abilities to provide data leakage prevention (DLP) protection at the network gateway. "We'll be looking to leverage the footprint of firewall and switches to better inform customers about many different aspects of security," he said. "Anything we can add to what Cisco is already doing has a network effect, and there will be a lot of opportunities for us to help companies monitor for malware and even look into issues such as data leakage prevention." At least one industry analyst said that the IronPort acquisition dovetails nicely with emerging customer demands to look at patterns in IP traffic to eliminate malware attacks such as botnet programs -- without having a negative impact on their overall network performance. "When you look at reputation services, if you know who the people are who are sending out spam or malware, there's a big opportunity to filter-out a lot of unwanted content at the gateway," said Andrew Jaquith, analyst with Boston-based research firm Yankee Group. "To do that you must have visibility into the actual flow of data, and that's what Cisco and IronPort should be able to provide." Selling additional features and services to existing customers is a sensible place for the two companies to begin their joint efforts, but their new products will need to prove their efficacy at stopping threats such as botnets which remain problematic for many large enterprises today, to gain wide acceptance quickly, the analyst said. "If you know that certain IP ranges are harboring botnets, or see something within the company network trying to communicate with those addresses, you have a pretty good clue that you've got a problem," he said. "That's one of the best potential uses for tying-in visibility into external reputations and correlating that with things going on inside the network." Jaquith believes that IronPort's technology will find its way into many of Cisco's routing and switching products over the next several years, and he cited the ability to leverage reputation-oriented information about what types of Web sites endpoint devices have visited in Cisco's network access control (NAC) technologies as another potential benefit of the merger. "Cisco really wants to be thought of as a security player, and for them to do that, it means they needed to move up the stack a couple of layers and start looking at e-mail and layer seven type-applications, they really needed to play in that space," the analyst said. "It's a mature market, and Cisco picked a strong company to help plant its security flag a little deeper."
282229
(InfoWorld) - As it develops the next generation of network security infrastructure, Cisco Systems Inc. is planning to cease development on its network admission control (NAC) client, the Cisco Trust Agent (CTA), and submit the source code for the software client to the open source community, Bob Gleichauf, CTO of Cisco's Security Technology Group, told InfoWorld. Cisco has a goal of making the CTA open source within "a couple months," allowing the company to free up development resources for other areas of NAC, Gleichauf said. Cisco's decisionis Â more evidence that Cisco will cede control of the desktop to Microsoft Vista, following a deal in September to use the Microsoft's NAP (Network Access Protection Agent) as the client for both Cisco NAC and NAP. "CTA will be something that's open source. That's just logically where it should end up," Gleichauf told InfoWorld. "We don't want to be in the CTA business, so we're going to just open it up." In September, Cisco and Microsoft unveiled the fruits of a long, cross company effort to integrate their network access control architectures. The plan devised by the two companies called for computers running Windows Vista or Windows Server to include the NAP Agent component as part of the core operating system, and to use that agent for both NAP and NAC. The NAP added support Extensible Authentication Protocol over UDP and EAP-FAST support, developed by Cisco and distributed over Windows Update in addition to native EAP methods and an 802.1X supplicant to enable it to work for both NAC and NAP. Computers running Windows XP with Service Pack 2, as well as non Windows systems, would need to run the Cisco Trust Agent for NAC and run the NAP Agent for NAP. Cisco also promised to continue developing CTA for non-Windows Vista and non-Windows Server âLonghornâ platforms. Since then, however, Microsoft and Cisco have extended both 802.1x and EAP support to Windows XP, reducing the need for the CTA, said Mark Ashida, General Manager of Enterprise Networking Servers at Microsoft. Open sourcing the CTA agent is just part of a much larger effort at Cisco to push beyond mere network access control to a much broader security architecture that addresses problems such as data leaks and policy enforcement -- architecture in which Cisco's Security Agent (CSA) will play a much bigger role, Gleichauf said. "Data leakage is about things crossing boundaries from areas you control to areas where you have less control: e-mail attachments going over IM, or data going from someone in [human resources] to someone in manufacturing who shouldn't see it," he said. "For us, it's all about modeling based on how data moves around. We recognize that data has its own identity, and we want to use the controls we've built up around where users can go -- role based access -- to figure out where data can and can't go," he said. Components like the technology Cisco recently acquired with IronPort will provide some of the intelligence to stop messaging and Web based leaks, and Cisco will use intelligence in its routers and switches to control data flows and in the CSA agent to enforce data-level policies on the desktop, Gleichauf said.Â  "CSA is the next area where you're going to see us make go to market announcements that offer real value in the data leak space," he said. "Cisco's getting out of the desktop plumbing business and focusing on areas on the desktop where they can add value to what they're doing on the network," said Jon Oltsik, an analyst at Enterprise Strategy Group. But Gleichauf's comment may also be an indication that Cisco trying to change the conversation around its NAC architecture, which has been a tough sell with enterprises largely because of the cost of upgrading Cisco and non-Cisco networking infrastructure in order to take advantage of the access control features. While the company has found plenty of buyers for its NAC appliance, formerly known as "Clean Access," it has had far few takers for the full fledged NAC solution. In the meantime, the company has found competition from a wide range of niche NAC vendors, security mainstays like Symantec as well as Microsoft, Juniper and the Trusted Computing Group's standards based Trusted Network Connect architecture. Gleichauf acknowledged that his company hadn't executed well in selling NAC to partners, but said the solution was for Cisco to close the loop even tighter on which firms it will tap to be a part of its solution. "With NAC we got caught in the vendor program race with TNC and Microsoft, where you want to get as many vendors as possible. But there are only a minority of vendors who are value added. The majority of them are just looking for stickers to put on their booth," he said.  Going forward with its data leakage solution, Cisco will rely on a small number of main vendors that offer it more value with license arrangements, rather than rely on open standards, Gleichauf said. That vision concerned Steve Hannah of the Trusted Computing Group, which promotes open standards for network access control that allow third party software to speak a common language when making access control decisions. Releasing the NAC client as an open source application was a fine gesture, but it has little value to the community at large until Cisco agreed to submit its NAC protocols as open standards, he said. "Ultimately, Cisco retains control, and you end up with Cisco as the center of the universe. So customers are stuck buying Cisco gear and looking for things that plug into Cisco gear, but they don't really have a choice of different vendors," said Hannah, who is a distinguished engineer at Cisco competitor Juniper Networks. TCG is happy to talk with Cisco about moving NAC protocols to open standards, perhaps blending NAC technologies from Cisco and TCG to give software vendors and enterprises the most choice, he said. In the end, submitting CTA as an open source application may just be a politically correct way of throwing in the towel on an application that had become irrelevant, said Oltsik. "It's a feel-good move," Oltsik said, but one without much force as long as the NAC protocols used by CTA remain firmly in Cisco's grasp.
81816
Microsoft and Cisco Systems will collaborate to make their emerging products for network security compatible. The vendors had been working independently in the area of PC access to networks but say customers
58067
(InfoWorld) - A top Microsoft executive promoted the company's licensing of network security protocols at theÂ Interop trade showÂ on Wednesday, but not before taking time out during a keynote address to defend the company's patent licensing program for open-source software. Microsoft has licensed networking protocols to Juniper Networks as part of a program to make its network access protection software work with more networking vendors' products. It has also licensed protocols to Aruba Wireless Networks and network-attached storage vendor OnStor, said Bob Muglia, senior vice president of Microsoft's server and tools business. Before bringing up those licensing deals in his keynote address Wednesday morning, Muglia offered an explanation for the software giant's recent moves toÂ license its software patents to open-source software distributors. "The commercial software industry knows how to work with intellectual property and patents," Muglia said. Commercial software like Microsoft's has numerous patent sublicenses built into it for technology from other vendors, so that when a customer buys Windows or another Microsoft product, they have the assurance that Microsoft has given them the intellectual property protection they need, he said. "Customers have indicated to us that it's problematic to them that when they work with open-source software, they don't have similar intellectual property protection," Muglia said. There is no mechanism to effectively license that software, he said. This creates a real problem for customers, and Microsoft's licensing program is designed to solve it, according to Muglia. However, Microsoft has been accused of creating that very problem. Its patent licensing deals with Novell and other companies have come under fire for creating fear, uncertainty, and doubt among users of open-source software. Muglia's theme was Microsoft's newfound focus on interoperability, including overtures to other companies in network security and unified communications, both hot topics at Interop. But one attendee said the company will have to overcome a years-long reputation for not working well with others. Microsoft must be serious about interoperability now because it has no choice, said Brian Shannon, an independent networking consultant to small businesses in Avon-by-the-Sea, New Jersey. After all, with the proliferation of mobile devices, the company's desktop business is on the way out, he said.
77538
Microsoft solution falls short on a number of issues that are going to be important to larger enterprises, but it also has a lot of factors going its way in its war with Cisco.
623553
(InfoWorld) - Security researchers and experts this week cautioned network administrators to consider carefully whether they need to implement network access control (NAC) technology in their security infrastructure before buying in to the current hype surrounding it. Speaking on a panel at the Interop New York conference Josh Corman, host protection architect for Internet Security Systems, said that a company should have good reason to implement NAC, not just purchase the technology because it's the latest "buzzword" in the industry. "Do you want NAC because you heard itâs important or do you have real business problems to solve?" he said. NAC allows companies to perform health checks on end-point devices such as PCs and mobile devices before they are granted access to company networks. For example, employee PCs might be checked to make sure they are not infected with a virus and have up-to-date antivirus definitions before being allowed onto a corporate LAN. Corman was joined on the panel by Mike McKinnon, American director of security for Hewlett-Packard's ProCurve networking business; Elliott Glazer, direct of security architecture and consulting for Depository Trust and Clearing Organization; and Paul Stamp, a security analyst with Forrester Research. Speaking from a customer perspective, Glazer said he is more concerned at the moment with making sure the network infrastructure in his company itself is secure before worrying about how that network can check on the health of devices coming on to the network. "One of the fundamental things that has to be considered when you think about NAC is, is the network secure enough?" he said. "When I look at NAC, I say it's a great thing to do, but what do I do when someone comes in with a new piece of hardware -- what's it going to do to my network? Before I go down a NAC path, I'm going to make sure there is a secure environment there for me." "There's a lot of great stuff about NAC, but for us it's a little early," Glazer said. Forrester's Stamp said that for NAC to work effectively, companies involved in providing network security and those developing client technology must work together to make sure the networks can communicate effectively with endpoint devices. "[In NAC] it is the client-based technologies that are giving us the information, it is the client-based technologies that have to deal with any of the problems that arise," he said. "We as security are setting the policies, but the policies are taken into actionable rules by endpoint people. We have to be open to that and help them out. ... We really have to embrace the involvement of the endpoint guys."
629541
BOSTON - Networking equipment maker Cisco Systems Inc. warned customers about security holes in two products that provide user authentication and authorization services for network devices such as firewalls and routers.
75711
Cisco Systems Inc. and Microsoft Corp. on Monday will announce a collaborative effort designed to bridge a divide between their emerging network access-control architectures.
156401
Giants team on giant white paper Microsoft and Cisco Systems have detailed plans for interoperability between systems designed to enforce security policies on Windows PCs and servers.â¦
300480
Security collaboration with Cisco will bump key network protection feature until 2007.