Over my 10 years in Nokia's Security Appliance Business, I have met a lot of people. Many of these people worked in the business and moved onto other areas of Nokia. Others were the direct result of my "poking around." At one point, I hoped that I could leverage some of these contacts to branch out into other areas of Nokia.

Then, a funny thing happened at the end of September 2008. Nokia announced they were selling the Security Appliance Business to an outside investor. We were to become a new, independent company. Shortly thereafter, the wheels fell off the economy and the credit market dried up. This made such a venture untenable.

Shortly before Christmas, Nokia announced we were being sold to Check Point Software . It wasn't the original plan, but under the circumstances, it made the most sense.

Despite the uncertain economic climate, not to mention the uncertain future all of us faced, a funny thing happened. We all pulled together, tightened our belts a little, and forged ahead. Profitability continued. Epic amounts of customer satisfaction were attained. We showed incredible strength and determination. Every one of us.

Meanwhile, the rest of Nokia downsized and reorganized. The company is asked employees to volunteer for a layoff as well as ideas for cost savings. I would not be surprised if additional actions are being considered to ensure survival during this protracted recession.

Clearly, my days at Nokia are numbered. Some of us will end up at Check Point. Others, sadly will not. It's not only a long goodbye to a company that has treated me well for 10+ years, but to a "family" of people I've worked with. While like all families, we disagreed at times, we all tried our best to "delight our customers" and be "very human" (to borrow a couple of Nokia's values).

While it is goodbye to some, many of us will continue to work together as part of Check Point. Clearly, it won't be the same as it was. I have hope that, in time, it will be much better than what we had.

Reblog this post with Zemanta

Intrusion Prevention Systems are designed to detect possible attacks that are occurring over the network and act upon them in some way. They are not unlike firewalls, but they tend to approach the problem a bit differently. Whereas your typical network firewall is a "deny by default" system (i.e. deny all traffic except those which pass certain criteria), an IPS tends to be an "allow all by default" system (i.e. allow all traffic except those things that look dangerous). Also, firewalls tend to be routers to serve as a network choke point, whereas the IPS is a "bump in the wire" looking at all traffic passing through. It is usually deployed in-line with the firewall, either on an ingress or egress point.

Joel Esler, one of the professional services guys for Sourcefire, who sell IPS solutions (Nokia, my employer, is a Sourcefire partner), wrote an interesting blog post decrying the typical practice of deploying the IPS outside the Internet-facing firewall. His basic message: if your Internet-facing firewall is properly configured and your important machines are properly ensconced behind it, you don't need an IPS on the outside of your firewall. The IPS should be placed inside the firewall.

While I agree that IPS is needed inside the external firewall, I think IPS has a useful place outside the firewall as well. It is not always feasible to put everything behind a firewall. For example, it may not be possible/feasible to subnet your external network so you can put stuff behind a firewall. You might be using a service that does not play nice with a firewall. Or any number of other technical or political reasons.

Even if you can manage to get everything behind a stateful inspection firewall, what's looking after the firewall? Sure, a properly configured firewall will deflect anything the Internet is likely to throw at it, but even a properly configured firewall might be susceptible to a security vulnerability.

To throw another viewpoint into the mix, perhaps the place to integrate IPS functionality is right in the firewall itself. Check Point was clearly starting down this road with SmartDefense in the NG AI release of VPN-1. Now in the R70 release of Check Point's Security Gateway product, we have the IPS software blade, which is a full-blown IPS.

The bottom line is that if you're going to use an IPS, you need it everywhere bad stuff could happen--inside or just outside your security parameter. Or on the firewall itself ;)

Reblog this post with Zemanta

One of the things that is making this transition to Check Point Software easier is the community of people that support, use, and sell what used to be called Firewall-1, but now goes by a few different names and offers many more functions than just firewalling and VPNs. It's a community I have never really left, having spent the last decade in Nokia's Security Appliance Business, but it's one I was less visible in over the past several years.

Despite being less visible in recent years, I have still been contributing, albeit indirectly. I have been maintaining Nokia's knowledge base, which of course contains many articles that relate to Check Point. I haven't written many Check Point-related articles in recent years, but I do work to make sure that the articles other folks in support write are readable. I also help our team out in various, sundry capacities, with the goal being to get customer issues resolved quickly.

In the course of this work, and my presence on many a social network, I run across the occasional person who thanks me for the contribution I made to the betterment of the Check Point community many years ago. As I re-engage in the community, the accolades have noticeably increased.

Meanwhile, Kellman Meghu, a SE manager for Check Point Software in Canada, recently gave a troubleshooting presentation for CPX 2009 in Las Vegas (CPX, or Check Point Experience, is their annual trade show). In the presentation, he apparently decided to use a picture of me to represent when things got hairy and you needed expert advice from support.

Kellman tweeted the following yesterday:

Used a picture of @PhoneBoy in his presentation. The crowd cheered; no one has forgotten the help he has provided to CP users.

To say I was touched and humbled is an understatement.

So what now? Hard to make any grand plans under the circumstances, but I'm keeping busy. I'm still running the FireWall-1 Gurus mailing list and participating on the CPUG Forums, helping out where I can. It's not much, but until the deal between Nokia and Check Point closes, it's difficult to do much else.

I recently went through the trouble of installing a Nokia IP260 as a firewall at home. It was one of the only machines I felt I could keep running in my office for any length of time and not cringe at the fan noise being thrown off. Clearly, our security appliances are not designed for home installation ;)

Unfortunately, the IP260 I had been using decided to die. Again. The unit had been sent to our repair facility on two separate occasions for repair for the same problem: won't even get to the boot manager. As a software guy, there's not a whole lot I can do about hardware problems ;)

The method they make employees follow is the "Return and Repair" method. We ship the box to the repair facility, they fix it and send it back to us. The only time a customer would ever follow this process is if their box is not covered by a support agreement. Otherwise, most direct customers get Advanced Replacement or on-site replacement, depending on your purchased support agreement.

The good news is that this unit should be scrapped and I'll get a (like) new unit to replace it. I also can run R65 now instead of R62. The bad news? I have to listen to the whine of the fans of an IP390 for a while.

Update: Our Service Parts guy told me they are going to overnight me a unit. I can scrap the unit myself. Spare parts FTW!

I got an email from the National Science Foundation regarding an interesting technology they used to watch all the surveillance cameras at President Obama's inauguration. According to the press release put out by the NSF, the technology created by VSee allowed law enforcement the ability to look at multiple cameras in real-time--even from police cruisers on a mobile phone network connection!

VSee sells their technology as a videoconferencing/application sharing service for companies, though at $50 per user per month, it's a bit pricey. However, you can be assured the service will work over low-bandwidth connections, is secured with FIPS 140-2 certified 256-bit AES encryption, and will traverse firewalls.

You can try the service with 3 users for free to see how well it works. Of course, without a Mac version, it's unlikely I'll spend a lot of time using it. I will have to see how well it works across the great firewall of Nokia before I become an ex-employee ;)