I guess it's time to take a break from kvetching about my job for a moment and talk about something security related. Or more specifically, something related to keeping your kids safe on the Internet.

My 8-year old son is becoming a bit more adventurous in his quest for all things Pokemon, not to mention Tower Defense-type games. He is using that "search area" in the upper right hand corner of the Firefox window to find things. This has resulted in coming across pages that are "blocked" by Microsoft's Family Safety filter, which I use on all the downstairs computers. This inevitably means he'll run into whatever room I am in and ask me to "type in my password" to unblock the site. Frequently, he asks me when I am doing something else and, of course, he wants it NOW.

When I am ready, I go to his computer--which is in our living room and thus in a public room--and find out what site he was trying to go to. Some sites I know aren't particularly great for his age range (e.g. MySpace), others I will check first. Because I'm not quite sure what I am going to find, I ask him to leave the room first. Either that or I will make note of the site and go check on a different computer.

The reason for this is very simple: Microsoft's Family Filter does not offer a lot of granularity on blocking. Furthermore, it doesn't give any explanation as to why it was blocked (e.g. what category the website was in). Even if it did, one should never assume the filter is entirely correct. Best way to keep the kids protected is to manually review the site--without them in the room--in case something particularly nasty shows up!

In one case, I went to a blocked website that appeared to have ok content, but had ads on it that were clearly not ok. Furthermore, there was so much crap on the site that the browser basically locked up! In short, there was no way I was allowing my son anywhere near this website.

I then explained to my son why I was still not going to allow access to the site in question. I reiterated why the filters are there and why I manually check things first. He understood and moved onto something else.

Obviously, things are relatively simple right now. As time wears on, things are going to be more complex, particularly when we get into instant messaging and interacting with other people online. Not to mention the difference in age-appropriateness between my 8-year-old son and 4-year-old daughter as they get older. However, it will hopefully be handled much the way it is handled today: with a conversation.

Reblog this post with Zemanta

Over my 10 years in Nokia's Security Appliance Business, I have met a lot of people. Many of these people worked in the business and moved onto other areas of Nokia. Others were the direct result of my "poking around." At one point, I hoped that I could leverage some of these contacts to branch out into other areas of Nokia.

Then, a funny thing happened at the end of September 2008. Nokia announced they were selling the Security Appliance Business to an outside investor. We were to become a new, independent company. Shortly thereafter, the wheels fell off the economy and the credit market dried up. This made such a venture untenable.

Shortly before Christmas, Nokia announced we were being sold to Check Point Software . It wasn't the original plan, but under the circumstances, it made the most sense.

Despite the uncertain economic climate, not to mention the uncertain future all of us faced, a funny thing happened. We all pulled together, tightened our belts a little, and forged ahead. Profitability continued. Epic amounts of customer satisfaction were attained. We showed incredible strength and determination. Every one of us.

Meanwhile, the rest of Nokia downsized and reorganized. The company is asked employees to volunteer for a layoff as well as ideas for cost savings. I would not be surprised if additional actions are being considered to ensure survival during this protracted recession.

Clearly, my days at Nokia are numbered. Some of us will end up at Check Point. Others, sadly will not. It's not only a long goodbye to a company that has treated me well for 10+ years, but to a "family" of people I've worked with. While like all families, we disagreed at times, we all tried our best to "delight our customers" and be "very human" (to borrow a couple of Nokia's values).

While it is goodbye to some, many of us will continue to work together as part of Check Point. Clearly, it won't be the same as it was. I have hope that, in time, it will be much better than what we had.

Reblog this post with Zemanta

Intrusion Prevention Systems are designed to detect possible attacks that are occurring over the network and act upon them in some way. They are not unlike firewalls, but they tend to approach the problem a bit differently. Whereas your typical network firewall is a "deny by default" system (i.e. deny all traffic except those which pass certain criteria), an IPS tends to be an "allow all by default" system (i.e. allow all traffic except those things that look dangerous). Also, firewalls tend to be routers to serve as a network choke point, whereas the IPS is a "bump in the wire" looking at all traffic passing through. It is usually deployed in-line with the firewall, either on an ingress or egress point.

Joel Esler, one of the professional services guys for Sourcefire, who sell IPS solutions (Nokia, my employer, is a Sourcefire partner), wrote an interesting blog post decrying the typical practice of deploying the IPS outside the Internet-facing firewall. His basic message: if your Internet-facing firewall is properly configured and your important machines are properly ensconced behind it, you don't need an IPS on the outside of your firewall. The IPS should be placed inside the firewall.

While I agree that IPS is needed inside the external firewall, I think IPS has a useful place outside the firewall as well. It is not always feasible to put everything behind a firewall. For example, it may not be possible/feasible to subnet your external network so you can put stuff behind a firewall. You might be using a service that does not play nice with a firewall. Or any number of other technical or political reasons.

Even if you can manage to get everything behind a stateful inspection firewall, what's looking after the firewall? Sure, a properly configured firewall will deflect anything the Internet is likely to throw at it, but even a properly configured firewall might be susceptible to a security vulnerability.

To throw another viewpoint into the mix, perhaps the place to integrate IPS functionality is right in the firewall itself. Check Point was clearly starting down this road with SmartDefense in the NG AI release of VPN-1. Now in the R70 release of Check Point's Security Gateway product, we have the IPS software blade, which is a full-blown IPS.

The bottom line is that if you're going to use an IPS, you need it everywhere bad stuff could happen--inside or just outside your security parameter. Or on the firewall itself ;)

Reblog this post with Zemanta

One of the things that is making this transition to Check Point Software easier is the community of people that support, use, and sell what used to be called Firewall-1, but now goes by a few different names and offers many more functions than just firewalling and VPNs. It's a community I have never really left, having spent the last decade in Nokia's Security Appliance Business, but it's one I was less visible in over the past several years.

Despite being less visible in recent years, I have still been contributing, albeit indirectly. I have been maintaining Nokia's knowledge base, which of course contains many articles that relate to Check Point. I haven't written many Check Point-related articles in recent years, but I do work to make sure that the articles other folks in support write are readable. I also help our team out in various, sundry capacities, with the goal being to get customer issues resolved quickly.

In the course of this work, and my presence on many a social network, I run across the occasional person who thanks me for the contribution I made to the betterment of the Check Point community many years ago. As I re-engage in the community, the accolades have noticeably increased.

Meanwhile, Kellman Meghu, a SE manager for Check Point Software in Canada, recently gave a troubleshooting presentation for CPX 2009 in Las Vegas (CPX, or Check Point Experience, is their annual trade show). In the presentation, he apparently decided to use a picture of me to represent when things got hairy and you needed expert advice from support.

Kellman tweeted the following yesterday:

Used a picture of @PhoneBoy in his presentation. The crowd cheered; no one has forgotten the help he has provided to CP users.

To say I was touched and humbled is an understatement.

So what now? Hard to make any grand plans under the circumstances, but I'm keeping busy. I'm still running the FireWall-1 Gurus mailing list and participating on the CPUG Forums, helping out where I can. It's not much, but until the deal between Nokia and Check Point closes, it's difficult to do much else.

I recently went through the trouble of installing a Nokia IP260 as a firewall at home. It was one of the only machines I felt I could keep running in my office for any length of time and not cringe at the fan noise being thrown off. Clearly, our security appliances are not designed for home installation ;)

Unfortunately, the IP260 I had been using decided to die. Again. The unit had been sent to our repair facility on two separate occasions for repair for the same problem: won't even get to the boot manager. As a software guy, there's not a whole lot I can do about hardware problems ;)

The method they make employees follow is the "Return and Repair" method. We ship the box to the repair facility, they fix it and send it back to us. The only time a customer would ever follow this process is if their box is not covered by a support agreement. Otherwise, most direct customers get Advanced Replacement or on-site replacement, depending on your purchased support agreement.

The good news is that this unit should be scrapped and I'll get a (like) new unit to replace it. I also can run R65 now instead of R62. The bad news? I have to listen to the whine of the fans of an IP390 for a while.

Update: Our Service Parts guy told me they are going to overnight me a unit. I can scrap the unit myself. Spare parts FTW!