Subject: RE: new to VPN

From: "Jayant Shukla" <[email-masked]>
Date: Sat, 1 Feb 2003 09:22:15 -0800

> -----Original Message-----
> From: [email-masked]
[mailto:[email-masked]]
> On Behalf Of Stephen Kent
> 
> although I agree it improves the situation. Dedicated
> hardware devices usually do not have the OS services present to shut
> off, so they are better off.  

I am not sure I really understand. Once you have switched off services,
what is the difference? You agree that it improves security and then you
say hardware is better. Can you tell me attacks that are OS specific and
not related to a service?

> I think we see more of this flavor in
> modern firewall products as well, so I think there is a parallel
> evolution path here.
> 

Which modern hardware firewalls? Newest thing in security is to solve
the intrusion problem and weed out Trojans. A recent test has shown that
hardware based systems performed miserably.

There are a lot of things you can do in software to catch detect
intrusions and catch Trojans, that you can never do by using a
standalone hardware.

> >There is a lot more to practical security than FIPS level 3. Maybe
your
> >box is fine, but a Trojan can have a field day with the computers
behind
> >your box.
> 
> Yes, but it's not the fault of the box, which is the focus of this
> discussion.
>

In my very first e-mail, I _very_ clearly stated that software based
systems will have an advantage in detecting Trojans. And therefore may
have an advantage in overall security. 

If you did not agree to that statement and wanted to talk only about the
security of VPN box, you could have mentioned it a lot earlier. 

> Since the comment applies to just the security of the IPsec device,
> not the computers behind it, I think it is fair to say that a
> dedicated, hardware implementation of IPsec has the potential to be
> considerably more secure than an implementation that runs on a
> general purpose computer with a general purpose OS, even if one
> attempts to harden the OS by turning off extraneous services.

The reason for my original response was that a general perception has
been created that hardware is more secure than software. Maybe (a real
maybe), VPN hardware is more secure than software based VPN, but somehow
that gets generalized to overall security. IMHO that is not correct. 

Here is a good example of hardware relying on software to improve
security....

Several leading VPN hardware vendors are working with those who
specialize in host-based security to ensure that the host configurations
have not been altered to infect the host with a virus/Trojan. These
secure VPN boxes were serving as a conduit to spread viruses and Trojans
and wreaking havoc on corporate security.

To summarize, security based on your lowly desktop OS is looking good.
It provides an excellent platform to integrate security function to
improve ease of configuration, management, event correlation, protection
against internal attacks, Trojan & intrusion detection and is a better
solution for overall security. Not to mention that it is much more
economical. 
Performance is excellent as well. 

Regards,
Jayant
www.trlokom.com

---

From: Stephen Kent <[email-masked]>
Date: Mon, 3 Feb 2003 10:36:57 -0500

>hardware based systems performed miserably.

Is this a function of the hardware performance, which is the focus of 
the thread, or the algorithms being used?

>intrusions and catch Trojans, that you can never do by using a

Nonesense. The line between what is programmable and what is hardware 
has been moving for 30 years, and will continue. The fact that your 
company happens to sell products based on general purpose computing 
platforms seems to be unduly influencing your comments.

>have an advantage in overall security.

As I said above, this is nonsense. The issue you are raising revolves 
around what algorithms are run to detect whatever we're looking for, 
not whether these algorithms are executed in a general purpose OS 
context, or in a dedicated realtime OS context with lots of hardware 
assist for pattern matching.

>security of VPN box, you could have mentioned it a lot earlier.

I don't recall your clearly articulating what sort of security was 
the focus of your comments, and from the messages others have sent, I 
think this lack of clarity is not merely a problem with my perception 
of your comments.

>and wreaking havoc on corporate security.

There are lots of means by which malicious code can be introduced 
into a host. Transit via an IPsec SA is one choice, but so is transit 
via an SSL connection, an S-MIME e-mail attachment, etc. The issue is 
where the secure communication path is terminated, and this where it 
can be examined for malicious code. The use of hardware or software 
devices along the path is immaterial to the fundamental issue here.

>Performance is excellent as well.

Not really.

Steve

---

From: "Jayant Shukla" <[email-masked]>
Date: Mon, 3 Feb 2003 10:23:30 -0800

> Sent: Monday, February 03, 2003 7:37 AM
> To: Jayant Shukla
> Cc: [email-masked]
> Subject: RE: new to VPN
> 
> >

Please read the original e-mail by Alan and allow me to quote:

"Is it true that the hardware VPN solutions are always better, trusted
and have higher secure level than software VPN?"

> platforms seems to be unduly influencing your comments.

That's enough! Rudeness and personal attacks are not the way to conduct
a discussion on a public forum. 

Since you brought up the issue of our product......it is doing rather
well. Check the top 100 downloads at Tucows to see for yourself. 

http://www.tucows.com/toppicks.html 

> think this lack of clarity is not merely a problem with my perception

Please allow me to quote again from my first e-mail:

"
> > Is it true that the hardware VPN solutions are always better, 
> > trusted and have higher secure level than software VPN?
> 

On the contrary, I think software solutions are becoming more secure
than the hardware solutions. If you look at technologies related to
intrusion prevention or known/unknown Trojan detection, the software
solutions have a much better edge.
"

Based on the way you respond, say incorrect things, and the fact that
you are simply not open to other people's point of views, I am not
interested in having any more discussions with you. 

Regards,
Jayant
www.trlokom.com

---

From: Stephen Kent <[email-masked]>
Date: Mon, 3 Feb 2003 15:08:26 -0500

>and have higher secure level than software VPN?"

Yes, that text sounds familiar. I, and others, interpreted this to 
mean that the  question had to do with the security of an 
implementation of VPN technology, since Alan asked about hardware vs. 
software for VPNs. He did not ask about VPNs that incorporate IDS 
functionality vs. ones that do not.

>a discussion on a public forum.

I was giving you the benefit of the doubt, assuming that you were 
smart enough to understand that this was nonsense and that it was 
some form of corporate loyalty that forced you to make a silly 
statement of that sort. If you insist otherwise ...

>http://www.tucows.com/toppicks.html

And McDonalds is highly rated by consumers of its products, which 
says so much about the nutritional value of those products.

>interested in having any more discussions with you.

I respond very negatively to nonsense statement by vendors in the 
context of an IETF WG. Your statement fall into that category.

It's not a matter of being open to "other people's point[sic] of 
views. What we have been discussing ys largely a matter of fact, not 
of value judgements.

I applaud your decision to not continue the discussion. It will avoid 
wasting the time of WG members.

Steve