July 21, 2011

By: Tom Spear and Paula Parker

80% OF BUSINESSES today have some level of virtualization in their network infrastructure. Just like with physical servers, it is important to secure Virtual Machines (VMs) which have become software instances inside a host container. There are different ways to secure and restrict a VM or server. However, some methods can be slow, cumbersome and punitive. What is troubling is the growing battle of “speed vs. security” within many large organizations. A recent survey result indicated that speed still wins. Security News from Help Net Security www.net-security.org reported July 19, 2011 that the results of a Crossbeam Systems survey which polled nearly 500 participants of enterprises and service providers resulted in data indicating that “Ninety percent of respondents admit to making a trade-off between security and throughput performance.” That puts the organization, partners, employees and customers like yours potentially at risk.

So how do we address this conundrum? In the past, Security Administrators have used V-LANs to segment and secure their mission critical workloads. A second, more recent tactic has been to implement a “Slow Path” approach of securing VMs on a one to one firewall/VM ratio. This solution though, potentially uses up the hypervisor’s resource pool, slowing down the overall performance and adding a large amount of overhead. Both of the methods described above intensify the challenge of “speed vs. security”.

However, security must not be ignored. Consider the outburst in recent security breaches: HBGary Federal was breached in February of 2011, supposedly by the internet activist group “Anonymous”. In March, RSA endured a security breach from a targeted phishing attack compromising RSA’s SecurID authentication tokens which put at risk many Fortune 500 companies. Epsilon endured a breach in April, putting at risk those whose names were on millions of e-mail addresses that were stored by the company, which happens to be one of the world’s largest providers of e-mail service marketing.

Also during April, Sony’s Playstation Network was reported to have leaked personal information of over 70 million subscribers.

The company then again endured another breach in May. And, most recently, in June of this year, Citibank announced that personal and account information of an estimated 200,000 bank card customers in North America had been breached. Could the Citibank breach been linked to the massive Epsilon breach in April since it was reported that Citibank was one of Epsilon’s customers? The world is getting smaller and it would appear the attack footprint is getting bigger.

Yet, there is now a third unique solution that takes a “Fast Path” approach and can provide a balance point that removes the challenge of forgoing speed while securing the VM environment. This “Fast Path” approach doesn’t impair the ROI gained from going to the virtualization model and has minimal overhead. It was designed with high performance and virtualized security in mind. The Fast Path approach is only possible by taking advantage of VMware’s VMsafe APIs (Application Programming Interfaces). VMsafe is a security suite of API’s for the VMware Hypervisor. The VMsafe APIs allow vendors to advance security products that combat malware in ways that were not previously available to physical environments. Tom Spear, CEO of enfoPoint Solutions, http://enfopoint.com explains that the third option has a 10 times greater improvement over the alternatives in throughput with greater security, thanks to VMware opening up their API’s through the VMsafe certification program. At enfoPoint, we recommend that if you are looking for such a solution, you need a product that has had years of development and is purpose built from the ground up. Some of the features you should look for include the following:

• Agentless software to prevent malware from hiding within the hypervisor
• VM Safe certification
• Intrusion Detection System capabilities
• VM Introspection for gaining an X-Ray view of VM activity within the hypervisor
• Alerts and Reporting capabilities
• Compliance management and indicators for rating the current security posture
• High Availability (HA) options
• Ability to go from Global to granular for applying automated security policies.

This is not the future. There are products that meet all the above requirements today. Tom points out that it is important to select an agentless product so malware would have no place to hide. Malware can attack the infrastructure of a business, and can lay in wait to attack for long periods of time if left undetected. It’s an industry known problem that malware can disable agents and hide. The solution needs to be effective in addressing the security need to limit an in scope VM to a single function in order to comply with PCI DSS mandates.

THE MOST RECENT REVISION for PCI DSS compliance 2.0 was updated in the fall of 2010 specifically to address virtualization and how Cardholder Data should be treated in a Cardholder Data Environment (CDE) when the data is being processed, stored and/or transmitted (in scope). Additionally, cloud computing, both private and public, has an underlying platform based on virtualization. The PCI Security Standards Council released their “Information Supplement: PCI DSS Virtualization Guidelines” in June of 2011 stating in section 2.2.1 under Scope Guidance: “If any virtual component connected to, (or hosted on) the hypervisor is in scope for PCI DSS, the hypervisor itself will always be in scope”. So essentially, Virtual Machines that are processing, transmitting or storing cardholder data must be treated like an in scope server and limited to a single function based on PCI DSS requirements.

Both public and private cloud computing utilize virtualization because of the innate ability to optimize the performance of an organization’s network through resource pools and clustering for high availability, high performance computing, load balancing and utility grid computing. This however, also suggests a potential area of vulnerability and perhaps a security gap if security managers for both VMs and the cloud, public and private, have not taken all the due diligence necessary to secure the virtualized environment.

If your organization is considering Public Cloud Services, it is important to be aware that the PCI Security Standards Council advised that the responsibility for securing in scope VMs should be shared but weighted differently depending on the type of service the cloud is providing. See the graph below for the Council’s guidance for Infrastructure As A Service (IAAS), Platform As A Service (PAAS), and Software As A Service (SAAS).

enfoPoint Solutions offers compelling value propositions that help to address and minimize the security gaps from the issues above. Both hardware and software solutions are offered by the company that can literally address the performance and security concerns from layer 1 of the OSI model all the way through layer 7 providing not only defense in depth protection of physically connected servers but also purpose built security protection of virtual devices in a VMware environment that helps to maintain high throughput with minimal impact on the performance of organization and/or service provider’s network.

Tom enthusiastically adds that there is some break though products that have taken advantage of the VMsafe API certification program. He has invested time in addressing the solutions available and if you would like to learn more he encourages organizations struggling with the “speed vs. security” dilemma to contact him at info@enfopoint.com.
He also encourages you to please visit the enfoPoint booth at InfoSec Conference on September 15th at the Nashville Convention Center to learn more about the “Fast Path” solution.

by Paula Parker paula.parker@enfopoint.com

ADOPTION of the Government’s Cloud First Policy requires agencies to evaluate cloud options first, over traditional IT approaches. Is this right for your organization? According to CIO Magazine, in their June 15, 2011 edition, “Putting the Cloud First”, the magazine reported that 48% of IT Leaders surveyed were putting more money towards the cloud services. Still, some IT Leaders want to hold off on moving mission critical applications to the cloud. There is good reason for that concern. However, the reasons for the concerns can be remedied.

There are too many positive arguments for Cloud services not to consider the compelling value proposition; the main one being that it helps to reduce cap ex spending when gross profits continue to shrink or remain stagnant. This can be amplified when an organization is still suffering from operating losses from the Great Recession and could still be dealing with multi-year depreciation of capital goods purchased prior to the economic climate change and need a better way to manage cash flow as the organization continues to recover from the recession.

A second big reason to consider Cloud services is because the Cloud Service provider shares the cost of security. Many may believe that keeping the upgrades of the network up to date to stay current in protecting against more and more sophisticated threats is the responsibility of the cloud provider. However, in cases where businesses are required to adhere and comply with Industry Regulatory Requirements, such as HIPAA/HITECH, SOX and PCI DSS, it becomes a shared responsibility.

For example, the newest revision for PCI DSS compliance 2.0 was updated in the fall of 2010 specifically to address virtualization and how Cardholder Data should be treated in a Cardholder Data Environment (CDE) when the data is being processed, stored and/or transmitted. Essentially, cloud computing, both private and public, has an underlying platform based on virtualization. The PCI Security Standards Council released their “Information Supplement: PCI DSS Virtualization Guidelines”  in June of 2011 stating that the responsibility should be shared but weighted differently depending on the type of service the cloud is providing. See the graph below for the Council’s guidance for Infrastructure As A Service (IAAS), Platform As A Service (PAAS), and Software As A Service (SAAS)

Putting mission critical workloads on the cloud often implies that organizations will be having the cloud host their virtual machines (VMs). Cloud computing utilizes virtualization because of the innate ability to maximize and optimize the performance of their network through resource pools and clustering for high availability, high performance computing, load balancing and utility grid computing. This however, also suggests a potential area of vulnerability and perhaps a security gap if security managers for both VMs and the cloud, public and private, have not taken all the due diligence necessary to secure the virtualized environment. The concern is heightened when sensitive data is being stored, processed and/or transmitted through both the cloud and in scope VMs, which have become virtualized instances in host containers.

In order to mitigate the security gap, a defense in depth strategy needs to take place. It is important to take the necessary precautionary measures. One way to do this is to assume that certain network components will fail due to unforeseen and ever-growing threats that arise out in the wild and around the world. The security of the network should be assessed by the ability to quickly alert to an anomalous event, contain it, and then mitigate and restore security in order to maintain business continuity and consumer trust.

Why is maintaining high levels of security so important? Consider the case of TJ MAX. In January of 2007 they had a breach where approximately 94 million credit cards were stolen. They were fined 9.75 million dollars because of the breach. If you think that is a big fine, consider other costs the company had to endure such as the cost of their reputation being damaged and the marketing expensed endured to restore their image. There was a cost too, of loss of stock value that could have been directly related to the breach. At the time the breach took place the stock was trading around $30.04. A two month window look at their stock shows a dramatic drop in the stock value with the stock closing around $26.77. By the third month it was still trying to regain its value prior to the breach. If the drop in the stock price was directly related to the drop in consumer confidence after the breach took place, then that represented a considerable amount of money since 413 million shares were outstanding at the time. The drop from $30.04 per share to $26.77 represented a difference of $3.27. Taking that amount and multiplying it against 413 million shares represents a loss in value of approximately 1.35 billion dollars.
Source: dailyfinance.com

TJX COS INC NEW ( TJX ) prices

Fortunately for TJ Max, consumer confidence seems to have been restored and the stock is doing quite well now, but that is not always the case for every business that experiences a breach in their network. What is troubling is that there seems to be a growing trend where there seems to be a battle of “speed vs. security” within many large organizations. A recent survey result indicated that speed still wins. Security News from Help Net Security www.net-security.org reported July 19, 2011 that the results of a Crossbeam Systems survey which polled nearly 500 participants of enterprises and service providers resulted in data suggesting that “Ninety percent of respondents admit to making a trade-off between security and throughput performance.” That puts the organization, partners, employees and customers potentially at risk.

There has been a sophisticated outburst of security breaches during 2011. HBGary Federal was breached in February of 2011, supposedly by the internet activist group “Anonymous”. In March, RSA endured a security breach from a targeted phishing attack compromising RSA’s SecurID authentication tokens which put at risk many Fortune 500 companies. Lockheed Martin and Northrup Grumman also endured attacks on their respective systems. Epsilon endured a breach in April, putting at risk those whose names were on millions of e-mail addresses that were stored by the company. Epsilon happens to be one of the world’s largest e-mail service marketing service providers.

Also during April, Sony’s Playstation Network was reported to have leaked personal information of over 70 million subscribers. The company then again endured another breach in May. And, most recently, in June of this year, Citibank announced that personal and account information of an estimated 200,000 bank card customers in North America had been breached. Could the Citibank breach been linked to the massive Epsilon breach in April since it was reported that Citibank was one of Epsilon’s customers? The world is getting smaller and it would appear the attack footprint is getting bigger.

enfoPoint Solutions offers compelling value propositions that help to address and minimize the security gaps from the issues above. Both hardware and software solutions are offered by the company that can literally address the security and performance concerns from layer 1 of the OSI model all the way through layer 7, providing not only defense in depth protection of physically connected servers but also purpose built security protection of virtual devices in a VMware environment that helps to maintain high throughput with minimal impact on the performance of organization and/or service provider’s network. To see how enfoPoint Solutions can better address the security concerns of your organization, please contact Tom Spear, CEO and founder of enfoPoint Solutions or send an e-mail requesting information to info@enfopoint.com.

By Sharif Sakr posted Jun 30th 2011 12:01AM

You’ve got to hand it to IBM’s engineers. They drag themselves into work after their company’s 100th birthday party, pop a few Alka-Seltzers and then promptlyannounce yet another seismic invention. This time it’s a new kind of phase change memory (PCM) that reads and writes 100 times faster than flash, stays reliable for millions of write-cycles (as opposed to just thousands with flash), and is cheap enough to be used in anything from enterprise-level servers all the way down to mobile phones. PCM is based on a special alloy that can be nudged into different physical states, or phases, by controlled bursts of electricity. In the past, the technology suffered from the tendency of one of the states to relax and increase its electrical resistance over time, leading to read errors. Another limitation was that each alloy cell could only store a single bit of data. But IBM employees burn through problems like these on their cigarette breaks: not only is their latest variant more reliable, it can also store four data bits per cell, which means we can expect a data storage “paradigm shift” within the next five years. Combine this with Intel’s promised 50Gbps interconnect, which has a similar ETA, and data will start flowing faster than booze from an open bar on the boss’s tab. There’s more detailed science in the PR after the break, if you have a clear head.

20 Port GE SFP, two rack units tall, Carrier Class Ethernet Router for under $30k, is this possible?  Yes, Juniper recently announced the MX80 5G, 10G and 40G bundles, which are really 20G, 40G and 60G respectively and all are upgradeable the next model with license keys.

The under $30k model (MX-80-5G) comes with redundant AC or DC Power Supplies (same price), a 20Port 1G-SFP fiber MIC in Slot 1 (2^nd slot is license key active), JUNOS WW, License for full Scale L3 route and L3 VPN, VLAN queuing, and JFlow.   In fact, if you suppose the chassis with 1 power supply is FREE, you would be still getting $101,500 of hardware and software for under $30k LIST.  Yes LIST.

Who’s buying these routers?  IOCs and Enterprises for core routers, Tier II ILECS and Service Providers for a reasonable edge router.   Need 2 ports of 10G?  No problem.  Upgrade to the 40G model and add a 2 port 10G MIC. List price for all of that is only $62,500.   The Cisco ASR1002 better beware.  Most people I talk to compare the 5G Cisco versions only to find out the MX 5G are actually 20G and run in hardware at line rate.

At enfoPoint, the demand for these has grown exponentially.  We have several demo units and would like to get your company / organization one next .

Jess Lubert, CFA, Senior Analyst

Sector Rating: Data Networking & Wireline Equipment, Overweight

Event: Today, Verizon announced plans to begin deploying 100G technology in select US markets by end of second quarter 2011.

Impact: This announcement comes sooner than we had anticipated and appears to confirm Ciena and Juniper as the lead vendors for Verizon’s 100G deployment. Though Verizon previously deployed 100G in Europe (Paris-Frankfurt) using both Ciena and Juniper, we had anticipated a later start to the 100G build in the US with 40G temporarily filling in the gaps. However, with Verizon now expecting to begin deploying 100G across several US routes (Chicago-New York, Sacramento-LA, and Minneapolis-KC), we believe Verizon and other carriers faced with surging traffic volumes (particularly from mobile and video) may be accelerating network upgrade plans. We believe this bodes particularly well for Ciena, the leading provider of coherent 100G transport technology, as well as for Juniper, following recent upgrades to its router portfolio.

Fee: Boot Camp is FREE for Service Provider engineering staff Seating is limited. Please make your reservation today.

https://spreadsheets.google.com/viewform?formkey=dHlJZlhvSW5sRy1XY2FoaGxWWW1Hbnc6MA

By Robert E. McFarlane, Contributor

SearchDataCenter.com

http://enfopoint.com/category/resources/junos-configurations

Juniper on Monday debuted a new portfolio of products and services designed to help mobile service providers optimize their network delivery and generate new services revenue. Among the major releases is its long-awaited mobile packet core, dubbed MobileNext. Described by Juniper as “the industry’s first open mobile core,” it’s been in development for the past few years as Project Falcon.

Juniper made the announcements in line with Mobile World Congress, taking place this week in Barcelona. With billions of smartphones and machine-to-machine devices expected by 2020, Juniper is among vendors looking to offer a combined portfolio of IPand mobile technologies, from core networking to consumer services, designed to ease the mobile traffic burdens.

Among this debuts are Juniper MobileNext, a mobile packet core with an open, programmable platform, and the true name of Juniper’s oft-mentioned Project Falcon. MobileNext offers 2G/3G and Long Term Evolution (LTE) evolved packet core functions using the MobileNext Broadband Gateway, MobileNext Control Gatewayand MobileNext Policy Manager.

The Broadband Gateway itself is software implemented on Juniper’s MX 3D universal edge routers. The MobileNext Control Gateway, by contrast, is a standalone appliance that manages MobileNext’s signaling. The Policy Manager, also software, is what controls policy and charging rules function (PCRF) for LTE. All will be generally available by mid-2011, according to Juniper.

Beyond the MobileNext offering is MobileNext Consumer Services — providing simultaneous 2G/3G and LTE services — and a suite called MobileNext Business Services, which combines APN technology with an operator’s network via an SSL VPN with Juniper’s Junos Pulse platform, allowing secure connectivity by corporate users with mobile devices.

Deeper into the portfolio is Juniper’s Service Delivery Gateway software, which also sits on the MX 3Ds. The Service Delivery Gateway combines various IP functions such as carrier-grade network address translation (NAT), video optimization, applicationload balancing and dynamic subscriber awareness into a single Junos platform — something Juniper says can save service providers 36 percent total cost of ownership because they don’t have to buy point products for each function.

Other debuts this week include an expansion of Juniper’s Media Flow Solution with integrated video optimization from Openwave Systems, and added security for Junos Pulse, including anti-virus, anti-spam, malware protection, remote device lock and other functions.

Juniper further debuted a set of Mobile Internet Professional Services, including LTE and IPv6 readiness assessments and mobile video optimization. All will help service providers more easily migrate to LTE, according to Juniper.

Wendy Cartee, vice president of marketing at Juniper, described the product rollouts as helping service providers optimize their networks while also creating greater services revenue.

“This is to help mobile operators monetize the smartphone revolution,” Cartee told CRN Monday. “They need to upgrade their infrastructures or provide more bandwidth and performance. But it’s also reducing cost, and building a network that is IP-centric, with everything from netbooks to laptops to phones now wireless.”

For Juniper’s partner ecosystem, there’s an increasingly relevant play around software development for mobile infrastructure using Juniper’s Junos platform and its various pieces.

MobileNext, for example, incorporates Juniper’s Junos SDK to enable operators to develop applications and also work with third-party developers — who can develop on Junos via the Junos Space piece — to add services, Cartee explained.

“Imagine you’re a mobile operator and you have a pipeline full of innovation that will potentially never run out,” she said. “What we’ve seen in the smartphone era is applications that can be downloaded on the fly. And mobile operators are very cost sensitive — they need to drive down costs in the network, and performance and scale are very important to them.”

Cartee emphasized security services, but also carrier-grade NAT, parental controls and financial transactions, such as e-banking, as examples of the types of services a flexible platform will better enable.

“A fully programmable platform drives a business model,” she said.

ethernet-switching-options {
    analyzer VPNtranet {
        ratio 1;
        loss-priority low;
        input {
            ingress {
                interface ge-1/0/21.0;
            }
            egress {
                interface ge-1/0/22.0;
            }
        }
        output {
            interface {
                ge-1/0/23.0;
            }
        }
    }
}

Download this config here.

forwarding-options {
    helpers {
        bootp {
            interface {
                vlan.101 {
                    server 10.216.221.54;
                    server 10.223.33.23;
                }
            }
        }
    }
}

Download this config here.

presented by enfoPoint Solutions

The Juniper Networks JUNOS Boot Camp presented by enfoPoint Solutions is a one-day immersion training session at no cost for Service Provider engineering and technical staff on the unique performance and scalability of the Juniper JUNOS operating system.

Learn more about how you can leverage the JUNOS power of one operating system, one release train, and one modular architecture integrated across routing, switching, security, and services to reduce complexity, increase availability, lower costs and deploy services more quickly. You will gain an understanding of the advantages of JUNOS, and the knowledge to work with and configure devices running JUNOS.

enfoPoint is the fastest-growing Juniper Service Provider Infrastructure Elite-Certified Partner. enfoPoint solves complex business problems for Service Providers by providing network architecture, implementation and support expertise to drive new client business, support organic growth of your existing clients, fast deployment of new services and prepare for your clients’ migration to cloud computing.

Fee: Boot Camp is free for Service Provider engineering staff Seating is limited. Please make your reservation today – Click Here!

Juniper JUNOS Boot Camp Curriculum

9:00AM – Noon Course Introduction JUNOS Overview Introduction to the JUNOS CLI

Advantages of the JUNOS CLI

Noon – 1:00PM: Lunch

1:00PM – 5:00PM Interface Configuration Routing with JUNOS OSPF on JUNOS BGP on JUNOS Conclusion

Wednesday, April 6, 2011

Juniper Executive Briefing Center 10 Technology Park Drive Westford, MA 01886

For more information, please contact Rikk at 617.500.4409 or email rikk@enfopoint.com.

forwarding-options {
    helpers {
        bootp {
            interface {
                vlan.2 {
                    server 192.168.215.10;
                    vpn;    <---- may be required if the DHCP is located on remote side of tunnel
                }
                vlan.3 {
                    server 192.168.215.10;
                    vpn;
                }
                vlan.4 {
                    server 192.168.215.10;
                    vpn;
                }
                vlan.24 {
                    server 192.168.215.10;
                }
                vlan.23 {
                    server 192.168.215.10;
                }
                vlan.22 {
                    server 192.168.215.10;
                }
                vlan.14 {
                    server 208.90.136.110;
                }
                vlan.13 {
                    server 208.90.136.110;
                }
                vlan.12 {
                    server 208.90.136.110;
                }
            }
        }
    }
}

Download this config here.

Industry’s First Integrated Offering to Provide Security at Scale for Physical and Virtual Network Environments

SUNNYVALE, Calif. — Feb. 14, 2011 — Juniper Networks (NYSE: JNPR) today announced the integration of its new Juniper Networks® vGW Virtual Gateway with the Juniper Networks SRX Series Services Gateways to provide a consistent, virtualization-aware solution for private and public cloud deployments. This milestone marks the first step with Juniper’s acquisition of Altor in December 2010 in a multi-phased strategy to combine best-in-class products for both physical and virtual network environments and provide a comprehensive, automated approach for data center security.

Prior to the acquisition, Juniper and Altor partnered for several years to bring deep expertise to a dynamic threat landscape that requires enterprises to push beyond purely physical security layers. The Juniper Networks vGW Virtual Gateway is a first-of-its-kind product that offers organizations access to robust, comprehensive security optimized for high performance, flexibility and scale in virtualized environments.

With security and trust as primary concerns in enterprise cloud adoption, Juniper’s integrated solution enables a secure enterprise architecture through the isolation of virtual machines (VMs) and visibility into VM traffic layers. This differentiated approach enables comprehensive security and assurance that multiple VMs within a virtualized environment remain secure and isolated. Additionally, vGW security automation simplifies corporate and regulatory compliance oversight by regulating the creation and movement of VMs virtual environments.

“Enterprises building private clouds and public cloud service providers need a security solution that is consistent and pervasive across the physical and the virtualized network infrastructure,” said Douglas Murray, senior vice president and general manager, security business unit, at Juniper Networks. “The integrated SRX plus vGW solution ensures that security is maintained and enforced right down to each individual VM, while enhancing the operational efficiency of security management.”

Juniper’s SRX-vGW integration offers organizations visibility into virtualized environments by having the vGW automatically populate VM membership into Juniper SRX Zones. Key SRX-vGW benefits include:

• Zone-based smart policy groups that are automatically created on the hypervisor;
• Automated security classification and enforcement for new or cloned VMs;
• Automated VM compliance assessment based on multiple VM attributes;
• Quarantine of non-compliant VMs to eliminate administrative errors and reduce risk.

“As organizations continue to virtualize their data centers, workloads of higher sensitivity are being virtualized and the workloads themselves are becoming more mobile, challenging traditional data center security architectures which rely solely on physical appliance-based enforcement,” said Neil MacDonald, vice president and Gartner Fellow at Gartner. “It’s critical to implement a consistent way of defining and managing security policies across physical and virtual machines and delivering virtualization-awareness to security policy enforcement points, to reduce the complexity of administration.”

Availability

The Juniper Networks vGW Virtual Gateway is available now and Juniper will be showcasing live demonstrations of the SRX-vGW product integration at RSA 2011 in the Juniper Networks booth #1745. The most comprehensive forum on information security for both enterprise and technical professionals, RSA is being held February 14-18, 2011 in San Francisco.

About Juniper Networks

Juniper Networks is in the business of network innovation. From devices to data centers, from consumers to cloud providers, Juniper Networks delivers the software, silicon and systems that transform the experience and economics of networking. Additional information can be found at Juniper Networks (www.juniper.net).

Juniper Networks and Junos are registered trademarks of Juniper Networks, Inc. in the United States and other countries. The Juniper Networks and Junos logos are trademarks of Juniper Networks, Inc. All other trademarks, service marks, registered trademarks, or registered service marks are the property of their respective owners