Risk
7/25/2006
11:14 AM
50%
50%

Network Security Courtesy Of A Fist Full Of Chips

Why pay tens of thousands of dollars on a firewall or other network security device when you can get comparable protection from one at a fraction of the cost? That's the promise behind security system-on-chip technology that embeds virtual private network, firewall, and other capabilities into network appliances at the silicon level, eliminating the need for the software and integrated circu

Why pay tens of thousands of dollars on a firewall or other network security device when you can get comparable protection from one at a fraction of the cost? That's the promise behind security system-on-chip technology that embeds virtual private network, firewall, and other capabilities into network appliances at the silicon level, eliminating the need for the software and integrated circuits that make security appliances more expensive and generate more heat in your data center.Security system-on-chip technology gives a network appliance the information it needs at the silicon layer to identify and/or block suspicious packets. Although such chips are only offered by a handful of companies worldwide, these visionaries are beginning to spread the word that cheaper network devices that run cooler means security pros can buy and implement more of them and better protect their networks. As security system-on-chip technology progresses, it may also be used to replace security appliances altogether, allowing makers of PCs, servers, printers, and other network endpoints to embed security into these devices.

One of the most evolved security system-on-chip technologies comes from Mistletoe Technologies, which is finding network appliance makers to embed its RDX chips within their devices to provide VPN and firewall capabilities. By the end of September, Taiwan-based network security provider BroadWeb Corp. will begin shipping its new Zone Defender appliance throughout Asia as a way for companies in that region to encrypt data sent over a LAN without slowing the flow of data across the network. Mistletoe's RDX chip adds VPN and firewall capabilities. BroadWeb sells its own security system-on-chip technology, which it calls Orion, to makers of intrusion prevention system, anti-virus, universal threat management, and security content management appliances. But it was faster for BroadWeb to license Mistletoe's VPN/firewall chip than to develop its own.

Whereas a more conventional firewall--one that relies on software to do the firewall activities and is powered by an Intel chip that sends traffic through at gigabit-per-second speeds--can cost about $20,000, Mistletoe's more simplified design can deliver comparable capabilities for about $1,000, says Gartner VP John Pescatore, adding, "Mistletoe has come out with a firewall chip essentially, with the idea of allowing networking companies to sell firewalls at an inexpensive price."

Lawrence Berkeley National Laboratory, the oldest of the Energy Department's national labs, has deployed two Mistletoe-based VPN/firewall appliances made by Viking Interworks, a division of Sanmina-SCI Corp., to help secure a portion of the lab's network. Security system-on-chip has the ability to change the price/performance ratio that has restricted the lab's deployment of gigabit-per-second network security appliances. "With firewalls, it's like buying a car," says Mike Bennett, senior network engineer with Berkeley Lab's LBLnet, the network that provides the enterprise LAN connectivity and infrastructure for Berkeley Lab. "If you spend only a little money, you're going to get a low level of performance." Not a good situation, given that the future of network security will depend on organizations using appliances that provide deeper inspection of network traffic while moving that traffic along at gigabit-per-second speeds.

Mistletoe's VPN/firewall processors are available in four different speeds, and the company is developing chips that can be used in unified threat management devices to build in anti-virus, intrusion detection and prevention, and VPN/firewall capabilities.

Mistletoe, which was founded in December 2002, has received $25 million in funding from the likes of Sevin Rosen Funds, Worldview Technology Partners, and Incubic Venture Capital.

Yet for the technology to have its greatest impact, Mistletoe and other security system-on-chip makers must convince large networking equipment providers such as Extreme Networks and Nortel that this model gives them an edge in competing with the likes of Cisco and Juniper. Only when the big boys see this technology as a must-have will it make a dent in the thousands and thousands of network security devices currently in use.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-8148
Published: 2015-01-26
The default D-Bus access control rule in Midgard2 10.05.7.1 allows local users to send arbitrary method calls or signals to any process on the system bus and possibly execute arbitrary code with root privileges.

CVE-2014-8157
Published: 2015-01-26
Off-by-one error in the jpc_dec_process_sot function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted JPEG 2000 image, which triggers a heap-based buffer overflow.

CVE-2014-8158
Published: 2015-01-26
Multiple stack-based buffer overflows in jpc_qmfb.c in JasPer 1.900.1 and earlier allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted JPEG 2000 image.

CVE-2014-9571
Published: 2015-01-26
Cross-site scripting (XSS) vulnerability in admin/install.php in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote attackers to inject arbitrary web script or HTML via the (1) admin_username or (2) admin_password parameter.

CVE-2014-9572
Published: 2015-01-26
MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 does not properly restrict access to /*/install.php, which allows remote attackers to obtain database credentials via the install parameter with the value 4.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
If you’re a security professional, you’ve probably been asked many questions about the December attack on Sony. On Jan. 21 at 1pm eastern, you can join a special, one-hour Dark Reading Radio discussion devoted to the Sony hack and the issues that may arise from it.