Risk
7/25/2006
11:14 AM
50%
50%

Network Security Courtesy Of A Fist Full Of Chips

Why pay tens of thousands of dollars on a firewall or other network security device when you can get comparable protection from one at a fraction of the cost? That's the promise behind security system-on-chip technology that embeds virtual private network, firewall, and other capabilities into network appliances at the silicon level, eliminating the need for the software and integrated circu

Why pay tens of thousands of dollars on a firewall or other network security device when you can get comparable protection from one at a fraction of the cost? That's the promise behind security system-on-chip technology that embeds virtual private network, firewall, and other capabilities into network appliances at the silicon level, eliminating the need for the software and integrated circuits that make security appliances more expensive and generate more heat in your data center.Security system-on-chip technology gives a network appliance the information it needs at the silicon layer to identify and/or block suspicious packets. Although such chips are only offered by a handful of companies worldwide, these visionaries are beginning to spread the word that cheaper network devices that run cooler means security pros can buy and implement more of them and better protect their networks. As security system-on-chip technology progresses, it may also be used to replace security appliances altogether, allowing makers of PCs, servers, printers, and other network endpoints to embed security into these devices.

One of the most evolved security system-on-chip technologies comes from Mistletoe Technologies, which is finding network appliance makers to embed its RDX chips within their devices to provide VPN and firewall capabilities. By the end of September, Taiwan-based network security provider BroadWeb Corp. will begin shipping its new Zone Defender appliance throughout Asia as a way for companies in that region to encrypt data sent over a LAN without slowing the flow of data across the network. Mistletoe's RDX chip adds VPN and firewall capabilities. BroadWeb sells its own security system-on-chip technology, which it calls Orion, to makers of intrusion prevention system, anti-virus, universal threat management, and security content management appliances. But it was faster for BroadWeb to license Mistletoe's VPN/firewall chip than to develop its own.

Whereas a more conventional firewall--one that relies on software to do the firewall activities and is powered by an Intel chip that sends traffic through at gigabit-per-second speeds--can cost about $20,000, Mistletoe's more simplified design can deliver comparable capabilities for about $1,000, says Gartner VP John Pescatore, adding, "Mistletoe has come out with a firewall chip essentially, with the idea of allowing networking companies to sell firewalls at an inexpensive price."

Lawrence Berkeley National Laboratory, the oldest of the Energy Department's national labs, has deployed two Mistletoe-based VPN/firewall appliances made by Viking Interworks, a division of Sanmina-SCI Corp., to help secure a portion of the lab's network. Security system-on-chip has the ability to change the price/performance ratio that has restricted the lab's deployment of gigabit-per-second network security appliances. "With firewalls, it's like buying a car," says Mike Bennett, senior network engineer with Berkeley Lab's LBLnet, the network that provides the enterprise LAN connectivity and infrastructure for Berkeley Lab. "If you spend only a little money, you're going to get a low level of performance." Not a good situation, given that the future of network security will depend on organizations using appliances that provide deeper inspection of network traffic while moving that traffic along at gigabit-per-second speeds.

Mistletoe's VPN/firewall processors are available in four different speeds, and the company is developing chips that can be used in unified threat management devices to build in anti-virus, intrusion detection and prevention, and VPN/firewall capabilities.

Mistletoe, which was founded in December 2002, has received $25 million in funding from the likes of Sevin Rosen Funds, Worldview Technology Partners, and Incubic Venture Capital.

Yet for the technology to have its greatest impact, Mistletoe and other security system-on-chip makers must convince large networking equipment providers such as Extreme Networks and Nortel that this model gives them an edge in competing with the likes of Cisco and Juniper. Only when the big boys see this technology as a must-have will it make a dent in the thousands and thousands of network security devices currently in use.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, January 2015
To find and fix exploits aimed directly at your business, stop waiting for alerts and become a proactive hunter.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-5437
Published: 2014-12-17
Multiple cross-site request forgery (CSRF) vulnerabilities in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) enable remote management via a request to remote_management.php,...

CVE-2014-5438
Published: 2014-12-17
Cross-site scripting (XSS) vulnerability in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allows remote authenticated users to inject arbitrary web script or HTML via the computer_name parameter to connected_devices_computers_edit.php.

CVE-2014-7285
Published: 2014-12-17
The management console on the Symantec Web Gateway (SWG) appliance before 5.2.2 allows remote authenticated users to execute arbitrary OS commands by injecting command strings into unspecified PHP scripts.

CVE-2014-7880
Published: 2014-12-17
Multiple unspecified vulnerabilities in the POP implementation in HP OpenVMS TCP/IP 5.7 before ECO5 allow remote attackers to cause a denial of service via unspecified vectors.

CVE-2014-8133
Published: 2014-12-17
arch/x86/kernel/tls.c in the Thread Local Storage (TLS) implementation in the Linux kernel through 3.18.1 allows local users to bypass the espfix protection mechanism, and consequently makes it easier for local users to bypass the ASLR protection mechanism, via a crafted application that makes a set...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.