Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

7/25/2006
11:14 AM
50%
50%

Network Security Courtesy Of A Fist Full Of Chips

Why pay tens of thousands of dollars on a firewall or other network security device when you can get comparable protection from one at a fraction of the cost? That's the promise behind security system-on-chip technology that embeds virtual private network, firewall, and other capabilities into network appliances at the silicon level, eliminating the need for the software and integrated circu

Why pay tens of thousands of dollars on a firewall or other network security device when you can get comparable protection from one at a fraction of the cost? That's the promise behind security system-on-chip technology that embeds virtual private network, firewall, and other capabilities into network appliances at the silicon level, eliminating the need for the software and integrated circuits that make security appliances more expensive and generate more heat in your data center.Security system-on-chip technology gives a network appliance the information it needs at the silicon layer to identify and/or block suspicious packets. Although such chips are only offered by a handful of companies worldwide, these visionaries are beginning to spread the word that cheaper network devices that run cooler means security pros can buy and implement more of them and better protect their networks. As security system-on-chip technology progresses, it may also be used to replace security appliances altogether, allowing makers of PCs, servers, printers, and other network endpoints to embed security into these devices.

One of the most evolved security system-on-chip technologies comes from Mistletoe Technologies, which is finding network appliance makers to embed its RDX chips within their devices to provide VPN and firewall capabilities. By the end of September, Taiwan-based network security provider BroadWeb Corp. will begin shipping its new Zone Defender appliance throughout Asia as a way for companies in that region to encrypt data sent over a LAN without slowing the flow of data across the network. Mistletoe's RDX chip adds VPN and firewall capabilities. BroadWeb sells its own security system-on-chip technology, which it calls Orion, to makers of intrusion prevention system, anti-virus, universal threat management, and security content management appliances. But it was faster for BroadWeb to license Mistletoe's VPN/firewall chip than to develop its own.

Whereas a more conventional firewall--one that relies on software to do the firewall activities and is powered by an Intel chip that sends traffic through at gigabit-per-second speeds--can cost about $20,000, Mistletoe's more simplified design can deliver comparable capabilities for about $1,000, says Gartner VP John Pescatore, adding, "Mistletoe has come out with a firewall chip essentially, with the idea of allowing networking companies to sell firewalls at an inexpensive price."

Lawrence Berkeley National Laboratory, the oldest of the Energy Department's national labs, has deployed two Mistletoe-based VPN/firewall appliances made by Viking Interworks, a division of Sanmina-SCI Corp., to help secure a portion of the lab's network. Security system-on-chip has the ability to change the price/performance ratio that has restricted the lab's deployment of gigabit-per-second network security appliances. "With firewalls, it's like buying a car," says Mike Bennett, senior network engineer with Berkeley Lab's LBLnet, the network that provides the enterprise LAN connectivity and infrastructure for Berkeley Lab. "If you spend only a little money, you're going to get a low level of performance." Not a good situation, given that the future of network security will depend on organizations using appliances that provide deeper inspection of network traffic while moving that traffic along at gigabit-per-second speeds.

Mistletoe's VPN/firewall processors are available in four different speeds, and the company is developing chips that can be used in unified threat management devices to build in anti-virus, intrusion detection and prevention, and VPN/firewall capabilities.

Mistletoe, which was founded in December 2002, has received $25 million in funding from the likes of Sevin Rosen Funds, Worldview Technology Partners, and Incubic Venture Capital.

Yet for the technology to have its greatest impact, Mistletoe and other security system-on-chip makers must convince large networking equipment providers such as Extreme Networks and Nortel that this model gives them an edge in competing with the likes of Cisco and Juniper. Only when the big boys see this technology as a must-have will it make a dent in the thousands and thousands of network security devices currently in use.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Commentary
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-30477
PUBLISHED: 2021-04-15
An issue was discovered in Zulip Server before 3.4. A bug in the implementation of replies to messages sent by outgoing webhooks to private streams meant that an outgoing webhook bot could be used to send messages to private streams that the user was not intended to be able to send messages to.
CVE-2021-30478
PUBLISHED: 2021-04-15
An issue was discovered in Zulip Server before 3.4. A bug in the implementation of the can_forge_sender permission (previously is_api_super_user) resulted in users with this permission being able to send messages appearing as if sent by a system bot, including to other organizations hosted by the sa...
CVE-2021-30479
PUBLISHED: 2021-04-15
An issue was discovered in Zulip Server before 3.4. A bug in the implementation of the all_public_streams API feature resulted in guest users being able to receive message traffic to public streams that should have been only accessible to members of the organization.
CVE-2021-30487
PUBLISHED: 2021-04-15
In the topic moving API in Zulip Server 3.x before 3.4, organization administrators were able to move messages to streams in other organizations hosted by the same Zulip installation.
CVE-2020-36288
PUBLISHED: 2021-04-15
The issue navigation and search view in Jira Server and Data Center before version 8.5.12, from version 8.6.0 before version 8.13.4, and from version 8.14.0 before version 8.15.1 allows remote attackers to inject arbitrary HTML or JavaScript via a DOM Cross-Site Scripting (XSS) vulnerability caused ...