Comments on: Response to Assertions Made by Blue Coat About the ISA Firewall http://blogs.isaserver.org/shinder/2006/02/27/response-assertions-made-by-blue-coat-about-the-isa-firewall/ Written by Dr Thomas W Shinder, consultant to Microsoft, HP and many Fortune 500 companies on ISA firewall and Web proxy deployments this blog is where administrators get information about ISA Server Universal Threat Management firewalls. Topics include how to manage, deploy, and troubleshoot ISA Server as a network firewall, Web proxy/Web cache, remote access VPN server and VPN gateway to provide a high level of network security for all corporate computers. Sat, 22 Nov 2008 12:44:57 +0000 http://wordpress.org/?v=MU by: JTIN http://blogs.isaserver.org/shinder/2006/02/27/response-assertions-made-by-blue-coat-about-the-isa-firewall/#comment-214163 Wed, 29 Oct 2008 01:55:59 +0000 http://blogs.isaserver.org/shinder/2006/02/27/response-assertions-made-by-blue-coat-about-the-isa-firewall/#comment-214163 Did anyone have to patch all their servers over the weekend for the critical MS patch? I had a customer have to patch all 700+ servers over the weekend and many of them had problems rebooting. Imagine if that was your ISA proxy farm? BTW, we have large school district which is running 32+ ISA servers for over 1Million students 400-600mbit thruput. These can be consolidated down to 6x ProsgSG8100-20s. Did anyone have to patch all their servers over the weekend for the critical MS patch?
I had a customer have to patch all 700+ servers over the weekend and many of them had problems rebooting.
Imagine if that was your ISA proxy farm?

BTW, we have large school district which is running 32+ ISA servers for over 1Million students 400-600mbit thruput. These can be consolidated down to 6x ProsgSG8100-20s.

]]> by: Thomas Shinder http://blogs.isaserver.org/shinder/2006/02/27/response-assertions-made-by-blue-coat-about-the-isa-firewall/#comment-202779 Fri, 15 Aug 2008 12:35:15 +0000 http://blogs.isaserver.org/shinder/2006/02/27/response-assertions-made-by-blue-coat-about-the-isa-firewall/#comment-202779 You also don't see any KB articles telling you not to chew on broken glass :) The fact is, if the exploit cannot be exploited, does it matter that it's there? If you're deep under thunder mountain, does a atom bomb matter? Just because there is a possbile underlying weakness, doesn't mean it can be exploited if that weakness is protected from. That's what the ISA firewall does, and thus, makes the exploits more theoretical and exploitable. Also, pay close attention to what I said about the SDL. Companies like Blue Coat skate away from being beholden to any kind of SDL or formal security review. Why? They claim that their devices are not security devices! Now, think about that before considering a Blue Coat box before an ISA firewall. However, if you *need* features that BC provides that the ISA firewall doesn't, it doesn't make any sense to get an ISA firewall. However, if the ISA firewall does have all the features you require, it would be insane (certifiable) to buy a BC box when you can buy several ISA firewalls for the same price. HTH, Tom You also don’t see any KB articles telling you not to chew on broken glass :)

The fact is, if the exploit cannot be exploited, does it matter that it’s there? If you’re deep under thunder mountain, does a atom bomb matter? Just because there is a possbile underlying weakness, doesn’t mean it can be exploited if that weakness is protected from. That’s what the ISA firewall does, and thus, makes the exploits more theoretical and exploitable.

Also, pay close attention to what I said about the SDL. Companies like Blue Coat skate away from being beholden to any kind of SDL or formal security review. Why? They claim that their devices are not security devices! Now, think about that before considering a Blue Coat box before an ISA firewall.

However, if you *need* features that BC provides that the ISA firewall doesn’t, it doesn’t make any sense to get an ISA firewall. However, if the ISA firewall does have all the features you require, it would be insane (certifiable) to buy a BC box when you can buy several ISA firewalls for the same price.

HTH,
Tom

]]> by: George698 http://blogs.isaserver.org/shinder/2006/02/27/response-assertions-made-by-blue-coat-about-the-isa-firewall/#comment-202773 Fri, 15 Aug 2008 12:20:02 +0000 http://blogs.isaserver.org/shinder/2006/02/27/response-assertions-made-by-blue-coat-about-the-isa-firewall/#comment-202773 Tom, I don't see any advice coming from Microsoft which says "If you're running ISA on Windows 2003 server then you don't need to bother applying security patches" Maybe I've missed this? Tom, I don’t see any advice coming from Microsoft which says “If you’re running ISA on Windows 2003 server then you don’t need to bother applying security patches” Maybe I’ve missed this?

]]> by: Thomas Shinder http://blogs.isaserver.org/shinder/2006/02/27/response-assertions-made-by-blue-coat-about-the-isa-firewall/#comment-202439 Thu, 14 Aug 2008 13:35:53 +0000 http://blogs.isaserver.org/shinder/2006/02/27/response-assertions-made-by-blue-coat-about-the-isa-firewall/#comment-202439 That's not true. If those vulnerabilities cannot be exploited, it doesn't matter. The key take home message here is that the ISA firewall protects the underlying operating system. There must be a vulnerability in the ISA firewall software before any vulnerabilities in the underlying operating system can be exploited. That is the key differentiator and the reason why we don't really need to consider the operating system issues. The fact that Blue Coat and other so-called "hardware" solutions have many more vulnerabilities than the ISA firewall is significant. Why? Because MS is under the microscope and if there is a problem, someone is going to find it and try to get famous for it. And Microsoft is going to fix it fast. In contrast, there are relatively few Blue Coat devices out there, and they're deployed in large environments. Why waste your efforts on getting famous? Put the Blue Coat and Netapp exploits up for sale on the black market, and make money, instead of fame from them. And I think it's safe to assume that Blue Coat's secure development practices are not nearly as sophisticated and codified as Microsoft's. Microsoft has thoroughly documented their SDL and the impact the SDL has had in secure software development has been significant. Blue Coat doesn't publish their secure software development policies and practices. If for no other reason, secure development practices and responses are the reason to go with a Windows based ISA firewall. HTH, Tom That’s not true. If those vulnerabilities cannot be exploited, it doesn’t matter. The key take home message here is that the ISA firewall protects the underlying operating system. There must be a vulnerability in the ISA firewall software before any vulnerabilities in the underlying operating system can be exploited. That is the key differentiator and the reason why we don’t really need to consider the operating system issues.

The fact that Blue Coat and other so-called “hardware” solutions have many more vulnerabilities than the ISA firewall is significant. Why? Because MS is under the microscope and if there is a problem, someone is going to find it and try to get famous for it. And Microsoft is going to fix it fast.

In contrast, there are relatively few Blue Coat devices out there, and they’re deployed in large environments. Why waste your efforts on getting famous? Put the Blue Coat and Netapp exploits up for sale on the black market, and make money, instead of fame from them.

And I think it’s safe to assume that Blue Coat’s secure development practices are not nearly as sophisticated and codified as Microsoft’s. Microsoft has thoroughly documented their SDL and the impact the SDL has had in secure software development has been significant. Blue Coat doesn’t publish their secure software development policies and practices. If for no other reason, secure development practices and responses are the reason to go with a Windows based ISA firewall.

HTH,
Tom

]]> by: George698 http://blogs.isaserver.org/shinder/2006/02/27/response-assertions-made-by-blue-coat-about-the-isa-firewall/#comment-202407 Thu, 14 Aug 2008 10:44:22 +0000 http://blogs.isaserver.org/shinder/2006/02/27/response-assertions-made-by-blue-coat-about-the-isa-firewall/#comment-202407 I do not have any affiliation with either manufacturer but I have used Netapp (now discontinued), Bluecoat and ISA proxies in an Enterprise environment for a number of years. Given the choice I would use Bluecoat or Netapp any time over ISA. The fact is that ISA, (or to be clear it\'s normally the windows 2003 server os) needs to have updates applied a lot more often which causes risk, downtime, cost, bad user experience etc. Our proxies are in use 24x7 and we find that the Netapp and Bluecoat proxies do not need to be updated nearly so often. We review the vulnerabilities of each product and make a decision whether or not to apply any updates. With Microsoft windows server, more often then not the risk is too great given the dominance of the product on the market. The threat could come from the internal network, not necessarily out on the internet. When people list vulnerabilities, it is misleading to list ISA server vulnerabilities in isolation without including windows server vulnerabilities. (unless you are referring to an ISA appliance which may need less updates, but I don’t have experience of these) I do not have any affiliation with either manufacturer but I have used Netapp (now discontinued), Bluecoat and ISA proxies in an Enterprise environment for a number of years. Given the choice I would use Bluecoat or Netapp any time over ISA. The fact is that ISA, (or to be clear it\’s normally the windows 2003 server os) needs to have updates applied a lot more often which causes risk, downtime, cost, bad user experience etc. Our proxies are in use 24×7 and we find that the Netapp and Bluecoat proxies do not need to be updated nearly so often. We review the vulnerabilities of each product and make a decision whether or not to apply any updates. With Microsoft windows server, more often then not the risk is too great given the dominance of the product on the market. The threat could come from the internal network, not necessarily out on the internet. When people list vulnerabilities, it is misleading to list ISA server vulnerabilities in isolation without including windows server vulnerabilities. (unless you are referring to an ISA appliance which may need less updates, but I don’t have experience of these)

]]> by: JimmyJoeBobAlooba http://blogs.isaserver.org/shinder/2006/02/27/response-assertions-made-by-blue-coat-about-the-isa-firewall/#comment-174710 Thu, 17 Apr 2008 13:59:59 +0000 http://blogs.isaserver.org/shinder/2006/02/27/response-assertions-made-by-blue-coat-about-the-isa-firewall/#comment-174710 (for "packetstorm" - an interesting nome de plume for a flood of FUD, IMHO) Qualifier: I am an avowed ISA proponent. Contrary to common misconception, the original ISA team was not, in fact "from Checkpoint". We'll save the history lesson for later, but accept that as fact. Has Microsoft gained people from competitors; absolutely - this is called "hiring good talent". Please don't engage in the "if they already had the right people" game. Microsoft HR rules discourage breeding with co-workers; particularly during working hours. You're welcome to express your opinion. The problem with your postings are twofold: 1. you approach what is clearly an ISA community with "ISA couldn't find a packet in its pocket (with a pig on a rocket)" tone and expect to be taken seriously? Please; this is silly at best. You'll discover if you provide reasoned thoughts and responses, that the folks here are typically more than willing to engage in factual debate. When you approach with assertions such as "I've been in firewalls since before ISA was born!!", well; you've been there already, haven't you? 2. No one (who knows firewall history) argues that ISA is a relative latecomer to the firewall / proxy game. Offering this as proof of anything other than temproal distinction is worthless. Regurgitating this point as "proof of insufficiency" merely generates yet another ping in an already noisy echo chamber. What you seem to overlook (or perhaps lack as knowledge) is that ISA has in fact proven itself to be a serious player in the edge protection space. There are plenty of customers who not only use ISA as their preferred edge firewall, but have in fact used it to replace their Cisco, CheckPoint, etc. devices (and frequently, the intractable admins). While it's true that ISA 2000 had some vulnerabilities (some of these shared by such "old firewalls" as Checkpoint & Cisco, mind you), neither ISA 2004 nor ISA 2006 have had any reported (much less exploited) vulnerabilites. Neither Cisco nor ChekPoint can truthfully make this claim. 3. Likewise, no one herein will argue that the common anti-Microsoft party-line is "Microsoft can't make secure products" (shall we do a point--by-point comparison yet again?). The fact is, that all firewall vendors have a history of patches. If you make the (not at all uncommon) statement that "I never have to patch my firewall", then you're more dangerous than any "weak technology". All firewalls since ~2000 are layered software offerings, and of late, are based on some form of hardened OS; be it Linux, Unix or Windows. Thus, the "hardware vs. software" argument is completely moot and serves only to illustrate the proponent's lack of current knowledge in this space. 4. You make such statements as "fail miserably", yet fail completely to shore these statements with anything approaching demonstrable fact. What tests have you (or someone you reference) performed on which you base these statements? If you have proof, by all means offer it up for review and comment. It's this sort of "grey-beard ponytail guy" (props to Steve Riley) thinking that keeps some customers running on their original-issue unpatched devices. Even ISA 2000 has seen its day. Likewise, Cisco & Checkpoint have met the new threats with changes in their devices. Any product that doesn't meet them dies - simple as that. Jim (for “packetstorm” - an interesting nome de plume for a flood of FUD, IMHO)

Qualifier: I am an avowed ISA proponent.

Contrary to common misconception, the original ISA team was not, in fact “from Checkpoint”. We’ll save the history lesson for later, but accept that as fact. Has Microsoft gained people from competitors; absolutely - this is called “hiring good talent”. Please don’t engage in the “if they already had the right people” game. Microsoft HR rules discourage breeding with co-workers; particularly during working hours.

You’re welcome to express your opinion. The problem with your postings are twofold:
1. you approach what is clearly an ISA community with “ISA couldn’t find a packet in its pocket (with a pig on a rocket)” tone and expect to be taken seriously? Please; this is silly at best. You’ll discover if you provide reasoned thoughts and responses, that the folks here are typically more than willing to engage in factual debate. When you approach with assertions such as “I’ve been in firewalls since before ISA was born!!”, well; you’ve been there already, haven’t you?

2. No one (who knows firewall history) argues that ISA is a relative latecomer to the firewall / proxy game. Offering this as proof of anything other than temproal distinction is worthless. Regurgitating this point as “proof of insufficiency” merely generates yet another ping in an already noisy echo chamber. What you seem to overlook (or perhaps lack as knowledge) is that ISA has in fact proven itself to be a serious player in the edge protection space. There are plenty of customers who not only use ISA as their preferred edge firewall, but have in fact used it to replace their Cisco, CheckPoint, etc. devices (and frequently, the intractable admins). While it’s true that ISA 2000 had some vulnerabilities (some of these shared by such “old firewalls” as Checkpoint & Cisco, mind you), neither ISA 2004 nor ISA 2006 have had any reported (much less exploited) vulnerabilites. Neither Cisco nor ChekPoint can truthfully make this claim.

3. Likewise, no one herein will argue that the common anti-Microsoft party-line is “Microsoft can’t make secure products” (shall we do a point–by-point comparison yet again?). The fact is, that all firewall vendors have a history of patches. If you make the (not at all uncommon) statement that “I never have to patch my firewall”, then you’re more dangerous than any “weak technology”. All firewalls since ~2000 are layered software offerings, and of late, are based on some form of hardened OS; be it Linux, Unix or Windows. Thus, the “hardware vs. software” argument is completely moot and serves only to illustrate the proponent’s lack of current knowledge in this space.

4. You make such statements as “fail miserably”, yet fail completely to shore these statements with anything approaching demonstrable fact. What tests have you (or someone you reference) performed on which you base these statements? If you have proof, by all means offer it up for review and comment.

It’s this sort of “grey-beard ponytail guy” (props to Steve Riley) thinking that keeps some customers running on their original-issue unpatched devices. Even ISA 2000 has seen its day. Likewise, Cisco & Checkpoint have met the new threats with changes in their devices. Any product that doesn’t meet them dies - simple as that.

Jim

]]> by: tshinder http://blogs.isaserver.org/shinder/2006/02/27/response-assertions-made-by-blue-coat-about-the-isa-firewall/#comment-174599 Thu, 17 Apr 2008 02:51:15 +0000 http://blogs.isaserver.org/shinder/2006/02/27/response-assertions-made-by-blue-coat-about-the-isa-firewall/#comment-174599 The error in your evaluaton is that you don't understand the ISA Firewall and have likely never deployed it properly as an edge firewall to provide superior security for your clients. I have, for dozens of clients, and I know many others who have done the same thing. You lack of expereince with the ISA Firewall, lack of understanding of the ISA Firewall's architecture, and clear "faith" in "hardware" are consistent with many I've had the pleasure to work with. The good news is that for many of those who were willing to give the ISA Firewall a chance, they ended up being very happy with the solution and couldn't believe how hapless their favorite firewalls were in meeting the security requirements for modern networks. Again, learn about the ISA Firewall, deploy it correct as an edge firewall, and I think you'll be pleasantly surprised by the results. But don't think you can just "throw on up" -- network security isn't easy, and you have a learning curve ahead of you. HTH, Tom The error in your evaluaton is that you don’t understand the ISA Firewall and have likely never deployed it properly as an edge firewall to provide superior security for your clients. I have, for dozens of clients, and I know many others who have done the same thing. You lack of expereince with the ISA Firewall, lack of understanding of the ISA Firewall’s architecture, and clear “faith” in “hardware” are consistent with many I’ve had the pleasure to work with. The good news is that for many of those who were willing to give the ISA Firewall a chance, they ended up being very happy with the solution and couldn’t believe how hapless their favorite firewalls were in meeting the security requirements for modern networks. Again, learn about the ISA Firewall, deploy it correct as an edge firewall, and I think you’ll be pleasantly surprised by the results. But don’t think you can just “throw on up” — network security isn’t easy, and you have a learning curve ahead of you.

HTH,
Tom

]]> by: Packetstorm http://blogs.isaserver.org/shinder/2006/02/27/response-assertions-made-by-blue-coat-about-the-isa-firewall/#comment-174552 Wed, 16 Apr 2008 15:34:41 +0000 http://blogs.isaserver.org/shinder/2006/02/27/response-assertions-made-by-blue-coat-about-the-isa-firewall/#comment-174552 "when evaluating products of any nature should be which one or two or three for that matter is best suited and provides the required features and security for the present scenario." i couldnt agree more, and actually i think i did write somewhere that ISA server did have its place i certain environments.. what i disputed was the issue of using the ISA server as a perimeter gateway aka. Firewall, or an appliance designed solely for that purpose. its in that assemblence i think the ISA server fails miserably. but enough said we all have our favourite toy.. and apparently som grow up faster than other “when evaluating products of any nature should be which one or two or three for that matter is best suited and provides the required features and security for the present scenario.” i couldnt agree more, and actually i think i did write somewhere that ISA server did have its place i certain environments.. what i disputed was the issue of using the ISA server as a perimeter gateway aka. Firewall, or an appliance designed solely for that purpose. its in that assemblence i think the ISA server fails miserably. but enough said we all have our favourite toy.. and apparently som grow up faster than other

]]> by: Steve Moffat http://blogs.isaserver.org/shinder/2006/02/27/response-assertions-made-by-blue-coat-about-the-isa-firewall/#comment-174544 Wed, 16 Apr 2008 11:55:33 +0000 http://blogs.isaserver.org/shinder/2006/02/27/response-assertions-made-by-blue-coat-about-the-isa-firewall/#comment-174544 "Packetstorm Says: April 15th, 2008 at 2:27 pm Lol.. youre quite far from truth my friend.. you can call ISA server, a firewall server as much as you like it doesnt change the fact that its so called “firewall architecture” is hilarous compared to a genuine firewall, im actually not stating tha BC is a firewall, it is in fact what the name states a Proxy appliance, but what i do know since i worked with checkpoint firewalls and cisco firewalls for more than 15 years, long before ISA server was even thought of… that the ISA server is NOT and never will be able to live up to the name ie. “firewall server” pfffft.. it might protect some webservers from unwanted traffic, but theres no way in Hell one could rely on a ISA server as a Perimeter gateway.. without asking for trouble, and if you cant agree with me there…. then im pretty sure my point about ignorance hit the spot right on." Steve: Where's the argument to prove what you say in your rant. You do realise that the original ISA Team were ex Checkpoint..oh and Cisco make packet filters, not firewalls.... “Packetstorm Says:

April 15th, 2008 at 2:27 pm

Lol.. youre quite far from truth my friend..

you can call ISA server, a firewall server as much as you like it doesnt change the fact that its so called “firewall architecture” is hilarous compared to a genuine firewall, im actually not stating tha BC is a firewall, it is in fact what the name states a Proxy appliance, but what i do know since i worked with checkpoint firewalls and cisco firewalls for more than 15 years, long before ISA server was even thought of… that the ISA server is NOT and never will be able to live up to the name ie. “firewall server” pfffft.. it might protect some webservers from unwanted traffic, but theres no way in Hell one could rely on a ISA server as a Perimeter gateway.. without asking for trouble, and if you cant agree with me there…. then im pretty sure my point about ignorance hit the spot right on.”

Steve: Where’s the argument to prove what you say in your rant.

You do realise that the original ISA Team were ex Checkpoint..oh and Cisco make packet filters, not firewalls….

]]> by: G http://blogs.isaserver.org/shinder/2006/02/27/response-assertions-made-by-blue-coat-about-the-isa-firewall/#comment-174523 Wed, 16 Apr 2008 07:39:45 +0000 http://blogs.isaserver.org/shinder/2006/02/27/response-assertions-made-by-blue-coat-about-the-isa-firewall/#comment-174523 Dont you guys (packetstorm) get sick of trudging out the same old spew time after time. Speaking of ignorance, it is defined as the condition of being uninformed or uneducated, lacking knowledge or information. This clearly is a description of what you have put forth so far into this discussion. Do not under estimate that Tom and others havent had extensive experience with all kinds of firewalls and security products since when moses was a boy (no offence Tom) and to say that you have worked with cisco and checkpoint for 15 years, long before ISA was around, in no way justifys your position above anyone else nor does it show the fact that ISA could not possibly be a good firewall purely because of its age or maturity as a product. ISA has most certainly developed as a product no doubt as im sure have many other products, but the real question about which one is more is more secure is a moot point really. The issue when evaluating products of any nature should be which one or two or three for that matter is best suited and provides the required features and security for the present scenario. There are many people out there who have chosen ISA in this situation and in their doing so doesnt make them wrong and you right, it just means there is a differing of opinion and circumstance. I will delcare an allegance to ISAserver.org and Tom as a collegaue however i in no way do i seek to degrade any ones opinion or mindset if stated clearly and with a basis of fact or evidence to support their arguments. I do however roll my eyes when i see people come out with statements like 'Microsoft does NOT and will NOT ever produce at firewall thats worth more that the crate its shipped in'. These kind of statements do nothing for the posters' credability and in fact show a narrowmindedness that you may be able to get away with, however if i was in the situation to be hiring someone to work along side me or run my network i would not give these people a second thought. Dont you guys (packetstorm) get sick of trudging out the same old spew time after time.

Speaking of ignorance, it is defined as the condition of being uninformed or uneducated, lacking knowledge or information. This clearly is a description of what you have put forth so far into this discussion.

Do not under estimate that Tom and others havent had extensive experience with all kinds of firewalls and security products since when moses was a boy (no offence Tom) and to say that you have worked with cisco and checkpoint for 15 years, long before ISA was around, in no way justifys your position above anyone else nor does it show the fact that ISA could not possibly be a good firewall purely because of its age or maturity as a product. ISA has most certainly developed as a product no doubt as im sure have many other products, but the real question about which one is more is more secure is a moot point really. The issue when evaluating products of any nature should be which one or two or three for that matter is best suited and provides the required features and security for the present scenario. There
are many people out there who have chosen ISA in this situation and in their doing so doesnt make them wrong and you right, it just means there is a differing of opinion and circumstance.

I will delcare an allegance to ISAserver.org and Tom as a collegaue however i in no way do i seek to degrade any ones opinion or mindset if stated clearly and with a basis of fact or evidence to support their arguments. I do however roll my eyes when i see people come out with statements like ‘Microsoft does NOT and will NOT ever produce at firewall thats worth more that the crate its shipped in’. These kind of statements do nothing for the posters’ credability and in fact show a narrowmindedness that you may be able to get away with, however if i was in the situation to be hiring someone to work along side me or run my network i would not give these people a second thought.

]]>