Presentation on SSL VPN technologies at CoolTech club

2. The state of the market

5. Web-based “Anywhere” Access

6. Per-user Portals

7. Self-updating Client

8. High Scalability

9. High Security

11. High Scalability

12. High Security

14. Difficult to Manage

15. Low Scalability

16. Unreliable

18. Low Bandwidth

19. Low securityStrategic Users Early 90s Mid 90s Late 90s to Present 2003 to Present

20. Remote Access over the Internet Intranet Remote Worker Public Internet DMZ Intranet Internet Anytime, Anywhere Access from Any Internet Device

22. Create HTML applications to access some resources

23. Create generic mechanism to access Web servers

24. Use browser extensibility mechanisms – Java, ActiveX, plugins – for more

25. Use https protocol in the browser as a security layer

26. The ciphersuites are comparable to IPSEC

27. Highly trusted security. More money is transferred every day over SSL than IPSEC or SSH

30. HTML access to files:CIFS, FTP, NFS

31. Web Mail

33. VNC- Telnet/SSH

34. X Windows

35. Desktop accessBrowser-based logon, posture assessment, endpoint protection SSL as a transport security layer

37. Now in its 4th version, called TLS

38. Highpoints:

39. Uses public key crypto to establish bulk symmetric keys

40. Has built-in trust infrastructure for accessing servers ad hoc, based on X.509 certificates

41. Provides confidentiality, authentication and authenticity

42. Typically used with 1024 bit RSA keys, and 128 bit symmetrical keys for 3DES, RC4 or AES ciphers

43. Extensive infrastructure for key revocation

46. State can be maintained via

47. Cookies

48. Query string parameters

49. Basic/NTLM authentication

50. Usually the cookies are used

53. VBScript

54. Java

55. Flash

56. XML/XSLT

57. SVG

58. Headers, cookies

59. ActiveX and plugins

61. Broken content

62. Dynamic client-side content

63. Client side performance

64. Need to inject controls

65. The imperfect nature of technologydocument.write(“<a href=‘http://www.google.com’’>Click</a>”); document.write(“<a href=‘htt’+’p://www.google.’+’com’’>Click</a>”); Web 2.0 Works in Firefox, but not in IE:<img “I just accidentally left this verbage"src = "images/logo.gif"> Works in IE, shows image an <> in Firefox <imgsrc = "images/logo.gif“<> Shows image in both browsers, honors <br> only in Firefox <imgsrc = "images/logo.gif“ Before<br>After

66. Clientless SSL VPN as imperfect technology varwnd = window.open(“http://www.google.com/”) varwnd = window.open(“http://ssl.mycompany.com/http/80/www.google.com/”) ?

67. Clientless SSL VPN as imperfect technology varmywindow = window; varwnd = mywindow.open(”http://www.”+”google.com/”) function SSLWOpen(wnd, url) { if(RealWindow(wnd)) return EncodeUrl(url); return url; } // …..varmywindow = window; varwnd = SSLWOpen(mywindow,“http://www.google.com/”) Window Objects and DOM objects methods, get and put for properties must be wrapped. Objects must be inspected.

69. Create point patch capabilities

70. Use other tools in the SSL VPN toolset

73. https always tested

74. Traverses NAT

75. Traverses https proxies

76. The client self deploys!

78. Can be addressed via the use of DTLS (rfc 4347)

80. The application needs to be reconfigured or fooled into talking into address:port

81. In best case no administrative privileges are needed

82. Not a universal solution, but a good part of a whole productEndpoint Application Loopback SSL VPN Thin Client SSL VPN Public Internet

84. Sensitive information may be left on a system, and recovered by an attacker

86. Use cache cleaners

87. Use sandboxing and virtualization

89. Genetically closer to a web server than to a network device

90. Ease of use, and low cost of deployment and support are the key differentiators

92. Logging and monitoring

93. High availability and clustering

94. Enterprise class hardware

95. Single Sign On

96. Multilanguage support

98. $91.7M worldwide revenue in 2Q07**

99. 5-year CAGR of 21% *Revenue Market Share Q207** Juniper 29.64% Cisco 16.78% Citrix 15.92% F5 07.50% Nortel 07.22% SonicWall 05.69% Sources: * Infonetics, ** Synergy

101. The user base is growing, from under 20% of employees to 50%

102. Managed services are growing

103. Many companies invest into disaster recovery

104. SSL VPN is often used to solve NAC problem

106. Juniper acquired Neoteris via NetScreen for ~$300M

107. Symantec acquired SafeWeb

108. Citrix acquired Net6 and Netscaler

109. SonicWall acquired enKoo, Aventail

110. BlueCoat acquired Permeo

111. Microsoft acquired Whale

112. Netilla merged with AEP

114. Very humbling experience

115. Started off as a service for remotely accessing home desktops over SSL

116. Really wanted to be a dot com initially

118. We did not have a complete management team

119. From dot.comserviceto enterprise desktop accessto mobile solution to peer to peerto next generation remote access to SSL VPN

120. The core technology stayed and evolved throughout the history, the marketing pitch kept changing

122. … but have not realized the importance

123. “If you have all this technology how come we haven’t heard of you?”

124. Went through a reverse merger with Filanet

125. Assets acquired by F5 Networks