Novell Security Manager™ powered by Astaro

Jan Hichert

CEO, Astaro

jhichert@astaro.com

Rob Sabey

Product Manager, Novell Inc.

rsabey@novell.com

Agenda

Security: Business and Technical Challenges

Introducing Novell Security Manager

Ease of Use, Ease of Management

Six Security Applications

Developed by Astaro

Fit in the Novell Environment

Q&A

Security: Business
and Technical Challenges

Multiplying Attacks

New Technologies

Limited Resources

Increased Scrutiny

Regulations

Audits

Compliance

Management

Attention

Risk

Assessment

Security

Network security must be comprehensive, integrated, and easy to manage.

Multiplying

Attacks

Limited

Resources

New

Technologies

Increased

Scrutiny

Introducing Novell Security Manager
Powered by Astaro

Novell Security Manager
Powered by Astaro

Six critical network security applications

Firewall

VPN Gateway

Virus Protection

Intrusion Protection

Spam Protection

Surf Protection (URL Filtering)

Integrated management platform

Management

Platform

Surf

Protection

(URL Filtering)

Virus

Protection

Firewall

VPN

Intrusion

Protection

Spam

Protection

Linux

Kernal

Layered Security

Firewall

and VPN

Intrusion

Protection

Content Filtering–

Virus/Spam/URL

Internet

External

users

Internal

users

LANs

Email

Database

Web

Built on a Linux Kernel

Novell SUSE LINUX

Hardened

Installed and updated automatically

Administrator needs no knowledge of Linux

Leverages flexibility and innovation of Linux and Open Source

Protects all networks and systems

Management

Platform

Surf

Protection

(URL Filtering)

Virus

Protection

Firewall

VPN

Intrusion

Protection

Spam

Protection

Linux

Kernal

Ease of Use,

Ease of Management

Integrated Management

Management

Platform

Surf

Protection

(URL Filtering)

Virus

Protection

Firewall

VPN

Intrusion

Protection

Spam

Protection

Linux

Kernal

Reporting

Update

Management

Installation

Ease of Use Example – Content Filtering

Ease of Use – Intrusion Protection

Six Security Applications

Firewall – Network Security Foundation

Stateful Packet Inspection

Packet filtering – inspects packet headers, applies rules on source, destination and service

Stateful packet inspection – tracks events across a session to detect violations of normal processes

Application-Level Deep Packet Filtering

Scans packet payloads to enforce
protocol-specific rules

Security proxies to simplify management

HTTP, DNS, Socks, POP3, Ident, SMTP

NAT (Network Address Translation) and masquerading

DoS (Denial of Service Attack) protection

DMZ

External

users

Internet

Internal

Networks

Firewall

Email

Database

Web

WAP

Virtual Private Network (VPN) Gateway

Encrypts data to create a secure private
communications “tunnel” over the public
Internet

Supports multiple architectures

Net-to-Net, Host-to-Net, Host-to-Host

Advanced encryption

Supports all major encryption methods

Supports IPSec, L2TP, and PPTP VPNs

Native Windows, IPSec, and MacOS x clients

Many authentication methods

Internal certificate authority

Full Public Key Infrastructure (PKI) support

Remote

Office

Main Office

Road

Warrior

Home Office

VPN

Gateway

VPN

Gateway

Internet

Intrusion Protection

Identifies and blocks application- and protocol-
related probes and attacks

Database of over 2,000 patterns and rules

Probing, port scans, interrogations, host sweeps

Attacks on application vulnerabilities

Protocol exploitations

Messaging, chat and peer-to-peer (P2P) activities

Intrusion detection and prevention

Notify administrator, or block traffic immediately

Powerful management interface

One click to enable and disable rules,
change between detection and prevention

Easy to add and customize rules

External

users

Internet

Internal Users and Resources

Email

Database

Web

Intrusion

Protection

Rules

Virus Protection

Block viruses, worms, trojans, and other “malware” before they reach email servers or desktops

Scans traditional email (SMTP and POP3 traffic), and Web email and downloads (HTTP traffic)

Multiple virus detection methods

Virus signatures, heuristics (similarities), emulation (execute code in a protected environment)

Database of 100,000 virus signatures

Flexible management

Can specify file formats and text strings to block

Emails and attachments can be dropped, rejected with message to sender, passed with a warning, quarantined

Gateway scanning supplements desktop anti-virus

Virus

Protection

For the

Web

Internet

Email

Server

Web

Server

Email

Virus

Protection

For Email

Spam Protection

Identifies and disposes of unsolicited emails (spam)

Multiple methods to identify spam

Sender address verification, Realtime Blackhole Lists, header and text analysis, whitelists, blacklists

Heuristic methods creates a “spam score” based on probability

Flexible management

Emails and attachments can be dropped, rejected with message to sender, passed with a warning, quarantined

Can attach headers to email messages to allow the email server to take additional actions

Reports on number and size of spam messages

Spam

Protection

Internal

Users

Email

Server

Email

Spam

Surf Protection (URL Filtering)

Internal

Users

Database

of

Classified

URLs

Web Sites

Cache of

Classified

URLs

Enforces policies on appropriate use of the web
Administrators can define web use policies based on
58 categories of web sites

Nudity, gambling, criminal activities, shopping,
drugs, job search, sports, entertainment, etc.

Checks against the largest URL database available

20 million categorized web addresses

Sophisticated classification techniques –
text classification, recognition of symbols and
logos, flesh analysis, comparison with similar
images

Whitelists and blacklists to tailor access for groups of users

Measure and report on activities, or actively block
inappropriate URLs

Spyware Protection

Gateway Spyware Protection complements desktop anti-spyware tools

Blocks downloads of spyware software

Prevents infected systems from sending information back to the spyware server

Spyware

Server

Internal

Users

Database

of

Classified

URLs

Web Sites

Blocks

Spyware

From

Entering

Intercepts

Messages

From

Infected PCs

A Perfect First Step Into Linux

Linux-based network security at the gateway protects all IT environment – Windows, NetWare, Unix, etc.

Requires no knowledge of Linux to implement

Easy first step in the transition to Linux

Linux-based Network Security

Heterogeneous Environment

Router

External Network

Internal Network

DMZ

Email

Server

Internet

Email

Server

Email

Server

Developed by Astaro

Astaro

The leading provider of Linux-based integrated network security solutions

Founded in 2000

$12.4 million venture funding raised in 2003 and 2004

Joint headquarters in US and Germany

Mature technology - currently version 5

Protecting 20,000 networks in 60 countries

Customers

“An astonishingly rich set of security features.”

SC Magazine

“The most polished and easy to use Web-based management system we’ve seen to date.

InfoWorld

“…gives the administrator all he can ask for, collected into one single machine, and everything without complications.”

Nätverk & Kommunikation

Best Business Security Solution of 2004

“[A] recipe for top-notch network perimeter security.”

PC Magazine

Recognition

Finalist

The Future:
The Novell security gateways

The Novell Security Gateways

Maintain and Support BorderManager

Enhancements

Support Packs

Security Manager

BorderManager feature parity

With Astaro provide latest industry advances

Q & A

The answer to the Security Struggle? Astaro Security Linux.

This product includes six critical network security applications:

A firewall

A VPN gateway

Spam protection

Intrusion protection

Gateway virus protection

And Surf Protection, which is also known as URL filtering

Astaro Security Linux gives you a layered approach to security, all in one system.

Communications from the Internet can come from customers, business partners, and employees – or from hackers, spammers and virus writers.

The stateful inspection firewall in Astaro Security Linux blocks traffic that does not conform to the rules you set about ports, protocols, and the expected sources and destinations of communications traffic.

The VPN gateway assures secure communications over the public Internet from users at remote locations.

You can use Astaro’s Intrusion Protection capabilities to detect and block more than 1,500 application- and protocol-specific attacks.

Astaro’s content filtering framework can scan emails, files and web traffic to block or quarantine viruses, spam, inappropriate web pages and other harmful materials.

Because all of the security applications in Astaro Security Linux are fully integrated, all communications traffic in and out of the organization is screened quickly, completely, and efficiently.

The answer to the Security Struggle? Astaro Security Linux.

This product includes six critical network security applications:

A firewall

A VPN gateway

Spam protection

Intrusion protection

Gateway virus protection

And Surf Protection, which is also known as URL filtering

The integrated management platform in Astaro Security Linux makes all of these security applications very easy to manage.

All of Astaro’s software installs from a single CD in less than 15 minutes. Or you can obtain the software pre-installed on a variety of “security appliances.”

A single management interface allows you to configure and manage all of the security applications in a simple, unified manner. This is one of the greatest strengths of Astaro Security Linux. Reviewers have called Astaro’s web-based management interface “The most polished and easy to use Web-based management system we’ve seen to date” and “a gem.”

Astaro’s update mechanism updates the entire system with one easy process. This includes upgrading the underlying software, updating virus signatures, and updating intrusion signatures and other types of threat patterns.

Finally, there is one set of reports and logs for all of the applications.

Astaro’s integrated management platform dramatically reduces the time and effort needed to deploy, manage, and update a complete network security infrastructure.

We very much encourage you to try Astaro’s evaluation software so you can see why this management platform is so powerful and effective.

Let’s look at each security application in a little more detail.

A firewall is the foundation of any network security infrastructure, and Astaro Security Linux features one of the most sophisticated and efficient firewalls available.

It provides stateful packet inspection. The firewall not only inspects the headers of all communications packets arriving from the network, it also tracks events across a session to detect violations in communications processes.

The firewall also scans the application-related sections of the communications packet so that it can enforce protocol-specific rules.

To simplify the management of many network connections and increase performance, Astaro provides security proxies for key protocols such as HTTP, DNS, Socks, POP3, Ident and SMTP.

Other key firewall capabilities include Network Address Translation, masquerading, and protection against Denial of Service attacks.

And Astaro Security Linux can screen traffic from wireless devices.

A virtual private network, or VPN, provides for secure communications over the public Internet. This can dramatically reduce communications costs by eliminating the need for expensive leased lines.

Astaro Security Linux features an extremely flexible VPN gateway.

It supports multiple architectures, so VPN connections can be established with remote offices, home offices, and “road warriors” coming in from hotel rooms and other public locations.

You can choose from all of the most advanced encryption methods such as AES, DES, 3DES, Blowfish, Twofish 128-bit and MPPE.

Astaro’s VPN works with a wide variety of VPN clients, including the PPTP and IPSec clients that come on Windows systems, L2TP and IPSec clients from Astaro and from third parties, and MacOS clients.

Users can be authenticated against VPN gateways, external directories, Radius servers, and LDAP-compliant user databases.

Astaro Security Linux includes it’s own certificate authority, to simplify the use of digital certificates for high-security communications. It provides full Public Key Infrastructure support.

And the VPN gateway supports VPN tunnels based on dynamic IP addresses. This makes it easy to implement a secure VPN using low-cost Internet connections that assign IP addresses dynamically.

Intrusion Protection is emerging as a “must-have” tool to address the ever-growing list of attacks that attempt to exploit weaknesses in specific applications and communications protocols.

Astaro’s Intrusion Protection is based on a database of over 1,500 patterns and rules. These can detect probes and interrogations by hackers, and attacks against weaknesses in applications and protocols.

You can also stop or limit activities related to newer communications media such as instant messaging, chat, and peer-to-peer networks. This can be a critical addition to your security, because today there are very few defenses against abuses of these systems.

Astaro’s Intrusion Protection provides both intrusion detection and intrusion prevention. That is, if the software detects suspicious activity it can either notify the systems administrator by email, or else tell the firewall to block the suspect traffic immediately.

Astaro’s management interface makes it very easy to enable and disable rules and change between detection and prevention with only a click. You can work at the level of individual rules, or entire categories.

The rules are updated continuously with Astaro’s Up2Date service, and you can also add new rules or customize existing rules.

Virus protection is a critical weapon in any security arsenal. It is essential to block viruses, worms, and similar threats before they reach email servers and user desktops.

Astaro is one of a handful of companies that offer two types of virus protection – virus protection for conventional email, and virus protection for files and emails downloaded from a web browser.

Astaro’s virus protection utilizes several virus detection methods to maximize the number of viruses blocked. The methods include scanning emails and attachments for code known to be associated with a virus, using heuristic methods to spot code that is similar to known virus patterns, and emulation – letting code execute in a protected environment where problems can be detected without allowing infection.

Astaro Security Linux checks suspicious code against a database of 80,000 virus signatures.

You also get a lot of management flexibility. You can specify file formats and text strings to block, and you can have suspicious emails and attachments dropped, rejected with a message sent to the sender, passed through to the user with a warning, or quarantined so that the administrator can examine the email later and take an appropriate action.

The gateway virus scanning provided by Astaro allows you to react very quickly to new viruses before they can reach your internal systems. It therefore provides a critical supplement to desktop virus scanners, which typically are difficult to update rapidly across an entire organization.

Astaro’s Spam Protection can identify and block unsolicited emails.

Astaro’s spam protection utilizes several spam detection methods to maximize the ability to identify spam correctly.

You can tell the software to check that emails come from the email server listed in the packet header. You can check email sources against known spammers listed on Realtime Blackhole lists. You can create your own whitelist and blacklist to override or extend the standard blacklists.

And you can use many rules and patterns to analyze text in an email and assign a “spam score” based on the probability that the email is unsolicited. By setting a threshold, you can have suspicious emails dropped, rejected with a message sent to the sender, passed through to the user with a warning, or quarantined so that the administrator can examine the email later and take an appropriate action. This flexibility allows you to balance the need to block spam against the chance of inadvertently blocking legitimate emails.

You can also have Astaro attach headers to an email message and pass it through. This allows the email server to take actions like putting potential spam messages into a special folder on the user’s desktop so the user can review and retrieve any messages that are in fact legitimate.

Astaro also provides reporting on the number and size of spam messages so that you can spot patterns and trends.

Excessive web surfing by employees can be a major drain on productivity. Employees who download inappropriate or copyrighted material can create legal liability for the organization as a whole.

Surf Protection lets you measure web activity to create a web usage policies, and then block access to web sites that violate that policy.

You can define web usage policies based on 58 categories of web sites, including those associated with nudity, gambling, criminal activity, and legal but inappropriate activities like surfing web sites for shopping, auctions, entertainment, and job searching.

Astaro Security Linux uses a database of 20 million categorized web addresses – the largest URL database commercially available. This database was compiled using extremely sophisticated classification techniques, including text analysis, visual recognition of symbols and logos, and the calculation of how much flesh on a web page comes from faces versus other parts of the body.

You can create your own whitelist and blacklist to override or extend the URL database. Separate whitelists and blacklists can be created for different groups of users.

And you can simply measure and report on web activities, to help identify problems and set priorities, or you can block URLs so they are inaccessible to users.

Excessive web surfing by employees can be a major drain on productivity. Employees who download inappropriate or copyrighted material can create legal liability for the organization as a whole.

Surf Protection lets you measure web activity to create a web usage policies, and then block access to web sites that violate that policy.

You can define web usage policies based on 58 categories of web sites, including those associated with nudity, gambling, criminal activity, and legal but inappropriate activities like surfing web sites for shopping, auctions, entertainment, and job searching.

Astaro Security Linux uses a database of 20 million categorized web addresses – the largest URL database commercially available. This database was compiled using extremely sophisticated classification techniques, including text analysis, visual recognition of symbols and logos, and the calculation of how much flesh on a web page comes from faces versus other parts of the body.

You can create your own whitelist and blacklist to override or extend the URL database. Separate whitelists and blacklists can be created for different groups of users.

And you can simply measure and report on web activities, to help identify problems and set priorities, or you can block URLs so they are inaccessible to users.

And Astaro’s products have been recognized in both reviews and awards.

2003-12-08T12:43:39