Ssl Vpn presentation at CoolTech club

1. SSL VPN TechnologiesBy Igor PlotnikovAgendaTechnology behind SSL VPNs

2. The state of the market

3. Personal experiencesThe Problem of Remote Access to Your DataPrivate Corporate NetworkPublic NetworkRemote WorkerTeleworking grown 40% since 2001 (Dieringer Research Group)

4. Evolution of Remote AccessBreadth of User AccessTCO SavingsSSL VPNMobile WorkersClientless or dynamically downloaded client

5. Web-based “Anywhere” Access

6. Per-user Portals

7. Self-updating Client

8. High Scalability

9. High Security

10. Low or High BandwidthTemps, Contractors IPSec VPNBusiness PartnersTraditionalClient-based

11. High Scalability

12. High Security

13. Low or High BandwidthDial Up Remote Access ServersLeased lines,ISDN, Frame RelayDay ExtendersClient-based

14. Difficult to Manage

15. Low Scalability

16. Unreliable

17. Low SecurityTeleworkersExpensive

18. Low Bandwidth

19. Low securityStrategic UsersEarly 90sMid 90sLate 90s to Present2003 to Present

20. Remote Access over the InternetIntranetRemote WorkerPublic InternetDMZIntranetInternetAnytime, Anywhere Access from Any Internet Device

21. Two core ideas of SSL VPNUse the browser as a universal client

22. Create HTML applications to access some resources

23. Create generic mechanism to access Web servers

24. Use browser extensibility mechanisms – Java, ActiveX, plugins – for more

25. Use https protocol in the browser as a security layer

26. The ciphersuites are comparable to IPSEC

27. Highly trusted security. More money is transferred every day over SSL than IPSEC or SSH

28. Always works! Internet, NAT, proxy-friendly Architecture of SSL VPNPortal – common unified user experienceLayer 3 VPN Drivers behind the scenes- Full network accessSSL over port 443

29. Seamless install via browserLayer 7 VPN Pure clientlessAccess to web apps:

30. HTML access to files:CIFS, FTP, NFS

31. Web Mail

32. CollaborationThin Client – L4 VPN-Port ForwarderPrepackaged Apps- Citrix MetaFrameRDP (Windows Terminal Services)

33. VNC- Telnet/SSH

34. X Windows

35. Desktop accessBrowser-based logon, posture assessment, endpoint protectionSSL as a transport security layer

36. SSL ProtocolPioneered by Netscape in 1994

37. Now in its 4th version, called TLS

38. Highpoints:

39. Uses public key crypto to establish bulk symmetric keys

40. Has built-in trust infrastructure for accessing servers ad hoc, based on X.509 certificates

41. Provides confidentiality, authentication and authenticity

42. Typically used with 1024 bit RSA keys, and 128 bit symmetrical keys for 3DES, RC4 or AES ciphers

43. Extensive infrastructure for key revocation

44. HTTP over SSL is called HTTPSBrowser as Application Delivery Platform

45. Request AuthenticationHTTP is a stateless protocol

46. State can be maintained via

47. Cookies

48. Query string parameters

49. Basic/NTLM authentication

50. Usually the cookies are used

51. It is possible to hijack a cookieReverse Proxy http://web1 Internethttps://ssl.company.comhttp://web2http://web3<a href=“http://web1/index.html>Corporate Network<a href=“https://ssl.company.com/http/80/web1/index.html>Must transform: Anchors, Forms, StyleSheets, Meta tags, includes, etc.

52. Reverse Proxy ChallengesMore datatypes to rewrite:JavaScript

53. VBScript

54. Java

55. Flash

56. XML/XSLT

57. SVG

58. Headers, cookies

59. ActiveX and plugins

60. Helper Applications (e.g. SharePoint)More hurdles to overcome:Gateway performance

61. Broken content

62. Dynamic client-side content

63. Client side performance

64. Need to inject controls

65. The imperfect nature of technologydocument.write(“<a href=‘http://www.google.com’’>Click</a>”);document.write(“<a href=‘htt’+’p://www.google.’+’com’’>Click</a>”);Web 2.0Works in Firefox, but not in IE:<img “I just accidentally left this verbage"src = "images/logo.gif">Works in IE, shows image an <> in Firefox<imgsrc = "images/logo.gif“<>Shows image in both browsers, honors <br> only in Firefox<imgsrc = "images/logo.gif“ Before<br>After

66. Clientless SSL VPN as imperfect technologyvarwnd = window.open(“http://www.google.com/”)varwnd = window.open(“http://ssl.mycompany.com/http/80/www.google.com/”)?

67. Clientless SSL VPN as imperfect technologyvarmywindow = window;varwnd = mywindow.open(”http://www.”+”google.com/”)function SSLWOpen(wnd, url) { if(RealWindow(wnd)) return EncodeUrl(url); return url;}// …..varmywindow = window;varwnd = SSLWOpen(mywindow,“http://www.google.com/”)Window Objects and DOM objects methods, get and put for properties must be wrapped. Objects must be inspected.

68. Clientless SSL VPN as imperfect technologyJavaScript is a functional language.It allows to call methods and access properties as associative arrays.var _window = window;var _open = “open”;var _url = “http://www.google.com/”;varwnd = _window[_open](_url);How to address this imperfect nature?Qualify common productivity applications

69. Create point patch capabilities

70. Use other tools in the SSL VPN toolset

71. Standardize the rewriterFull Network Tunneling over SSLNATSSL VPNhttps over 443https proxyIP encapsulated in SSL, e.g. PPP over SSLhttp CONNECT

72. Full Network Tunneling over SSLSSL Full Network Tunneling is functionally equivalent to IPSEC, but better!Main Benefits:Internet-friendly

73. https always tested

74. Traverses NAT

75. Traverses https proxies

76. The client self deploys!

77. Easy to use browser-based user experienceLimitations:IP over TCP/IP not good for VOIP

78. Can be addressed via the use of DTLS (rfc 4347)

79. Not completely standardPort Forwarding – mini VPN for client-server appsMaps remote IP address:port to a local address:port

80. The application needs to be reconfigured or fooled into talking into address:port

81. In best case no administrative privileges are needed

82. Not a universal solution, but a good part of a whole productEndpointApplicationLoopbackSSL VPN ThinClientSSL VPNPublic Internet

83. Endpoint Security ChallengesAny endpoint can be used , not just a corporate asset

84. Sensitive information may be left on a system, and recovered by an attacker

85. The endpoint may have malware, spyware, rootkitsSolutionsMark all content non-cacheable

86. Use cache cleaners

87. Use sandboxing and virtualization

88. Build access policies around posture assessment Technology SummarySSL VPN is an application delivery platform

89. Genetically closer to a web server than to a network device

90. Ease of use, and low cost of deployment and support are the key differentiators

91. Tight policy controls are essentialWhat makes it a product?AAA infrastructure

92. Logging and monitoring

93. High availability and clustering

94. Enterprise class hardware

95. Single Sign On

96. Multilanguage support

97. Multiplatform supportState of the SSL VPN market$631M addressableenterprise market CY09 *

98. $91.7M worldwide revenue in 2Q07**

99. 5-year CAGR of 21% *Revenue Market Share Q207**Juniper 29.64%Cisco 16.78%Citrix 15.92%F5 07.50%Nortel 07.22%SonicWall 05.69%Sources: * Infonetics, ** Synergy

100. Market trendsRemote access SSL VPN replacing IPSEC

101. The user base is growing, from under 20% of employees to 50%

102. Managed services are growing

103. Many companies invest into disaster recovery

104. SSL VPN is often used to solve NAC problem

105. More multifunctional devices with SSL VPN functionalitySSL VPN – active M&A spaceF5 acquired uRoam

106. Juniper acquired Neoteris via NetScreen for ~$300M

107. Symantec acquired SafeWeb

108. Citrix acquired Net6 and Netscaler

109. SonicWall acquired enKoo, Aventail

110. BlueCoat acquired Permeo

111. Microsoft acquired Whale

112. Netilla merged with AEP

113. Cisco, Nortel, Fortinet, Array - developed SSL VPN technology in houseSharing a uRoam storyuRoam founded in 1998 by Michael Herne, Alexander Sokolsky and Igor Plotnikov

114. Very humbling experience

115. Started off as a service for remotely accessing home desktops over SSL

116. Really wanted to be a dot com initially

117. Got naturally pulled into the enterprise remote access space in 2000 (agreement with RCN)Sharing a uRoam storyThe timing was always wrong, up until 2002 we were contrarian

118. We did not have a complete management team

119. From dot.comserviceto enterprise desktop accessto mobile solution to peer to peerto next generation remote access to SSL VPN

120. The core technology stayed and evolved throughout the history, the marketing pitch kept changing

121. The term SSL VPN was invented very late, in 2002. We intentionally avoided being compared with IPSECSharing a uRoam storyFirst to pioneer the full Network Access over SSL

122. … but have not realized the importance

123. “If you have all this technology how come we haven’t heard of you?”

124. Went through a reverse merger with Filanet

125. Assets acquired by F5 Networks

Ssl Vpn presentation at CoolTech club

More Related Content

What's hot (20)

Viewers also liked (20)

Similar to Ssl Vpn presentation at CoolTech club (20)

Ssl Vpn presentation at CoolTech club