Feeds

US and UK gov cyber defences = big boys' trough-slurp

Firewall Obi-Wan says small firms will be locked out

Website security in corporate America

Commitments by the UK government and others to improve cybersecurity by increased spending are more likely to benefit established security vendors with well-oiled lobbying machines than innovative start-ups, according to one of the pioneers of the industry segment.

Nir Zuk, chief technology officer at Palo Alto Networks, reckons web applications have made the traditional firewall technologies he helped to develop obsolete, despite their ubiquity in both government and business.

"The firewall was designed to block someone from the outside connected to servers on inside," Zuk said. "Web applications have changed that so that the traditional stateful inspection firewall - invented by Check Point 15 years ago - doesn't do anything any more."

You might as well take traditional firewalls and "replace them with an Ethernet cable," Zuk reckons.

The traditional approach of using ports and protocols to either block or allow traffic can't hope to succeed. Palo Alto's technology is designed to allow enterprises to regain control of applications, providing greater visibility of what's going on in a network.

A different approach is needed because everything for enterprise applications, such as salesforce.com, through VoIP to worms all come in and out through HTTP traffic and the web. Just blocking or allowing ports or protocols, the functions of a traditional firewall, no longer makes much sense.

Plenty of security firms play in the application control space, mostly using application control technology installed on the desktop or via intrusion prevent systems. Palo Alto is trying to attack the problem at the network level and via a next generation firewall that it hopes large enterprises will use as an upgrade from legacy Cisco, Check Point or Juniper kit.

Zuk left service with a branch of Israeli military intelligence to help Check Point develop Firewall 15 years ago. The developer was four years younger than the three founders of Check Point, as a result of which he left the firm wealthy but not set up for life.

He went on to NetScreen, which was acquired by Juniper Networks in 2003. "I spent 11 months banging my head before I tired of life at Juniper and left to start Palo Alto, building the technology I tried to start inside Juniper but wasn't able to."

Zuk founded Palo Alto in 2005, two years before the firm began selling products in 2007. He remains in the business because he "likes to build technology" and solve things. Zuk is also in business to make money, of course, and it might be thought that recent commitments by the government in the UK and the US to spend more on infrastructure protection would be good news for the likes of Palo Alto.

This isn't necessarily so, however. "I don't know about the UK but in the US money gets spent on the vendors who spend millions lobbying Congress," Zuk told El Reg.

"In the information security arena governments do the same thing, just more of it when there are higher budgets for cybersecurity. This, according to Zuk, translates into buying more kit from the likes of Cisco and paying expensive consultants.

"Money is shut out from start-ups," he told El Reg. "It's a cycle and I don't know how to break it."

Zuk made the comments during a presentation in the city of London and a subsequent interview during a rare visit to the UK on Wednesday. ®

Protecting users from Firesheep and other Sidejacking attacks with SSL

More from The Register

next story
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
Home Depot: 56 million bank cards pwned by malware in our tills
That's about 50 per cent bigger than the Target tills mega-hack
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
UK.gov lobs another fistful of change at SME infosec nightmares
Senior Lib Dem in 'trying to be relevant' shocker. It's only taxpayers' money, after all
Critical Adobe Reader and Acrobat patches FINALLY make it out
Eight vulns healed, including XSS and DoS paths
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
Blood-crazed Microsoft axes Trustworthy Computing Group
Security be not a dirty word, me Satya. But crevice, bigod...
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.