Stingray

[bascule]

Stingray is the codename of Microsoft's new Internet Security and Acceleration Server and was one of many technologies Microsoft unveiled at Comdex this week. It appears to be an integrated firewall, web proxy, and VPN product. One really must question why Microsoft applies their monolithic swiss army knife approach to software design to security-oriented products as well, considering that some of the most secure software designed, namely Dan J Bernstein's qmail and djbdns both work by breaking the full functionality of the software down into several small, trivial programs which each do one thing and do it well...

[jesse]

I'm sure it'll make all other security packages go the way of Netscape, Word Perfect and Eudora.

Good thing this is from a company that can't even secure its freakin' game console.

[TwinVega]

both work by breaking the full functionality of the software down into several small, trivial programs which each do one thing and do it well...

"Security is a process, not a product."-Bruce Schneier

"Security is a chain; it's only as secure as the weakest link"-Bruce Schneier

[bascule]

"Security is a process, not a product."-Bruce Schneier

"Security is a chain; it's only as secure as the weakest link"-Bruce Schneier

I would say security is a product of proper software design and proper software usage, with the former affecting the difficulty of the latter. Proper design of network software also includes proper protocol design, such that input validation can be centralized as much as possible. Improper protocol design makes the software design itself that much harder... and unfortunately I'd say that many commonly used protocols are improperly designed from an input validation stanpoint, such as ASN.1 which forms the basis for SSL, and this has been exhibited by multiple and repeated input validation vulnerabilities in multiple SSL implementations, most notably the recent OpenSSL vulnerability which is not the first such vulnerability in its ASN.1 parser. Similar vulnerabilities have been exhibited by the Kerberos ASN.1 implementation, as well as the ASN.1 parsers used by various SNMP implementations.

[bobaxos]

ISA server is nothing new, they had a windows 2000 version and i believe a windows NT version. The proxy is fast and the firewall is a pain in the ass to setup. I dont think i ever got it working right. And it took up a crap load of ram.