449 reputation
24
bio website cymbel.com
location Massachusetts
age
visits member for 3 years, 2 months
seen Feb 5 '13 at 14:04

Principal at Cymbel Corporation, an information security and compliance solutions provider headquartered in Massachusetts. We help our clients rethink and re-implement defense-in-depth in response to changes in business needs, technology, threats, compliance requirements, and the economy. I have been in information security since 1999.


Jan
30
awarded  Yearling
Jan
11
comment How should I store SSL keys on the server?
If you are investing in SSL, then an HSM should be considered part of the total cost of SSL, even if you are using Microsoft's free Certificate Authority for internal certs.
Nov
8
comment How will microvirtualisation change the security field, if at all?
This is an excellent description of Bromium's technology. I would like to see Tal respond to some of the other answers given here. Would that be appropriate?
Nov
8
awarded  Supporter
Jan
30
awarded  Yearling
Jan
22
answered What advantages and disadvantages do Palo Alto firewalls have, compared to others in the market
Jan
22
comment What advantages and disadvantages do Palo Alto firewalls have, compared to others in the market
Palo Alto also supports traditional stateful inspection policies based on ports, IP addresses and protocols. This is important for two reasons: (1) Eases conversion and (2) build policies that are a combination of application and port. For example, SMTP only on port 25 and only SMTP on port 25.
Jan
3
awarded  Commentator
Jan
3
comment HTTP Proxy vs bump-in-wire
@ThomasPornin I would like to clarify my two points. First regarding routing, I believe that if a pair of "bump-in-the-wire" appliances are deployed in an active/active configuration, the appliances will see all the traffic and be able to perform their security functions. Regarding HTTP proxy issues, we've seen applications like cgiproxy, phproxy, and ultrasurf go through the proxy unblocked. And we've seen SSH go through HTTP proxies as well.
Jan
3
comment HTTP Proxy vs bump-in-wire
@ThomasPornin I would like to clarify my two points:
Jan
2
comment HTTP Proxy vs bump-in-wire
From my perspective, in 2012, the only reason to proxy is for caching. But proxies for security purposes is a very weak solution. With the proliferation of port hopping applications like Skype, all 65K+ ports must be monitored, if you want to establish real control of traffic to and from the Internet.
Jan
2
comment HTTP Proxy vs bump-in-wire
I guess it depends on what type of organization you are in. If you don't have a firewall, perhaps not having to worry about NAT'ing makes sense. However, I would still like a response from someone regarding the issue of bypassing an HTTP proxy because in general they are only monitoring a small number of ports such as 80 and 443. And I would like a clarification on what's "cumbersome" about installing a "bump-in-the-wire" appliance.
Dec
31
comment HTTP Proxy vs bump-in-wire
How is the bump-in-the-wire box cumbersome to install? No network configuration changes are needed. HTTP proxies have limited value because they can be easily bypassed since they are not looking at all 65K+ ports. Of course we are just talking generic solutions and there is quite a variation within each category.
Dec
30
answered HTTP Proxy vs bump-in-wire
Aug
21
answered Do these ports mean anything?
Aug
17
comment How do a firewall's rules for individual programs work?
Let's be more specific about the definition of "application." I would call HTTP a protocol. Facebook, for example, actually consists of many different applications. A firewall that can classify traffic by application block Facebook games and allow Facebook mail. Stateful inspection firewalls, by definition, cannot detect applications. A proxy-based firewall might be able to, but only on the ports to which it is listening and only for the protocols it can proxy.
Aug
17
comment How do a firewall's rules for individual programs work?
This answer is specific to host-based firewalls, not network-based firewalls. Network-based firewalls generally have no knowledge of the operating systems of end point devices.
Aug
16
answered How do a firewall's rules for individual programs work?
Apr
21
comment Do you detect/react to DNS tunnelling?
@AviD Actually they do identify applications within protocols. HTTP is surely not considered one application. If it were, there would be little added value.
Apr
21
comment Do you detect/react to DNS tunnelling?
@Rory - I amended my answer in two ways. I made it more specific and disclosed my relationship with Palo Alto Networks (as well as Check Point and Juniper).