F5 News

F5 - iApp for VMware View

devcentralteam@f5.com (F5 Networks) — Thu, 09 Feb 2012 11:44:34 GMT

#VDI Deploying virtual desktops involves many different elements and be complex.

Rolling out your deployment across data centers is time-consuming and prone to human error. F5 iApp technology is a user-customizable framework for deploying application. With iApp for VMware View, you can easily roll out configuration across your F5 devices, to cut deployment time from hours to minutes. F5 can help by making VMware View secure, fast, scalable, and available.

More information about F5's solution for VMware View can be found at http://www.f5.com/view

F5 - iApp for VMware View

Resources:

Connect with F5:

Latest F5 Information

Technorati Tags: F5,F5 News,VDI,virtualization,VMware,iApp,video,VMware View

F5 - Mobile Device Support for VMware View

devcentralteam@f5.com (F5 Networks) — Fri, 03 Feb 2012 13:07:00 GMT

#mobile #vdi #virtualization

End user computing means that a wide range of mobile devices from laptops to tablets and from desktops to smartphones are being used. The diversity of these mobile devices and the sheer number of them in the workplace can overwhelm IT and strain your resources. Access and performance are key support concerns. And, since many mobile devices are personal, security is absolutely critical.

F5 provides intelligent mobile device support for VMware View. This benefits IT with greater access and compliance control, while at the same time, allowing your employees the freedom to use their mobile device of choice. F5 can help by making VMware View secure, fast, scalable, and available.

More information about F5's solution for VMware View can be found at http://www.f5.com/view

F5 - Mobile Device Support for VMware View

Resources:

Connect with F5:

Latest F5 Information

Technorati Tags: F5,F5 News,VMware,VMWare view,virtualization,vdi,mobile,video

F5 - Simplifying Access for VMware View

devcentralteam@f5.com (F5 Networks) — Wed, 01 Feb 2012 13:18:00 GMT

#vdi #fasterapp #infosec End-user acceptance will suffer if access to desktops is complicated or slow.

In addition, without strong security, confidential information might be exposed, critical data lost, or regulatory compliance requirements unmet. F5 BIG-IP Access Policy Manager (APM) offers users unified, secure access as well as broad support for authentication, authorization, and accounting (AAA) mechanisms and stringent access policies. These features are combined with security endpoint check, plus multi gigabit-per-second SSL encryption, thousands of logins per second, and optimized connections. F5 can help by making VMware View secure, fast, scalable, and available.

More information about F5's solution for VMware View can be found at http://www.f5.com/view

F5 - Simplifying Access for VMware View

Resources:

Connect with F5:

Latest F5 Information

Technorati Tags: F5,F5 News,VMware,VMware View,VDI,virtualization,application delivery,performance,availability,video

Rackspace - F5 Case Study

devcentralteam@f5.com (F5 Networks) — Mon, 30 Jan 2012 13:05:00 GMT

Rackspace Hosting wanted to broaden its product portfolio by offering customers an easy way to link dedicated managed servers to cloud-based servers. The company used Application Delivery Networking devices from F5 to help build a hybrid service called RackConnect. Now, Rackspace customers can mix and match dedicated managed and cloud hosting platforms for ultimate scalability, flexibility, efficiency, and lower costs.

As part of its standard hosting infrastructure, Rackspace uses BIG-IP devices to accomplish a number of tasks. BIG-IP LTM automatically directs customers’ traffic among web and application servers. It offloads CPU-intensive content caching and TCP connections from the servers to the BIG-IP devices to boost server performance. It also monitors application health and seamlessly redirects traffic away from potentially problematic servers or network components. The company also takes advantage of F5 Enterprise Manager to centralize management of multiple BIG-IP devices in its network through a single interface, significantly reducing the amount of time spent administering devices.

Rackspace - F5 Case Study

More Resources:

Rackspace

Connect with F5:

Latest F5 Information

Technorati Tags: F5,F5 News,integration,cloud computing,load balancing,performance,availability,video

F5 - Availability and Scalability for VMware View

devcentralteam@f5.com (F5 Networks) — Mon, 30 Jan 2012 12:08:00 GMT

#virtualization #vdi Scaling VMware View from hundreds to thousands of devices can strain the network and data center connectivity. Additionally, if poor performance hinders access to virtual desktops, end-user productivity will suffer. F5 BIG-IP LTM and BIG-IP GTM Application Delivery Controllers support redundant tiers of infrastructure within and across data centers, for maximum availability. In addition, the patented, unified F5 TMOS product platform provides tremendous scalability -- from thousands to millions of transactions per second. F5 can help by making VMware View secure, fast, scalable, and available.

More information about F5's solution for VMware View can be found at http://www.f5.com/view

F5 - Availability and Scalability for VMware View

Related resources:

Connect with F5:

Latest F5 Information

Technorati Tags: F5,F5 News,VMware,VMware View,VDI,virtualization,performance,availability,security,video,application delivery

Overview: F5 for VMware View

devcentralteam@f5.com (F5 Networks) — Fri, 27 Jan 2012 12:02:38 GMT

#virtualization #vdi VMware View is a leading solution for desktop virtualization offering simplified administration while increasing security and control. When deploying VMware View, there are several issues your business must deal with: from the management of a wide range of devices, to ensuring availability, scalability, and performance. F5 can help by making VMware View secure, fast, scalable, and available.

More information about F5's solution for VMware View can be found at http://www.f5.com/view

Overview: F5 for VMware View

Connect with F5:

Latest F5 Information

Technorati Tags: F5,F5 News,VMWare,VMware View,virtualization,application delivery,integration,video

Human Kinetics - F5 Case Study

devcentralteam@f5.com (F5 Networks) — Thu, 26 Jan 2012 13:01:00 GMT

Human Kinetics publishes and sells print, online, and multimedia materials related to kinesiology. It hosts its own e-commerce website and nearly 40 other educational and storefront sites, which together get about half a million unique visits per month. A year after its deployment, HK's third-party network solution had become unstable, was inflexible and difficult to support, and impaired performance. HK replaced the solution with F5 BIG-IP Local Traffic Manager and BIG-IP Application Security Manager.

Human Kinetics - F5 Case Study

More resources:

Human Kinetics

Connect with F5:

Latest F5 Information

Technorati Tags: F5,F5 News,case study,performance,security,video

Blue Cross Blue Shield Kansas City - F5 Case Study

devcentralteam@f5.com (F5 Networks) — Tue, 24 Jan 2012 10:56:27 GMT

Blue Cross Blue Shield of Kansas City (BCBSKC) is the area's largest health benefits provider. As a prominent local healthcare provider with a strong reputation for quality, BCBSKC recognized the need to ensure high availability and strong security for their website, which typically receives more than 30,000 hits a day.

By using F5 solutions, Blue Cross Blue Shield dramatically improved page load times, supercharged their application performance, improved their scalability to meet future growth challenges, and effectively locked down their data to meet the rigorous compliance goals mandated by the Health Insurance Portability and Accountability Act (HIPAA).

Blue Cross Blue Shield Kansas City - F5 Case Study

More Resources:

Blue Cross Blue Shield

Connect with F5:

Latest F5 Information

Technorati Tags: F5,F5 News,case study,performance,security,HIPAA,compliance,insurance,availability,video

Mobile and IPv6: Why Cows Connecting to the Internet Affects You

devcentralteam@f5.com (F5 Networks) — Mon, 23 Jan 2012 14:51:53 GMT

#mobile #IPv6 Mobile devices. Plants. Cars. Cows. It’s time to get serious about that move to IPv6.

Until recently the motivation for migrating from IPv4 to IPv6 has been, well, less than urgent. If consumerization hasn’t been enough of an impetus to get you seriously thinking about migration, maybe the reality that even cows are now being Internet-enabled might. (Check out the infographic linked below for the story)

There has been some contention about the number of connected things and by when. Cisco's prediction of 50 billion devices by 2020 matches Ericsson CEO Hans Vestberg's prediction earlier this year within a similar time period. However IBM recently put it at 1 trillion connected devices by 2015. Indeed in April 2010, Cisco's own CTO Padmasree Warrior said that by 2013 the number of devices connected to the Internet will reach 1 trillion.

Cisco: 50 Billion Things on the Internet by 2020 [Infographic]

But if that’s not enough to convince you, let’s just do some pure mathematics. Even if we take the lowest of predictions, 50 billion, and we compare that to the maximum number of IP addresses allowed by IPv4 - 2^{^32} - the result is a number less than 50 billion.

2^{^32} = 4,294,967,296 < 50B

That’s reality. What you might not have known, however, is that major providers have long since announced they will stop offering IPv4 addresses to smartphones around the end of … 2011. Which if you recall was about, oh, four weeks ago.

AT&T, Verizon and others have announced that they will stop offering IPv4 addresses to smartphones around the end of 2011. So, even if your corporate network has plenty of IPv4 addresses, your employees may find themselves without connectivity unless there’s full IPv6 support for their mobile devices.

-- Enterprise IPv6 Transition

Whether providers have or have not stopped offering IPv4 addresses already isn’t as important as the fact that in the very near future they will, because they will have no other options. Moving forward with such rapid growth in the number of, as Cisco put it, “things” connected to the Internet, the only option is migration to IPv6 – and sooner rather than later.

What’s missing from discussions about “things” connected to the Internet is what they’re connecting to. While Twitter-enabled plants are certainly amusing, the impact to the enterprise is unsurprisingly minimal. Or at least it seems that way…

IMPACT on the ENTERPRISE

The impact to enterprise IT organizations comes from being forced to support IPv6 sooner rather than later by providers pushing out IPv6 out of necessity. It comes from needing to somehow support IPv6-requiring mobile devices in their quest to access critical corporate resources while not within the confines of the internal, IPv4 network. The fact that cows and plants and things are increasingly connected to the Internet means that the day when your employees are assigned IPv6 addresses on their smart phones and tablets and may no longer be able to access corporate resources remotely will be more quickly upon you.

The need to support not only the mobile device platforms but their networking mechanisms has been on F5’s radar for some time. It’s not just enough to support the platform if you don’t support the network. That’s why it was satisfying to see Gartner place F5 in the leaders quadrant for SSL VPN, recognizing its dedication and focus on supporting mobile client platforms natively like iOS and Android as well as its leadership in supporting IPv6 to ensure those mobile clients can access corporate resources remotely regardless of their networking stack.

F5 BIG-IP Access Policy Manager (APM) and Edge Gateway are already IPv6 ready. Drawing on the IPv6 gateway capabilities of F5’s core platform technology, TMOS, BIG-IP APM and Edge Gateway are fully IPv6 ready and able to support mobile devices (and cows, too) assigned IPv6 addresses.

The ability of an SSL VPN to support IPv6 will quickly be of utmost importance for organizations desiring to continue supporting the needs of its remote users accessing resources via mobile devices.

More Resources

Connect with F5:

Latest F5 Information

Technorati Tags: F5,F5 News,mobile,Ipv6,SSL VPN,VPN,security,android,ios,blog

From LOIC to a Click Party–The Danger in Connection-Based Attacks

devcentralteam@f5.com (F5 Networks) — Fri, 20 Jan 2012 13:53:58 GMT

#infosec #adcfw #LOIC Did you rush out to check if a site was really taken down? If you did, you may have unintentionally helped

The focus on Anonymous’ self-described retributive attacks on a variety of sites last night has been on its use of LOIC – Low Orbit Ion Cannon – as a means to achieve maximum effect with minimal resources.

It’s a connection-based attack, pure and simple. A DDoS at the application layer, which makes it nearly impossible to detect, let alone stop.

The tool isn’t really anything special in execution. Its ability to give control to someone else and communication with a central system is not what’s special about it. The way it participates in an attack is not what’s special about it.

What’s important about it is that there’s actually nothing really special about it. The purpose is merely to generate requests automatically. Not special requests, just requests.

In other words, anyone with a web browser could do the same, albeit not as efficiently. In fact, it was noted on Twitter during the attacks that “It’s a click party no #LOIC needed” (for those who wanted to help but were concerned with the legal ramifications of using LOIC).

A click party. Flash mob. DDoS.

This is because of a single fundamental truth on the web today: connections count.

CONNECTIONS COUNT

If your infrastructure would not be able to withstand a sudden spike in users – i.e. connections – then it certainly won’t withstand a click party, or targeting via LOIC, or any other tool designed to consume connections.

When thousands of people intentionally and unintentionally (did you zip off to check if the site really was down? If you did, you probably aided in their quest to consume resources and render the site disabled) connect to a site – with or without the use of a tool – it’s going to have an impact. Reports estimated over 5000 people were using LOIC in the attacks last night. A typical browser will generate several TCP connections for every web page requested, meaning the connection impact of those 5000 people was likely magnified by a factor of 2, 6, or eight (depending on who you ask, what browser they’re running, and whether they’ve changed the default settings), assuming LOIC will use the configured maximum number of connections per host and per server.

So really, all you have to do to overwhelm a site today is generate more connections than the weakest link in the traffic path can handle. That may be the server, although with cloud computing, virtualization, and auto-scaling solutions this is growing more unlikely, but it may also be an upstream or downstream network component. Any piece of network infrastructure which manages TCP connections is a potential source of disruption in the event of a concerted attack, as is your DNS infrastructure. Firewalls. Load balancers. Dependent services. There’s a host (pun mostly intended) of possible chokepoints in a network that make it more likely that even if an attack is not successful in the sense that it forces an outage, it might be successful at overloading enough components that performance degrades so far it might as well be down.

LEGIT and NON-LEGIT

The biggest problem organizations may face in terms of defending against these types of attacks is detecting them. These are more often than not legitimate requests, they’re just in overwhelming numbers or drawing responses back very slowly, or using some other similar technique whose intent is malicious but the packets and data are not. If part of the retaliatory attacks by Anonymous were, in fact, a “click party”, security infrastructure was likely unable to do anything about it, because what’s the difference between 100 people clicking on a site for purposes of attack and 100 people clicking on a site for purposes of gathering information?

Right. Nothing but intent, and that’s something no infrastructure can determine with any real accuracy. Or can it?

There are some characteristics that make it obvious a user – or bot – is intent on disabling a site. Repeated requests for the same content, pulling responses from web servers at a rate that is much lower than their network connection would normally allow, and failure to respond to TCP protocol connection-management packets (common when the attacker is spoofing their IP address in a (mostly futile these days) attempt to hide their location and/or identity).

If infrastructure is smart enough, as some application delivery controllers are, then these clues will give it the information it needs to redress the situation. What policies might be applied to such connections is dependent upon the organization. Rejection, closing connections, redirection, etc. It might simply be that you want to be aware. The right infrastructure can withstand a lot when the attack is primarily attempting to overwhelm a site through massive connection counts.

Right now is a good time to evaluate your infrastructure and its ability to withstand such an attack. Consider leveraging cloud-based load testing services as a means to determine at which point your site might “fall over”, and to ascertain what, if any, components in the connection path may be your “weakest link”, and then determine to do something about it.

Connect with F5:

Latest F5 Information

Technorati Tags: F5,F5 News,LOIC,threat mitigation,security,web application security,firewall,DNS,infrastructure,news,blog

Integration Demo - Oracle Database Firewall with F5 Application Security Manager

devcentralteam@f5.com (F5 Networks) — Tue, 17 Jan 2012 13:52:00 GMT

#infosec #F5 and #Oracle have partnered together to deliver a unique integration

Many organizations rely on Web applications powered by Oracle databases to run their missions critical business applications. The requirement to protect both the Web tier and the Database tier from unauthorized access, malicious attacks, and SQL Injection is more important than ever. F5 Networks and Oracle have partnered together to deliver a unique integration of the F5 Application Security Manager web application firewall with the Oracle Database Firewall. This recorded demo is designed to show the benefits of enhanced reporting, better security, and a defense in depth architecture that is possible when using these best of breed technologies together. During this demo, the integration of F5's Application Security Manager with Oracle Database Firewall will be explained.

Integration Demo - Oracle Database Firewall with F5's Application Security Manager

Connect with F5:

Latest F5 Information

Technorati Tags: F5,F5 News,Oracle,Database,firewall,BIG-IP,ASM,web application firewall,security,application security,integration,video

Bursting to the IBM SmartCloud

devcentralteam@f5.com (F5 Networks) — Fri, 13 Jan 2012 10:51:34 GMT

Dynamic Provisioning of IBM Smart #Cloud Enterprise (SCE) with #F5 BIG-IP.

Creating a truly elastic data center that is flexible enough to dynamically expand compute resources based on planned or unplanned requirements has many real world applications. Peak demands driving end of month or quarter batch processing is a common enterprise computing challenge. Other opportunities include situations where the need for resources is not as easily predicted such as test / development deadlines, e-commerce, ticketing or social media. Whatever the application, the need for more and more agile infrastructures to facilitate the intelligent use of the cloud will become a necessity.

By leveraging the F5 BIG-IP LTM and on-demand resources from the IBM SmartCloud Enterprise, customers can scale and adjust their services based on need, and dramatically reduce costs at the same time. IBM and F5 provides an agile and flexible architecture that can make the most of what the enterprise is utilizing today, as well as embrace connectivity to the IBM Smart Cloud.

Bursting to the IBM SmartCloud

Connect with F5:

Latest F5 Information

Technorati Tags: F5 News,IBM,cloud,IBM SmartCloud,cloud bursting,architeture,availability,video

F5 Delivers Sensitive Data Securely for RVP

devcentralteam@f5.com (F5 Networks) — Fri, 06 Jan 2012 11:46:23 GMT

“F5 delivers the performance that citizens want and the security we need.” -- Ivo Tuytens, IT Security Manager, RVP

Customer:         RVP

Vertical:            Government

F5 Solution:      BIG-IP Local Traffic Manager / BIG-IP Application Security Manager

Summary:

The Rijksdienst voor Pensioenen (RVP) is the government agency that handles pension information for the citizens of Belgium. When RVP it decided to make pension data accessible over the Internet to all employed people and pensioners in the country, it had two key concerns. First, it had to secure its highly personal and sensitive data from unauthorized access. Second, it had to ensure high performance and availability for a potential user base of many millions of people.

Using F5 BIG-IP products, RVP can now provide citizens with a secure, convenient way to view their pension information online. The high performing F5 solution scales to accommodate traffic spikes, enables the RVP to comply with various regulations, and has also eased IT management tasks.

Business Benefits:

Strong security against all forms of attack

High performance for online users, even during peaks in traffic

Ease of management for the internal IT teams

Case Study

Connect with F5:


Latest F5 Information

F5 News Articles

F5 Press Releases

F5 Events

F5 Web Media

F5 Technology Alliance Partners

F5 YouTube Feed

Technorati Tags: F5,F5 News,RVP,ASM,LTM,application security,security,iRules,case study,scalability,BIG-IP,government,blog

The F5 Dynamic Data Center

devcentralteam@f5.com (F5 Networks) — Wed, 21 Dec 2011 11:28:37 GMT

#infosec #fasterapp This video sets the stage for IT having to manage multiple networking challenges when faced with a natural disaster causing their data center to shut down.

With careful planning, the evolution of the network and application delivery allows the single point of control to automate, provision and secure their virtual and cloud environments.

The F5 Dynamic Data Center

Resources

F5 Security Vignette: Proactive Security

F5 Security Vignette: DNSSEC Wrapping

F5 Security Vignette: Hacktivism Attack

F5 Security Vignette: SSL Renegotiation

F5 Security Vignette: Credit Card iRule

F5 Security Vignette: Apache HTTP RANGE Vulnerability

F5 Security Vignette: iHealth

Security is our Job

F5 YouTube Feed

Connect with F5:


Latest F5 Information

F5 News Articles

F5 Press Releases

F5 Events

F5 Web Media

F5 Technology Alliance Partners

F5 YouTube Feed

Technorati Tags: F5,F5 News,dynamic data center,security,performance,availability,video

F5 Security Vignette: iHealth

devcentralteam@f5.com (F5 Networks) — Mon, 19 Dec 2011 14:35:00 GMT

#infosec #cybersecurity Security is a never ending battle. The bad guys advance, we counter, they cross over ... you're just never done.

To give our side an edge we do a lot of research. If we were going to sum up the role of security in corporate IT today we'd have to say it's to "be prepared." This series looks at many of those security concerns which can be addressed proactively, before they are exploited or become a fire drill.

F5 Security Vignette: iHealth

Related:

F5 Security Vignette: Proactive Security

F5 Security Vignette: DNSSEC Wrapping

F5 Security Vignette: Hacktivism Attack

F5 Security Vignette: SSL Renegotiation

F5 Security Vignette: Credit Card iRule

F5 Security Vignette: Apache HTTP RANGE Vulnerability

Security is our Job

F5 YouTube Feed

Connect with F5:


Latest F5 Information

F5 News Articles

F5 Press Releases

F5 Events

F5 Web Media

F5 Technology Alliance Partners

F5 YouTube Feed

Technorati Tags: F5,F5 News,security,web application security,iHealth,video

F5 Security Vignette: Apache HTTP RANGE Vulnerability

devcentralteam@f5.com (F5 Networks) — Thu, 15 Dec 2011 14:28:00 GMT

#infosec If we were going to sum up the role of security in corporate IT today we'd have to say it's to "be prepared."

This series looks at many of those security concerns which can be addressed proactively, before they are exploited or become a fire drill.

When we hear about an Apache vulnerability, it gets our attention. In this case the issue was the way Apache handles HTTP RANGE headers, which are used to request individual sub-ranges of a given response, instead of the entire response. The problem is that responding to an HTTP RANGE request is computationally expensive. A simple iRule fixes this.

F5 Security Vignette: Apache HTTP RANGE Vulnerability

Related:

F5 Security Vignette: Proactive Security

F5 Security Vignette: DNSSEC Wrapping

F5 Security Vignette: Hacktivism Attack

F5 Security Vignette: SSL Renegotiation

F5 Security Vignette: Credit Card iRule

Security is our Job

Connect with F5:

Latest F5 Information

F5 News Articles

F5 Press Releases

F5 Events

F5 Web Media

F5 Technology Alliance Partners

F5 YouTube Feed

Technorati Tags: F5,F5 News,security,web application security,apache,HTTP,threat mitigation,video

F5 Security Vignette: Credit Card iRule

devcentralteam@f5.com (F5 Networks) — Tue, 13 Dec 2011 12:11:19 GMT

The consequences of exposing hundreds of thousands of customer credit card numbers is unthinkable. Fines, lawsuits, damaged brand -- the effects can be catastrophic. Even if it was accidental, the effect would be the same.

If we were going to sum up the role of security in corporate IT today we'd have to say it's to "be prepared." This series looks at many of those security concerns which can be addressed proactively, before they are exploited or become a fire drill.

F5 Security Vignette: Credit Card iRule

Related:

F5 Security Vignette: Proactive Security

F5 Security Vignette: DNSSEC Wrapping

F5 Security Vignette: Hacktivism Attack

F5 Security Vignette: SSL Renegotiation

Security is our Job

F5 BIG-IP Platform Security

Connect with F5:

Latest F5 Information

F5 News Articles

F5 Press Releases

F5 Events

F5 Web Media

F5 Technology Alliance Partners

F5 YouTube Feed

Technorati Tags: F5,F5 News,security,credit card,data scrubbing,data leak prevention,iRules,video

F5 Security Vignette: SSL Renegotiation

devcentralteam@f5.com (F5 Networks) — Thu, 08 Dec 2011 12:25:00 GMT

The premise of the SSL Renegotiation DOS attack is simple: "An SSL/TLS handshake requires at least 10 times more processing power on the server than on the client". If a client machine and server machine were equal in RSA processing power, the client could overwhelm the server by sending ten times as many SSL handshake requests as the server could service. The counter measure against the attacks was to write an iRule to limit renegotiation requests to 5 per minute per session.

If we were going to sum up the role of security in corporate IT today we'd have to say it's to "be prepared." This series looks at many of those security concerns which can be addressed proactively, before they are exploited or become a fire drill.

F5 Security Vignette: SSL Renegotiation

Related:

F5 Security Vignette: Proactive Security

F5 Security Vignette: DNSSEC Wrapping

F5 Security Vignette: Hacktivism Attack

Security is our Job

F5 BIG-IP Platform Security

Connect with F5:


Latest F5 Information

F5 News Articles

F5 Press Releases

F5 Events

F5 Web Media

F5 Technology Alliance Partners

F5 YouTube Feed

Technorati Tags: F5,F5 News,security,video,SSL,SSL renegotiation,threat mitigation

I Scream, You Scream, We all Scream for Ice Cream (Sandwich)

devcentralteam@f5.com (F5 Networks) — Wed, 07 Dec 2011 11:23:20 GMT

#mobile For IT and security professionals, Android 4.x (Ice Cream Sandwich) is a big deal

For most people (who don’t live in the midwest), talking Ice Cream in the middle of the winter may be a bit odd, unless you’re talking about Google’s latest Android release (4.x). “Ice Cream Sandwich” is an important step forward for the mobile operating system platform in that it includes much needed enterprise security features including support for MDMs and a SSL-VPN Framework.

This is an important step forward because of the growing demand upon IT by employees to support mobile platforms within the enterprise. A secure remote access solution is a must have for any organization when supporting remote and mobile access, so providing a framework upon which vendors could develop the appropriate clients is paramount to getting the right tools into the hands of IT.

F5 has previously supported Android devices with its BIG-IP Edge Portal but like many had run into the lack of an appropriate underlying framework in our quest to provide a full featured SSL-VPN client. The result was a smattering of support for specific manufacturer’s devices (like Samsung), but most clients were left unsupported.

So we did two things: First, we grabbed Ice Cream Sandwich as soon as we could and started developing atop its new security framework. Second, we jumped onto the “rooted” wagon and developed a BIG-IP Edge Client for “rooted” devices* to extend support to devices running versions prior to Android 4.x.

The result is two new clients for BIG-IP Edge and an updated Edge Portal v1.0.1 for Android . The Edge Portal update includes improved uninstallation, support for unique device identification and client certificate support for Firepass, as well as extended SSL error information.

You can download the latest Edge Client for Android devices - as well as find our previous device-specific and general clients – from the Android Marketplace.

RESOURCES & DOWNLOADS

BIG-IP® Edge Client™ for all Android 4.x (Ice Cream Sandwich) devices
https://market.android.com/details?id=com.f5.edge.client_ics

BIG-IP® Edge Client™ for Android rooted devices
https://market.android.com/details?id=com.f5.edge.client_root

BIG-IP Edge Portal™ v1.0.1 for Android
https://market.android.com/details?id=com.f5.edge.portal

FirePass Controller and BIG-IP Edge Client for Android documentation

Other Android BIG-IP Edge Clients
https://market.android.com/details?id=com.f5.edge.client
https://market.android.com/details?id=com.f5.edge.portal

* F5 does NOT recommend that users root their devices. But for IT professionals, this is an option for demonstration or testing purposes

Connect with F5:


Latest F5 Information

F5 News Articles

F5 Press Releases

F5 Events

F5 Web Media

F5 Technology Alliance Partners

F5 YouTube Feed

Technorati Tags: F5,F5 News,Android,Ice Cream Sandwich,rooted,BIG-IP,Edge,SSL-VPN,client,4.x,mobile,blog

F5 Security Vignette: Hacktivism Attack

devcentralteam@f5.com (F5 Networks) — Tue, 06 Dec 2011 13:52:00 GMT

If we were going to sum up the role of security in corporate IT today we'd have to say it's to "be prepared." This series looks at many of those security concerns which can be addressed proactively, before they are exploited or become a fire drill. The F5 Security Vignette series looks at various security concerns, vulnerabilities and attacks which can cause headaches for Corporate IT and the business integrity overall.

F5 Security Vignette: Hacktivism Attack

Related Resources:

F5 Security Vignette: Proactive Security

F5 Security Vignette: DNSSEC Wrapping

F5 YouTube Channel

Connect with F5:


Latest F5 Information

F5 News Articles

F5 Press Releases

F5 Events

F5 Web Media

F5 Technology Alliance Partners

F5 YouTube Feed

Technorati Tags: F5,F5 News,hacktivism,security,video

When is an IPS not a WAF?

devcentralteam@f5.com (F5 Networks) — Mon, 05 Dec 2011 14:31:33 GMT

Answer: All the time #infosec

Despite the fact that web application firewall (WAF) solutions have been around for quite a number of years, there still seems to be confusion around what it is they do. In particular, there’s a troubling trend that tries to compare WAF with IPS (Intrusion Prevention Systems). This is essentially the same as trying to shove a square peg into a round hole. Or, if you prefer, viewing everything as a nail because all you have is a hammer.

While it is true that IPS technology is increasingly looking up the network stack toward the application layers, it is also still true that WAF technology is specifically designed to detect and prevent web application attacks. WAF solutions at one time were similar to IPS in that they leveraged signature based comparisons against web requests to detect such attacks, but this has not been standard practice in many years due to the rapid advances and increasing sophistication of web application attacks.

Thus it is the case that when WAF is compared with IPS, only one technology is truly exercised in a meaningful way. Just as one would not expect a Prius to perform well in a test designed to evaluate the speed and agility of a Formula I racing car, it’s likely an IPS will fall short of expectations when evaluated solely as an WAF. Because it’s not a WAF, it’s an IPS.

The only way around this reality is to change the definition of either a WAF or an IPS or the criteria by which you judge them (which in some circles has the same effect). In other words, change the premise upon which you are operating and you can change the outcome.

A recent review appears to have been operating on that principle. Larry Suto, by no means a neophyte in the realm of security, analyzed the “effectiveness of Web Application Firewalls” but did not, unfortunately, actually analyze their effectiveness against the very attacks and methods a WAF is designed to prevent in the first place.

For example, there was no coverage of real web application issues. No parameter tampering, no CSRF, no cookie poisoning, no session fixation. The attacks that cannot be stopped by an IPS but for which a WAF is specifically designed were never evaluated. The attacks against which solutions were evaluated further ignored false positive rates. It is very easy to create rules that will block any attack, but it is not so easy to create rules that will do so with a minimal false positive rate. And nothing is more frustrating to end-users than false positives on a WAF or IPS that result in the inability to do their job.

Larry’s use of a single scanner was also problematic in that while using dynamic application security testing (DAST) applications can teach an IPS how to protect against the attack syntax it generates, there are many more variants of that attack in the real world, none of which a DAST generates. Consider the use of encoding and obfuscation techniques to “hide” the attack. This can generally be considered a “WAF evasion” technique, something else which was not considered in the evaluation but which is increasingly problematic as attackers learn to sneak past security solutions to reach their targets. These variations on a theme are part of the reason WAF technology has matured beyond simply signature-based protections. The permutations possible of a single attack type are nearly immeasurable given the nature of scripting and encoding and web-based protocols.

Another characteristic of a WAF that was not explored is the ability of WAF to perform deep HTTP inspection. While an IPS runs in a raw HTTP context (search the signature on all request raw data), a WAF will run each signature on specific HTTP locations (URL, Parameters, Headers) giving better control on signatures and preventing false positives. This is one of the major differentiators between IPS and WAF as IPS continues to look up the stack at the application layers.

Interestingly enough, if you take a WAF and test it like an IPS, you will find out that it is good as an IPS. [Tom Spector] A colleague had a great example of comparing a firewall to a router with an access list. If all you test is the access list, then you could also claim that a firewall and router provide the same security, though you’re likely to be laughed out of just about room full of security practitioners.

What Larry appears to have actually tested was a WAF’s signature detection coverage. Why is this important? Consider the potential variations on a signature that are possible in the real world when an attacker is executing an SQL injection attack. Using a DAST to teach an IPS is a good way to generate signatures. But it is not a good way to generate the permutations of that attack that are not only possible but likely to be used in a real attack.

For example, let’s assume that the vulnerability scanner used to evaluate the solutions is looking for SQL injection and the signatures he will be using are payloads containing fragments such as:

‘ OR ‘1’=’1

‘ OR ‘2’=’1

If the application is vulnerable the server response will be different for each of these payloads. But a real attacker will be aware of security filters in the data path to the web application and will almost certainly use the following payloads in order to evade attack detection:

‘OR’1’=’1 (without spaces)

‘ XOR ‘1’=’1 (XOR)

‘ oR ‘1’=’1 (lower/upper case)

‘ OR ‘2’=’2 (and so on)

‘ OR ‘2’>’1 (and < !=)

‘ || ‘1’=’1 (|| represent OR)

‘ OR true=true

The methodology used to test the SQL injection signatures is not capable of also detecting the variations commonly used to evade that detection. The IPS does not have the capability to deal with variations – at least not out of the box and rarely without comprehensive manual signature design.

Larry’s evaluation is not a poor one, it’s just not a meaningful evaluation of web application firewalls. It’s more an evaluation of the ability of a WAF to act like a semi-application aware IPS. Without actually testing a WAF as a WAF, complete with the variations and key performance metrics by which WAF solutions are judged today (false positive rates), the evaluation is unfortunately little more than the measurement of how far a square peg can be shoved into a round hole.

Additional Resources:

Ofer Shezaf’s View of Larry Suto’s Review

Larry Suto - Analyzing Effectiveness of Web Application Firewalls

SQL Injection Evasion Detection

XSS Evasion—Trying to hide in the all-concealing torchlight

Connect with F5:


Latest F5 Information

F5 News Articles

F5 Press Releases

F5 Events

F5 Web Media

F5 Technology Alliance Partners

F5 YouTube Feed

Technorati Tags: F5,F5 News,WAF,IPS,Larry Suto,SQLi,XSS,CSRF,security,web application security,review,blog

F5 Security Vignette: #DNSSEC Wrapping

devcentralteam@f5.com (F5 Networks) — Fri, 02 Dec 2011 10:21:57 GMT

The dirty little secret of the Internet is how insecure DNS really is.

The good news is, there's a solution -- DNSSEC. It secures the DNS query and response process. The F5 Security Vignette series looks at various security concerns, vulnerabilities and attacks which can cause headaches for Corporate IT and the business integrity overall.

F5 DNSSEC Wrapping

Resources:

F5 Security Vignette: Proactive Security

F5 YouTube Channel

Latest F5 Information

F5 News Articles

F5 Press Releases

F5 Events

F5 Web Media

F5 Technology Alliance Partners

F5 YouTube Feed

Technorati Tags: F5,F5 News,security,DNS,DNSSEC,infosec,video

F5 Security Vignette: Proactive Security

devcentralteam@f5.com (F5 Networks) — Thu, 01 Dec 2011 10:16:05 GMT

#infosec Security is such a small word considering the breadth of concerns it must address.

Welcome to the F5 Security Vignette series, in which we’ll look at various security concerns, vulnerabilities and attacks which can cause headaches for Corporate IT and the business integrity overall. If we were going to sum up the role of security in corporate IT today we’d have to say it’s to “be prepared.” This series looks at many of those security concerns which can be addressed proactively, before they are exploited or become a fire drill.

This video covers SSL Certificates.

Resources

F5 YouTube Channel

Connect with F5:


Latest F5 Information

F5 News Articles

F5 Press Releases

F5 Events

F5 Web Media

F5 Technology Alliance Partners

F5 YouTube Feed

Technorati Tags: F5,F5 News,video,security,SSL,certificates

Greek Yellow Pages Speeds It Up and Serves It Out Securely with F5

devcentralteam@f5.com (F5 Networks) — Mon, 28 Nov 2011 14:05:26 GMT

“BIG-IP LTM does exactly what we need it to do…I highly recommend #F5.” -- George Pagaremos, IT Manager, Greek Yellow Pages

Customer:     Greek Yellow Pages

Vertical:         eCommerce

F5 Solution:   BIG-IP Local Traffic Manager (LTM)

Summary:

Every year, millions of people turn to Greek Yellow Pages to look up information, and they expect to find answers almost instantly. The company consequently has to ensure that its website provides exceptionally fast performance. At the same time, Greek Yellow Pages must also protect its valuable online database from web scraping attacks.

A single product from F5 provided the solution to both these business challenges. F5 BIG-IP Local Traffic Manager Application Delivery Controllers improve customer experience by significantly accelerating page loading times, and they protect the site from web scraping attacks. In addition, the solution cut IT management and administration time by 60 percent.

Business Benefits:

Increases web application speed by 70%

Improves protection against web scraping

Reduces IT administration time by 60%

Case Study

BIG-IP Information

Connect with F5:


Latest F5 Information

F5 News Articles

F5 Press Releases

F5 Events

F5 Web Media

F5 Technology Alliance Partners

F5 YouTube Feed

Technorati Tags: F5,F5 News,customer,Greek Yellow Pages,acceleration,security,optimization,iControl,iRules,integration,BIG-IP,BIG-IP LTM,load balancing,blog

Scaling VDI Architectures

devcentralteam@f5.com (F5 Networks) — Thu, 17 Nov 2011 12:35:50 GMT

Scaling #VDI requires scaling its entire supporting infrastructure as well as operations

Something application developers have known for years is that the success of an application deployment depends as much on scaling dependencies as it does on scaling the focal application. Integration with other application services for a variety of functions requires scalability across all interconnected functions. Operations has similar concerns when it comes to deploying the application - authentication, authorization, access management, logging, and more.

With the increasing push for flexibility and more rapid response by IT, this means paying careful attention to the ability to scale not just the solutions providing the services, but the operational processes that create and maintain policies governing access, security, and performance for applications. It is simply not scalable to expect operations to manually intervene every time a new mobile client appears or core infrastructure is scaled out. A more flexible, adaptable means of scaling operations is required to maintain the efficiencies and cost savings gained through the implementation of virtualization and cloud computing based technology.

Complexity, as they say, is the enemy of security but it is also the enemy of scalability. The more complex the architecture needed to scale an application to hundreds or thousands of users, the less scalable the operational processes become.

While it may be simple to offer virtual applications to a few dozen users, once the user count increases to the many hundreds and beyond, complexity tends to grow exponentially and security and performance concerns get elevated- and that is exactly where F5 enters the picture with its BIG-IP Local Traffic Manager (LTM) with Access Policy Manager (APM) product.

-- F5 Brings Simplicity to Complex Virtual Application Environments, Frank J. Ohlhorst

A major hurdle for VDI (Virtual Desktop Infrastructure) deployments has been in scaling out to meet the demand of large scale and distributed deployments. Technological challenges abound from restrictions imposed by the virtualization solutions themselves to the more traditional challenges of scaling architectures encountered in many application deployments. What sets VDI apart is its assumption that users will be using a variety of endpoints and that those endpoints are likely to be both remote and local and roaming. This complicates delivery and security policies as it requires many more moving parts to support such a deployment, increasing the potential for a failure to scale operations as well as the architecture.

BIG-IP Access Policy Manager (APM) addresses these concerns handily whether the VDI implementation comprises Citrix, VMware, Microsoft, or a combination of all three. The flexibility of BIG-IP APM and BIG-IP Local Traffic Manager (LTM) provides the foundation for designing an architecture capable of scaling with the VDI implementation while simultaneously addressing more esoteric challenges with respect to end-user location. Additionally, the offloading capabilities of the BIG-IP system (on which APM and LTM are deployed) improves performance as well as virtual machine density, addressing one of the most common end-user complaints regarding VDI deployments: performance.

In essence, APM gives administrators dynamic control of the delivery and security components of the major virtualization solutions, consolidating and unifying elements such as access, security and policy management. For example, in a typical Citrix XenApp/XenDesktop implementation, APM can replace Citrix’s authentication management, Secure Ticket Authority (STA), NetScaler and other components that are required for Citrix sourced enterprise deployment. What’s more, APM brings portal access, SSL VPN tunnels and SSL offloading into the equation, which improves server and application performance and simplifies security management.

Much the same can be said for VDI deployments based upon VMware View, where APM also helps to bring unified management, ease of provisioning and enhanced security to the enterprise. Interestingly, APM can support VMware View and Citrix XenApp/XenDesktop concurrently, as well as adding RDP and other technologies to the mix.

F5 Brings Simplicity to Complex Virtual Application Environments, Frank J. Ohlhorst

Frank Ohlhorst recently reviewed BIG-IP APM with a focus on scaling VDI deployments and you can read his review and experiences in F5 Brings Simplicity to Complex Virtual Application Environments.

More F5 Virtualization Solutions:

VMware Solution Brief for F5 and View

Enable Single Namespace for VMware View Deployments

Optimize Virtual Desktop Deployments for VMware View

Delivering Virtual Desktop Infrastructure with a Joint F5-Microsoft Solution

In 5 Minutes or Less Video - BIG-IP APM & Citrix XenApp

Citrix XenApp or XenDesktop (BIG-IP APM v11)

iApp Templates

Citrix XenApp/XenDesktop APM Template

Citrix XenApp/XenDesktop Combined Load-balancing iApp

VMware View 5 iApp Template

Connect with F5:


Latest F5 Information

F5 News Articles

F5 Press Releases

F5 Events

F5 Web Media

F5 Technology Alliance Partners

F5 YouTube Feed

Technorati Tags: F5,F5 News,review,virtualization,VDI,Citrix,VMware,XenApp,XenDesktop,View,BIG-IP APM,BIG-IP LTM,BIG-IP,v11,blog

F5 News

F5 - iApp for VMware View

Latest F5 Information

F5 - Mobile Device Support for VMware View

Latest F5 Information

F5 - Simplifying Access for VMware View

Latest F5 Information

Rackspace - F5 Case Study

Latest F5 Information

F5 - Availability and Scalability for VMware View

Latest F5 Information

Overview: F5 for VMware View

Latest F5 Information

Human Kinetics - F5 Case Study

Latest F5 Information

Blue Cross Blue Shield Kansas City - F5 Case Study

Latest F5 Information

Mobile and IPv6: Why Cows Connecting to the Internet Affects You

IMPACT on the ENTERPRISE

Latest F5 Information

From LOIC to a Click Party–The Danger in Connection-Based Attacks

CONNECTIONS COUNT

LEGIT and NON-LEGIT

Latest F5 Information

Integration Demo - Oracle Database Firewall with F5 Application Security Manager

Latest F5 Information

Bursting to the IBM SmartCloud

Latest F5 Information

F5 Delivers Sensitive Data Securely for RVP

Latest F5 Information

The F5 Dynamic Data Center

Latest F5 Information

F5 Security Vignette: iHealth

Latest F5 Information

F5 Security Vignette: Apache HTTP RANGE Vulnerability

Latest F5 Information

F5 Security Vignette: Credit Card iRule

Latest F5 Information

F5 Security Vignette: SSL Renegotiation

Latest F5 Information

I Scream, You Scream, We all Scream for Ice Cream (Sandwich)

RESOURCES & DOWNLOADS

BIG-IP® Edge Client™ for all Android 4.x (Ice Cream Sandwich) devices https://market.android.com/details?id=com.f5.edge.client_ics

BIG-IP® Edge Client™ for Android rooted devices https://market.android.com/details?id=com.f5.edge.client_root

BIG-IP Edge Portal™ v1.0.1 for Android https://market.android.com/details?id=com.f5.edge.portal

FirePass Controller and BIG-IP Edge Client for Android documentation

Other Android BIG-IP Edge Clients https://market.android.com/details?id=com.f5.edge.client https://market.android.com/details?id=com.f5.edge.portal

Latest F5 Information

F5 Security Vignette: Hacktivism Attack

Latest F5 Information

When is an IPS not a WAF?

Latest F5 Information

F5 Security Vignette: #DNSSEC Wrapping

Latest F5 Information

F5 Security Vignette: Proactive Security

Resources

Latest F5 Information

Greek Yellow Pages Speeds It Up and Serves It Out Securely with F5

Latest F5 Information

Scaling VDI Architectures

More F5 Virtualization Solutions:

Latest F5 Information

BIG-IP® Edge Client™ for all Android 4.x (Ice Cream Sandwich) devices
https://market.android.com/details?id=com.f5.edge.client_ics

BIG-IP® Edge Client™ for Android rooted devices
https://market.android.com/details?id=com.f5.edge.client_root

BIG-IP Edge Portal™ v1.0.1 for Android
https://market.android.com/details?id=com.f5.edge.portal

Other Android BIG-IP Edge Clients
https://market.android.com/details?id=com.f5.edge.client
https://market.android.com/details?id=com.f5.edge.portal