Roger's Information Security Blog

As I warned, I attended a BlueCoat seminar on Wednesday and I’m getting a few days worth of blog posts from that.

In March of 2009, I blogged that I was testing the BlueCoat ProxyClient.   The ProxyClient provides URL filtering via WebPulse and also attempts to provide acceleration to VPN users and users on slower network sites.   Each feature can be enabled or disabled automatically depending on location.  Last year I had ProxyClient deployed to the IT department for quite a while until it was time to test some HTTP SaaS solutions.  At that point I uninstalled ProxyClient from all computers.   I didn’t return it after I completed my HTTP bake-off.   I only renewed with BlueCoat for one year and didn’t want to roll out something and then switch it only a year out.

Looking at this months desktop virus reports, its pretty clear that a large number of the infections occur while systems are remote.   Outside the facility they currently only have SEP11 as protection.   For a long while I felt that if I was going to offer protection, URL filtering wasn’t good enough.   I needed antivirus.   But from what I wrote about yesterday with WebPulse, I am now thinking this is a significant step up security wise.   Also it doesn’t have the SaaS risk. 

To be sure some of our users might revolt if we put one more security product on “their” desktop.   But I a strong case can be made for deploying ProxyClient.   If you own BlueCoat and you pay for BlueCoat WebFilter, then the ProxyClient is no charge.  At most companies, users are increasingly mobile.   Unless you’ve got some other strong protections (such as only allowing browsing through an always tunnel vpn connection, and also removing local admin rights) I’d take a strong look at adding this protection.

As I mentioned, I was at a BlueCoat Web Security briefing on Wednesday.

Most of the talks covered things I already knew.   I’m well aware of BlueCoat’s product line, and the web security stuff I received that in a meeting earlier in the year.   But the security stuff was good review.   It is rather interesting how BlueCoat is using a hybrid model for security.   Rather than simply having an Antivirus Engine and a URL filter database on site, they use the WebPulse Cloud service to provide better protection. 

At one point URL filtering exclusively used a local database that was updating periodically.   When sites aren’t categorized,  BlueCoat used to use a service called Dynamic Real-Time Threat Rating to submit the URL to the cloud and see if categorization was available, either in a newer database or through dynamic categorization.   That has evolved into BlueCoat Webpulse.   It’s a cloud based service that uses 8-10 heuristic scanners to analyze requested websites.    With 62 million global users, there is a certain hope that a malicious site would have been seen and been categorized by the service.

This is why I don’t actually see very many viruses detected by the Kaspersky AV scanner that scans traffic.   A lot of malicious sites are already categorized and in the block list.   I need to check out BlueCoat Reporters reports on the malicious software category if I want to better justify web security.

While BlueCoat does use some of the more advanced detection functionality of Kaspersky locally on the appliance, they are doing detection in the cloud that couldn’t be done on locally on the appliance.

On Wednesday, I went to the BlueCoat Security Briefing at the Tyson’s Corner Marriott. 

The big news for me was that our hardware (SG810-B and SG510-B) which I’d been led to believe was going to end-of-support in November is good for another year.  Even today the end of life matrix says TBD, but typically end of life comes three years after end of sale.   I had only renewed BlueCoat for one year last year based on the end of life information provided by the sales rep.   That’s good news.   If we stick with BlueCoat we’ll be able to get another year of life from this hardware.   I dont anticipate replacing this hardware to be cheap, its good to put that off.  However it does make it a bit tougher to justify leaving BlueCoat because of cost.

There were two briefings.   One by Mark Stanford, Director of Sales Engineering and another by Jeff Barker VP of Technical Marketing.    Technical Marketing.   Hmmm.   Sounds like an oxymoron.  

I plan string out posts about this meeting for a few days rather than engaging in one long post now.