Mobile & Cloud computing are exciting trends that are driving business growth but also bring with them increased risk. In many cases, these varied platforms being brought into the company by the business and then dropped into your lap to figure out the security impact on the company.

And the security risk is real. Here’s a few highlighted by CSO Magazine, online:

• Smart Phone (and tablet) Data breaches
• Need for better access control and identity management
• The Risk of multiple cloud tenants
• Ongoing compliance concerns
• Need and emergence for cloud standards and certifications.

And these issues are the tip of the iceberg.

We had used Linux based gateways and firewalls for years, I had toyed with Linux IPsec about three years ago when we setup our initial VPN. Then it seemed too cumbersome and I couldn’t find a tool to create the VPN easily and quickly. So we bought new hardware from the US and deployed it in India and US. The FSV318 is a good router was easy to setup and hardly ever gave us any trouble till one of them passed on. We used it for everything from SNMP to VoIP. However there was no monitoring reporting or any fancy stuff.

This time around I decided to bite the bullet and decided to go pure Linux. The ipsec was built in kernel, and better supported. I referred to the instructions here.

http://www.ipsec-howto.org/x304.html

http://ipsec-tools.sourceforge.net/checklist.html

Highlevel VPN Diagram

On a high level here is what I did

• Turned off the firewall on both gateways. and enabled ip forwarding
  sysctl -w net.ipv4.ip_forward=1
• Updated the kernels and using yast.
• Updated the IPsec tools using yast.
• Configured the Security Association Database and Security Policy DB using setkey.conf
• Turned on the tunnel using setkey -f
• Tested the ssh ping http between red and blue zones. Note: routers are not able to access the opposite network directly.
• Modified /etc/sysconfig/SuSEfirewall2 and added following
  * FW_NOMASQ_NETS=”0/0,10.50.0.0/21″ on chigateway and similarly on the kolgateway.
  *FW_FORWARD=”10.50.0.0/21,10.60.8.0/21 10.60.8.0/21,10.50.0.0/24″ on both gatweays

That’s it it worked like charm.

Pi, Greek letter (), is the symbol for the ratio of the circumference of a circle to its diameter. Pi Day is celebrated by math enthusiasts around the world on March 14th. Pi = 3.1415926535…

With the use of computers, Pi has been calculated to over 1 trillion digits past the decimal. Pi is an irrational and transcendental number meaning it will continue infinitely without repeating. The symbol for pi was first used in 1706 by William Jones, but was popular after it was adopted by the Swiss mathematician Leonhard Euler in 1737. Learn more about Pi.

From www.piday.com

In conversations with clients, prospects and vendors about IAM solutions, Gartner reports and magic quadrants often come up.  The reports are cited and recited by all vendors proving respective strength. I have had a chance to read some of the reports and always wondered who are the analysts who pass judgment with such authority on subject matters. No matter how refined a study, before I trust a judgment I need to know who the judge is, who are the people behind it, what are their qualifications and motives. So when I saw this opportunity to have a first hand experience was listening and interacting with the analyst I jumped at it.

Going into the conference I wondered. What is the methodology of their research? What is the depth of their knowledge when they make a statement and make recommendations? How much is all this punditry qualified. How are they influenced by corporate sponsors and contracts.? How to read the magic quadrant? Are there any other dimensions to the quadrant ? What are the sources of the information for the analyses?

A of the slide from Earl Perkins' Keynote

I stepped into the keynote with an open mind. The first impression was very good.  Earl Perkins gave a very good insight on to the state of the IAM  and how it has matured over the years. It was a fresh light on the subject. A holistic approach of looking at IAM. Earl was impressive, authoritative his talk was very informative. If nothing else one should listen to the keynote. So it seemed that the analysts do know their subject matter at a high level.

I attended a number of sessions here is My Agenda for the event. One of the most popular session was Best Practices for Vendor Selection – The Gartner Magic Quadrant. The analyst explained additions, removals and changes from last year’s quadrants. They downplayed using this tool as the primary means of selecting a vendor. As one analyst summed up -  “Suffice to say, that choosing the vendor in any particular corner of the magic quadrant, doesn’t necessarily mean the best or the worst possible option for your enterprise”. The magic quadrant is not as holy as it is made up to be. It was good that the analysts did not present it otherwise.

During my conversations with analysts I noticed most of them have command on the subject matter they are knowledgeable about marketplace, about which vendor has what set of features . There was hardly any talk of open source or open standards. I guess there isn’t money in sponsorships there. The analysts were very proficient in tuning the ideas for upper management.

Having a background in engineering, found the language, the presentations, the conversations at a very high level. Very few analysts actually implement the products they review. It was easy to stump them about nuances of vendors and products. Admittedly

A chart from the event

most of their knowledge was based on informations from vendors themselves, discussions with clients. They will have a fabulous answer when you ask them “How do I create and present the use case of IAM to upper management ?” but you will left wanting for more if you ask “Is reverse proxy based Web Access Management easier to implement than agent based Access Management”. There was a general lack of attention to details and more attention to how well a vendor markets their product. What I understood was a vendor who spends more money on sales will score relatively higher points in Gartner Books.

Gartner reports, charts, quadrants are academic research papers wannabe, but with generalizations, and somewhat lack of depth. However the value of the research should not be completely discounted. They do provide to a level of understanding to non technical and management (read pointy haired bosses) people who otherwise will get completely lost in details.

Overall the event was fruitful for me. I came out admiring the analysts for what and how they presented. It broadened my knowledge and got a new perspective of looking at technology.

I have subscription to the Gartner On Demand portal to replay the keynotes, session etc. And thanks to them they allow sharing of the content. So if you are interested in viewing the recoded sessions and keynotes drop me an email at arun dot binaykia at sathtech dot com and I will send the credentials to you.

We will strive to bring meaningful and useful content to the readers. Your comments are welcome @ webmaster at sathtech com