Comments on: Friends, welcome to the Yoggie CEO blog http://www.yoggie.com/blog/2007/11/15/friends/ The Blog of Shlomo Touboul, CEO and founder of Yoggie Security Systems Sat, 22 Nov 2008 06:27:43 +0000 http://wordpress.org/?v=2.5.1 By: Visitor http://www.yoggie.com/blog/2007/11/15/friends/#comment-31 Visitor Wed, 28 May 2008 15:09:54 +0000 http://www.yoggie.com/Blog/?p=1#comment-31 I agree and support 100% of this posting. I'm the IT director at a Montréal based company providing telecommunications systems and services for the small and medium size business market. We need better security and I our client too. All that with effective costs of deployement. We have a cuple xServe and 24 workstations all OSX based. Our IT infrastructure is rock solid since we change from Windows and we've converted many of our clients promoting Mac systems. Unfortunately software based security has its limits. Respectfully, Jim I agree and support 100% of this posting. I’m the IT director at a Montréal based company providing telecommunications systems and services for the small and medium size business market. We need better security and I our client too. All that with effective costs of deployement. We have a cuple xServe and 24 workstations all OSX based. Our IT infrastructure is rock solid since we change from Windows and we’ve converted many of our clients promoting Mac systems. Unfortunately software based security has its limits.

Respectfully,

Jim

]]> By: Shlomo Touboul http://www.yoggie.com/blog/2007/11/15/friends/#comment-17 Shlomo Touboul Sat, 24 May 2008 04:41:25 +0000 http://www.yoggie.com/Blog/?p=1#comment-17 Dear Joseph, As you mentioned, Yoggie Gatekeeper SOHO protects up to five computers and costs less than software yearly subscription for five users. We would love to accommodate your need for more than 5 supported clients and will take it into consideration in our future product planning. Dear Joseph,
As you mentioned, Yoggie Gatekeeper SOHO protects up to five computers and costs less than software yearly subscription for five users. We would love to accommodate your need for more than 5 supported clients and will take it into consideration in our future product planning.

]]> By: Per Ottosen http://www.yoggie.com/blog/2007/11/15/friends/#comment-30 Per Ottosen Tue, 20 May 2008 05:27:27 +0000 http://www.yoggie.com/Blog/?p=1#comment-30 Yoggie, and private sector Submitted by Visitor (not verified) on Mon, 04/07/2008 - 09:48. Dear mr. Shlomo, your idea regardless yoggie, are the first serious effort, to protect the client side of peoples computer, and the idea of moving security out of the computer are just brilliant. I have here in Denmark contact to CERT org. and spoken to the head leader, and ask him to write an news flash about your product, and he was very interested in the yoggie product line. Looking into the future my own opinion are the your compagny will have as much success as microsoft had. People are just now discover how it can be done in a very proffesional way.. THANK YOU FOR THIS PRODUCT. Best and kind regards. Per Ottosen. Yoggie, and private sector
Submitted by Visitor (not verified) on Mon, 04/07/2008 - 09:48.
Dear mr. Shlomo, your idea regardless yoggie, are the first
serious effort, to protect the client side of peoples computer, and the idea of moving security out of the computer are just brilliant. I have here in Denmark contact
to CERT org. and spoken to the head leader, and ask him to
write an news flash about your product, and he was very interested in the yoggie product line. Looking into the future my own opinion are the your compagny will have as much success as microsoft had. People are just now discover
how it can be done in a very proffesional way..
THANK YOU FOR THIS PRODUCT.

Best and kind regards.
Per Ottosen.

]]> By: Shlomo Touboul http://www.yoggie.com/blog/2007/11/15/friends/#comment-23 Shlomo Touboul Tue, 20 May 2008 04:51:05 +0000 http://www.yoggie.com/Blog/?p=1#comment-23 Dear Yuval, The Gatekeeper family of products implements a total of 13 security applications including: Firewall, Intrusion Detection and Intrusion Prevention systems. These applications run outside your computer on top of an external hardened Linux machine. The Personal Firewall and HIPS (Host based Intrusion Prevention Systems) you referred to, run on top of your Windows PC and therefore suffer from the following weaknesses: <ul> <li>They try to stop the attack as it reaches your PC. Gatekeeper stops it before it gets to your PC. It’s like stopping a burglar outside your house vs. stopping him in your living room. </li> <li>They run on top of Windows OS and therefore are vulnerable to Windows vulnerabilities. While Windows is a great general purpose OS it is designed to support applications developed in the past, today’s and tomorrow’s applications. Therefore, it is less secure than a hardened, dedicated and secured OS with a single purpose – to run security applications. </li> <li>When a hacker exploits a new or known Windows vulnerability, he can easily attack the HIPS application, and a very common situation is that the attack prevents the HIPS from getting new signature updates. This makes the attack immune to security applications. This situation is not common on external security devices such as the Gatekeeper since the attack cannot reach it. </li> <li>Performance: offloading the 13 security applications to the Gatekeeper releases many cycles of your PC, so your productivity applications can benefit from better PC performance. </li> <li>Annoying pop up messages: HIPS solutions tend to pop up security related messages to the user who lack the expertise to understand them. End users also lack the knowledge to set up and customize them and usually simply ignore them or worse – stop the HIPS. Gatekeeper’s IDS and IPS operate independently and it’s built-in MLA – Multi Layer Security Agent – takes care of false positives and reduce them to a minimum. The end result is high security level with near zero user intervention. </li> </ul> In general Gatekeeper was designed to provide the end user with the highest level of security, usually found in enterprise networks. Gatekeeper comes with full SNORT implementation, a smart IDS/IPS system that usually is not found on end user desktop and dramatically improves overall security and performance with minimal user interference. Dear Yuval,
The Gatekeeper family of products implements a total of 13 security applications including: Firewall, Intrusion Detection and Intrusion Prevention systems. These applications run outside your computer on top of an external hardened Linux machine. The Personal Firewall and HIPS (Host based Intrusion Prevention Systems) you referred to, run on top of your Windows PC and therefore suffer from the following weaknesses:

  • They try to stop the attack as it reaches your PC. Gatekeeper stops it before it gets to your PC. It’s like stopping a burglar outside your house vs. stopping him in your living room.
  • They run on top of Windows OS and therefore are vulnerable to Windows vulnerabilities. While Windows is a great general purpose OS it is designed to support applications developed in the past, today’s and tomorrow’s applications. Therefore, it is less secure than a hardened, dedicated and secured OS with a single purpose – to run security applications.
  • When a hacker exploits a new or known Windows vulnerability, he can easily attack the HIPS application, and a very common situation is that the attack prevents the HIPS from getting new signature updates. This makes the attack immune to security applications. This situation is not common on external security devices such as the Gatekeeper since the attack cannot reach it.
  • Performance: offloading the 13 security applications to the Gatekeeper releases many cycles of your PC, so your productivity applications can benefit from better PC performance.
  • Annoying pop up messages: HIPS solutions tend to pop up security related messages to the user who lack the expertise to understand them. End users also lack the knowledge to set up and customize them and usually simply ignore them or worse – stop the HIPS. Gatekeeper’s IDS and IPS operate independently and it’s built-in MLA – Multi Layer Security Agent – takes care of false positives and reduce them to a minimum. The end result is high security level with near zero user intervention.

In general Gatekeeper was designed to provide the end user with the highest level of security, usually found in enterprise networks. Gatekeeper comes with full SNORT implementation, a smart IDS/IPS system that usually is not found on end user desktop and dramatically improves overall security and performance with minimal user interference.

]]> By: Yuval http://www.yoggie.com/blog/2007/11/15/friends/#comment-22 Yuval Tue, 20 May 2008 04:50:40 +0000 http://www.yoggie.com/Blog/?p=1#comment-22 Dear Shlomo, How do you differentiate the GK device from "personal firewalls" applications aka HIPS? And how do you deal with the h/w support issues? Thanks Yuval Dear Shlomo, How do you differentiate the GK device from “personal firewalls” applications aka HIPS? And how do you deal with the h/w support issues?

Thanks Yuval

]]> By: Shlomo Touboul http://www.yoggie.com/blog/2007/11/15/friends/#comment-27 Shlomo Touboul Thu, 27 Mar 2008 05:17:14 +0000 http://www.yoggie.com/Blog/?p=1#comment-27 problem with web filtering... Dear Yoggie user, First of all thank you for the kind words. We are always very happy and proud to meet satisfied Yoggie customers. Thank you also for providing us with this valuable feedback. After checking with the SurfControl Web Filtering database servers, we've discovered it's simply a matter of a delay in the database update. This has now been solved, and the sites you've mentioned, along with all the rest of the sites in the database are categorized properly. problem with web filtering…
Dear Yoggie user,

First of all thank you for the kind words. We are always very happy and proud to meet satisfied Yoggie customers.
Thank you also for providing us with this valuable feedback. After checking with the SurfControl Web Filtering database servers, we’ve discovered it’s simply a matter of a delay in the database update. This has now been solved, and the sites you’ve mentioned, along with all the rest of the sites in the database are categorized properly.

]]> By: Shlomo Touboul http://www.yoggie.com/blog/2007/11/15/friends/#comment-26 Shlomo Touboul Tue, 25 Mar 2008 05:17:04 +0000 http://www.yoggie.com/Blog/?p=1#comment-26 problem with web filtering... I attach to this reply after seeing that is about web filtering. I think that more than a bug on the web filter is a problem caused from some skilled web master to make the site insensible to categorization... you can take for example this (adult) website: <a href="http://www.tiavastube.com " rel="nofollow">www.tiavastube.com</a> it is categorized from surf control but seams accessible also if in yoggie the adult cat is blocked... but if you use the direct ip:64.111.210.230 you found it blocked ... so I think it's a trick from the web site owner... maybe you can analyze the fact in this way ... making yoggie impossible to trick... my best compliments for your blog and for yoggie i was waiting it from many times! best regards problem with web filtering…

I attach to this reply after seeing that is about web filtering.
I think that more than a bug on the web filter is a problem caused from some skilled web master to make the site insensible to categorization… you can take for example this (adult) website: http://www.tiavastube.com it is categorized from surf control but seams accessible also if in yoggie the adult cat is blocked… but if you use the direct ip:64.111.210.230 you found it blocked … so I think it’s a trick from the web site owner… maybe you can analyze the fact in this way … making yoggie impossible to trick…

my best compliments for your blog and for yoggie i was waiting it from many times!
best regards

]]> By: Shlomo Touboul http://www.yoggie.com/blog/2007/11/15/friends/#comment-25 Shlomo Touboul Wed, 05 Mar 2008 05:16:44 +0000 http://www.yoggie.com/Blog/?p=1#comment-25 Dear Gaetano, Thank you for providing us with this valuable feedback. After checking with the SurfControl Web Filtering database servers, we've indeed discovered an issue which delayed the updates of the servers' database. This has now been solved, and the sites you've mentioned, along with all the rest of the sites in the database are categorized properly. Dear Gaetano,

Thank you for providing us with this valuable feedback. After checking with the SurfControl Web Filtering database servers, we’ve indeed discovered an issue which delayed the updates of the servers’ database. This has now been solved, and the sites you’ve mentioned, along with all the rest of the sites in the database are categorized properly.

]]> By: Shlomo Touboul http://www.yoggie.com/blog/2007/11/15/friends/#comment-29 Shlomo Touboul Mon, 03 Mar 2008 05:22:58 +0000 http://www.yoggie.com/Blog/?p=1#comment-29 We do intend to support NAC protocol Submitted by Shlomo Touboul on Mon, 03/03/2008 - 05:57. Dear George, We do intend to support NAC protocol. Meanwhile, we have customers that use the Gatekeeper Pico PRO. They provide their contractors a pre configured VPN client on it and restrict that client (inside Gatekeeper Pico PRO) to a specific area in their network. They set the policy using Yoggie Management Server. This allows them to control and restrict access of their contractors to their network. Cheers, Shlomo. We do intend to support NAC protocol
Submitted by Shlomo Touboul on Mon, 03/03/2008 - 05:57.
Dear George,
We do intend to support NAC protocol. Meanwhile, we have customers that use the Gatekeeper Pico PRO. They provide their contractors a pre configured VPN client on it and restrict that client (inside Gatekeeper Pico PRO) to a specific area in their network. They set the policy using Yoggie Management Server. This allows them to control and restrict access of their contractors to their network.

Cheers,
Shlomo.

]]> By: Mr. George http://www.yoggie.com/blog/2007/11/15/friends/#comment-28 Mr. George Sun, 02 Mar 2008 05:22:47 +0000 http://www.yoggie.com/Blog/?p=1#comment-28 802.1x endpoint security for corporate LAN's Submitted by Visitor on Sun, 03/02/2008 - 05:24. Corporates are often faced with external contractors that require to use their own notebooks on the corporate lan i.e. external auditors, contracted IT services etc... This then becomes more difficult to manage since these contractors may not comply to the company's endpoint protection policies, so controlling who can connect to the network is very critical. Solving this problem would be to make all users authenticate before being able to utilise lan resources 802.1X is available on certain network switches, and can be configured to authenticate hosts which are equipped with supplicant software, denying unauthorized access to the network at the data link layer. One feature that I would love to see in yoggie endpoint products would be an 802.1x client, this would make this device a complete solution to corporates wanting to deploy tighter edge security on their LAN's Regards, George 802.1x endpoint security for corporate LAN’s
Submitted by Visitor on Sun, 03/02/2008 - 05:24.
Corporates are often faced with external contractors that require to use their own notebooks on the corporate lan i.e. external auditors, contracted IT services etc… This then becomes more difficult to manage since these contractors may not comply to the company’s endpoint protection policies, so controlling who can connect to the network is very critical. Solving this problem would be to make all users authenticate before being able to utilise lan resources

802.1X is available on certain network switches, and can be configured to authenticate hosts which are equipped with supplicant software, denying unauthorized access to the network at the data link layer.

One feature that I would love to see in yoggie endpoint products would be an 802.1x client, this would make this device a complete solution to corporates wanting to deploy tighter edge security on their LAN’s

Regards,
George

]]>