Blue Ridge Border Guard blocks sudden security breaches

Blue Ridge Networks is introducing a security appliance family that has built-in digital certificates and can override them on the fly to block sudden security breaches.

Called Border Guard 6000, the devices can red list users, cutting them off the VPN even if they have a valid digital certificate. The certificate itself stays valid, so if security administrators decide access should be restored, it doesn’t require fiddling with the certificates themselves.

This feature is designed for protecting very sensitive data. It lets network security staff cut off a user’s access immediately without having to revoke certificates and wait for any current sessions to end before the cutoff takes effect. If a user’s behavior on the network is suspicious or malicious, access can be cut right away. Similarly, if the user is fired suddenly, their access can be terminated.

By containing its own digital certificates, the devices make setting up two-factor VPN authentication simpler because no external certificate authority is needed. But if a business already has an established public key infrastructure (PKI), the appliances can tap into that as well.

This is important to businesses and government agencies that have invested in, say, VeriSign or Entrust for PKI already and don’t want to complicate it by having their VPN gear use a separate infrastructure.

The new appliances have a tunnel-lock feature that allows only traffic in and out of remote machines via the VPN during VPN sessions, protecting the VPN from attempts to hack in from devices that are on the same LAN with the remote computers. The Border Guard 6000 family supports roaming with a wireless laptop, so if a machine is connected to a VPN and the user wanders from access point to access point, the session stays alive.

Border Guard 6000 series gateways come in five models – 6100, 6200, 6400, 6500 and 6600 – and cost $4,000 to $20,000. They differ in VPN throughput and number of concurrent users supported.