Category-breaking innovation

Selected by five columnists, these products and services offer fresh approaches to today’s network problems.

What makes this service so special? Until now, corporations willing to use mobile data to improve field productivity and service had to make significant, often unacceptable, trade-offs. Applications had to be “dumbed down” to work over slow and unreliable services via devices with frustratingly small screens and keyboards. Verizon Wireless’ CDMA2000 EV-DO service, marketed as BroadbandAccess, performs more like DSL or cable modem service than familiar cellular data. BroadbandAccess heralds the long-touted era of 3G wireless. With Evolution-Data Optimized technology, organizations not only can extend enterprise networks into the field but also can reach customers equipped with handheld multimedia devices in new ways – perhaps changing the way we conduct business.

Who’s using it? Because CDMA2000 EV-DO rolled out during the second half of 2004 in select cities, corporations are just starting to kick its tires. One of Verizon’s biggest mobile data customers, UPS, is testing it. Other companies are doing the same but are reluctant to talk about it for competitive reasons. However, this is a technology that many users will start to employ on their own, so it behooves IT leaders to learn what EV-DO can and can’t do in order to better manage and secure its use.

Verizon now offers at least partial coverage for BroadbandAccess in 30 cities and plans to cover 150 million people (about half the U.S. population) by the end of 2005.

Suitable business applications include e-mail (even with large attachments), Web browsing, database queries and multimedia messaging. Consumer applications include games, mobile TV, mobile commerce and location-based services.

How much will it cost the average enterprise? Verizon initially targeted business users exclusively, selling PC cards for $100 (after a $150 mail-in rebate) with a one-year service contract and $50 with a two-year contract. The service costs $80 per month with unlimited use.

What else should we know? CDMA2000 1xEV-DO is the first offering that gives users a genuine taste of the 3G wireless services promised for more than five years. With its peak data rate of 2.4M bit/sec, and users reporting actual throughputs of 300K to 500K bit/sec, EV-DO delivers “always on” performance rivaling that of most Wi-Fi hot spots (many of which are constrained in throughput by their DSL backhaul links).

As of Jan. 10, 2005 Verizon offered BroadbandAccess service in 30 cities: Atlanta; Austin, Texas; Baltimore; Boston; Chicago; Cincinnati; Columbus, Ohio; Dallas/Forth Worth; Dayton, Ohio; Hartford, Conn.; Houston; Jacksonville, Fla.; Kansas City, Mo.; Las Vegas; Los Angeles; Madison, Wis.; Miami/Fort Lauderdale; Milwaukee; New Haven, Conn.; New Orleans; New York/Newark; Orlando; Philadelphia; Phoenix; Pittsburgh; Providence, R.I.; San Diego; St. Petersburg/West Palm Beach, Fla.; Tampa, Fla.; and Washington, D.C.

That’s not to say CDMA2000 EV-DO is the only robust mobile data solution. Users of Cingular Wireless’ competing WCDMA service report performance almost as fast as EV-DO’s. But EV-DO has a significant head start and is likely to achieve nationwide urban coverage sooner. Currently 10.4 million users worldwide subscribe to CDMA2000 EV-DO services; the vast majority of these users are in Korea and Japan. Though the number of WCDMA subscribers has reached 13.3 million globally, EV-DO is the more mature service with a better selection of devices (plug-in cards for notebook PCs and multimedia handsets). Plus, EV-DO users don’t compete with voice users for bandwidth the way WCDMA users must; however, that advantage could quickly vanish as EV-DO operators launch wireless VoIP services.

Expect CDMA2000 EV-DO and the competing WCDMA solutions to continue evolving – perhaps leapfrogging each other as further enhancements are introduced. A new version of EV-DO promises higher data rates (up to 3.1M bit/sec), multicasting of multimedia content, greater capacity, and QoS support for low-latency applications such as voice. WCDMA promises even higher peak data rates (as high as 14M bit/sec) using a technology called High-Speed Downlink Packet Access, which Cingular recently trialed in the field.

Both enterprise users and consumers stand to benefit as proponents of the two competing solutions play “Can you top this?” Finally, mobile professionals will be able to access the Internet and e-mail, whether on the road or in the office, in essentially the same way. However, the impact of new multimedia handsets – with gaming and location-based services thrown in for good measure – is harder to predict; the advertising and mobile-commerce opportunities seem endless.

What makes this service so special? Anyone who can bring Microsoft and Linux together deserves consideration for a Nobel Prize, but that’s beyond our power. The least we can do is recognize Vintela with the Category-Breaker Award for simplifying the management of heterogeneous – Windows, Unix and Linux – networks. Vintela Authentication Services lets you manage a single logon/password for Unix, Linux and Windows efficiently – and securely – while extending Microsoft’s implementation of Kerberos authentication to the ‘nix platforms.

Who’s using it? This simple, elegant solution was adopted by almost 100 organizations, such as Advanta Bank, Boeing, Brown & Williamson Tobacco, Cross Country Healthcare, Lockheed Martin, Paymentech, RotaDyne, the U.S. Department of Agriculture and Vertex Pharmaceuticals.

How much will it cost the average enterprise? Pricing is based on a combination of $200 per managed host/server and $25 per managed user. Vintela offers volume and site discounts.

What else should we know? Simply put, VAS reduces the number of times your telephone rings.

Anyone trying to manage a heterogeneous network of Windows, Unix and Linux boxes (with a mixed bag of servers, hosts and desktops) is aware of the numerous problems that cross-platform authentication and authorization can bring: the phone calls, the begging, the pleading, the yelling and the crying – and that’s just when the help desk calls you.

A great outpouring of grief followed the Windows 2000, with Active Directory, release because Microsoft implemented authentication and authorization schemes based on the traditionally Unix-based Kerberos service. Essentially, most Unix/Linux implementations use Kerberos for authentication and ignore the authorization aspects, while Microsoft uses the authorization services heavily (click here  for the background on this). Windows 2003 Server continued to use Kerberos in this non-traditional way. Vintela saw this not as a problem, but as an opportunity. It has simply extended the Unix and Linux-based Kerberos so that it supports the uses Microsoft is making of the technology and thus supports cross-platform sign-on and authentication.

VAS is simple, it’s elegant, and it complies with the Kerberos standard as written.

VAS also provides the ability to manage a single username/password combination for each platform, one of the two major methods of providing single sign-on to the enterprise. The other method (using a service to store multiple usernames and passwords while acting as a proxy for the user) can be a disadvantage when the proxy service is down. With VAS, even if users can’t access Active Directory they can still log on to one of the supported platforms because the username and password is the same for each.

The number of supported platforms is pretty comprehensive:

• AIX 4.3.3
• AIX 5.1
• AIX 5.2
• HP-UX 11i v1 (B.11.11 / PA-RISC)
• HP-UX 11i v1.6 (B.11.22 / IA-64)
• HP-UX 11.0 (PA-RISC)
• HP-UX 64-bit support
• Sun Solaris 8 and 9 SPARC
• Solaris 64-bit support
• SuSE 8.0, 9.0 and later
• Red Hat 7.3 and later
• Red Hat Enterprise Linux

All user management in a VAS-supported network takes place within the familiar confines of the Active Directory utilities. Yet any password change done within any of the supported operating systems – actually any Kerberos-aware application or service – is automatically changed for all.

Figuring out the pricing for VAS is probably more complex than implementing and maintaining it, since it’s based on a combination of the number of VAS-enabled Unix/Linux servers and Unix-enabled user accounts (one account per person) that will be stored and authenticated in Active Directory. Vintela defines a VAS-enabled Unix/Linux server as “any machine running Unix and/or Linux with VAS client software installed having concurrent log-in sessions that originate from five or more VAS user accounts.” List price is $200 per server, $25 per user, but volume and site discounts are available.

VAS can simplify your life. But the company isn’t resting on those laurels. Once you’ve implemented VAS, you’ll also want to look at Vintela Group Policy, which extends Microsoft Group Policy to the same Unix and Linux platforms. But that’s a story for another day.

What makes this service so special? Access Enforcer combines role and permission provisioning with workflow in a powerful new way. Access Enforcer automates the access-provisioning approval workflow. If users request online access to resources for which they don’t have permission, Access Enforcer automatically forwards the request to internal approvers within a pre-specified, customizable business workflow. Updates to roles and permissions are automatically applied to enterprise directories only when access requests are approved within the appropriate workflow. When implemented within Virsa Systems’ Continuous Compliance Suite, Access Enforcer automatically ensures that users aren’t granted roles or permissions that might violate applicable laws or create conflicts of interest. (Access Enforcer is a separately licensable suite component.)

Who’s using it? Virsa Systems developed Access Enforcer at the request of its user group of more than 100 enterprise customers in various verticals: aerospace, agribusiness, chemicals, consumer products, defense, financial services, government, healthcare, higher education, high-tech, media, oil and gas, pharmaceuticals, transportation and utilities. Almost a dozen customers currently have Access Enforcer in various stages of deployment, the company says. All have deployed Access Enforcer over SAP’s enterprise applications and platforms.

How much will it cost the average enterprise? Pricing is based on a software license of $50,000 per instance deployed.

What else should we know? Role provisioning is one of the most difficult, complex and imperfect processes within identity management environments. Access Enforcer automates that process to the maximum extent feasible while ensuring corporate accountability and compliance with Sarbanes-Oxley and other laws and regulations.

What’s truly innovative about Access Enforcer is the extent to which it automates role provisioning in keeping with approved enterprise workflows. We can best understand Access Enforcer’s value by understanding how roles are traditionally provisioned in most organizations.

Traditionally (without Access Enforcer), users complete forms that request access to one or more business applications. Those forms are then submitted to a first-line supervisor who reviews, approves and forwards them for secondary approval by IT security or directly to administration for entry into the target system. Often, the managers who review access requests are expected to research and catch any potential conflicts of interest between the roles that the requester currently has and any new roles and permissions being requested. The temptation to expedite an under-researched access request can seriously backfire, exposing the corporation to significant legal, regulatory, security and financial risks.

However, with Access Enforcer, companies can speed up the request approval process while ensuring continued compliance with controlling laws, regulations and policies. Access Enforcer works as follows:

• Within a browser-based session, the user requests a level of access to a particular application for which he doesn’t have the necessary roles and permissions.
• Access Enforcer presents the user with an access-request form, which can be customized to the proper format and can include all the data fields necessary, pulled from multiple internal and external data sources (such as SAP’s human resources application), to complete the desired process.
• The user enters all necessary and appropriate data elements into the access-request form.
• The user completes and submits the completed access-request form, thereby automatically triggering a workflow process within Access Enforcer.
• The access request is routed through a pre-specified, customized workflow (defined by the appropriate corporate business managers) to any number of reviewers and approvers.
• At each stage in the workflow, the relevant reviewer/approvers receive e-mail notifications of the request, including a link directing them to the completed form.
• The reviewer/approvers can retrieve additional information from multiple sources to provide the data necessary for a complete analysis, including “segregation of duties” (i.e., conflict of interest) assessments automatically evaluated by Virsa’s Compliance Calibrator software tool. This is one of the critical internal control steps required by the Sarbanes-Oxley regulation.
• Upon approval, the access request can be routed to the security team for entry into the target application, or executed automatically within that application or platform.

Access Enforcer keeps a fully documented audit trail of executed user requests and approvals for security, legal and regulatory compliance monitoring.

Access Enforcer integrates fully into an enterprise’s existing application and identity infrastructure. It is a stand-alone Web-based application within J2EE and .Net environments. Access Enforcer dynamically retrieves user identity, permission and role information from multiple sources, including Lightweight Directory Access Protocol directories, Windows Active Directory and SAP platforms. In response to a user access request, it automatically looks up current user roles and permissions across all connected systems and assesses the risks of provisioning the requested access across diverse systems.

What makes this service so special? Biometrics has been the “next big thing” in security circles for the past five years. IT executives are intrigued by the possibilities, but reluctantly end up concluding that the technologies aren’t quite simple enough to roll out to thousands of end users. That changed with IBM’s December introduction of the ThinkPad T42, which includes the IBM Embedded Security Subsystem 2.0, which features a built-in fingerprint scanner. By bringing biometrics to the desktop, IBM addressed several critical requirements that IT executives tell us are top-of-mind in 2005: endpoint security, identity management and compliance.

Who’s using it? No enterprise accounts are publicly available at this point, but we have spoken with clients who are evaluating the ThinkPad T42.

How much will it cost the average enterprise? Pricing for the T42 with Embedded Security Subsystem 2.0 begins at $1,400.

What else should we know? Anyone who’s concerned about endpoint security, identity management or compliance should seriously consider this system.

• Endpoint security. Increasingly, sensitive data resides on users’ desktops and laptops – not just on managed and protected servers. Ensuring effective endpoint security is a key component of an up-to-date security strategy.
• Identity management. Security policies rely on effective identity management – knowing who a user is, and mapping that user’s access rights to his or her profile. The biggest challenge in identity management is authentication – ensuring that a user is who he or she claims to be. This is particularly important when multiple users share the same machine – one user might have rights to view a set of files, for example, that other users might not have rights to view.
• Compliance. Regulations such as Gramm-Leach-Bliley, Sarbanes-Oxley and the Health Insurance Portability and Accountability Act (HIPAA) increasingly require senior company executives to ensure that sensitive or protected data can only be accessed by appropriate personnel. Password protection is often insufficient, as most passwords can be cracked.

The T42 with Embedded Security Subsystem 2.0 works effectively in a variety of scenarios. For users who share client systems (for example, hospital, IT administrative and military staffs), it integrates into server-based authentication to reproduce sensitive user credentials and key information. Thus, users can roam from one security-enabled system to another followed by their authentication credentials and keys, and gain access only to those files they’re entitled to see (from any machine). The system also enhances the security of wireless networking (particularly critical in HIPAA environments) by concealing authentication credentials for industry-standard 802.1x protocols and Cisco Lightweight Extensible Authentication Protocol (LEAP).

For IT executives, though, all that pales beside the T42’s most compelling feature: It’s easy to use. Users simply swipe their fingers across the integrated fingerprint scanner; if there’s a match, the system provides single sign-on to appropriate data and applications. For companies that currently spend millions on password management, the simplicity alone is a standout. It translates into a hard-dollar rationale for implementing the new machines: IT executives can now seriously consider implementing company-wide biometrics while reducing their operational security costs.

What makes this service so special? It is a rare year indeed when I get slap-happy over a product, but Eli certainly made me so. Eli brings hope to the professional security officers struggling to maintain a reasonable level of security for a corporation with hundreds of distance offices, telecommuters and travelers moving hither and yon across the globe. Once this small lightweight is connected to a cable modem or DSL line, or router, Eli “calls home” and is assigned a “master server” somewhere in the company’s expansive global infrastructure. Your Eli, which has secure Ethernet and wireless ports and a built-in network address translation firewall, then is updated with the latest and greatest in anti-virus signatures, spyware blocks, content filtering decisions, popup detectors and more. Here, Eli shines more than any other product I have seen in years, putting it into a category of its own!

Who’s using it? ELI is in negotiations with a number of systems integrators and service providers, and a handful of high-profile enterprise organizations.

How much will it cost the average enterprise? About $200, with service that starts at $10 per month for complete automatic managed security for a small network.

What else should we know? ELI advertises Eli as the first managed broadband security appliance for the home, but I immediately realized it is so much more than that. Epidemics of viruses, malware and spam make Ma and Pa part of the global security problem. The road warrior of today and remote offices are clones of the security woes brought on by millions of broadband home users.

Architecturally, Eli is a small, surprisingly lightweight box that connects to a cable or DSL line or can be easily hooked to a router. Eli provides four protected Ethernet ports and a fully featured 802.11 b/g capability with the usual MAC/WPA security. The built-in network address translation firewall assures that you are indeed in stealth mode to the world – and that’s a great thing, as you want to be as invisible as possible to keep those pesky bad guys far, far away. A USB port is perfectissimo for a centralized wireless printer.

But that is only the start. Are you migrating to VoIP to save money, maintain a single phone number and schlep around the world? Eli handles all of that, too. Securely.

Once hooked up (true plug ‘n’play), Eli “calls home” and is assigned a “master server” somewhere in Eli’s expansive global infrastructure. Your Eli is then updated with the latest and greatest in anti-virus signatures, spyware blocks, content-filtering decisions, pop-up detectors and more.

But wait, there’s more!

How about VPNs for Dummies? Any Eli can automatically talk to any other Eli with strong Diffy Hellman key exchange and Advanced Encryption Standard. To me, this is one of the most stupendous features for connecting securely and with supreme laissez-faire ease to an organization’s distant offices.

In summary:

• I like ridiculously simple.
• I like to tell those without a clue, “Don’t touch.”
• I like all-in-one solutions that are hardware-based.
• I like solutions that address real-world corporate needs, small office/home office necessities and anything that will keep Ma and Pa from hurting themselves by tweaking inside of Windows.

To me, Eli is this and more. Eli is going to be huge.