At Interop 2012, I’ll be hosting a session, “Less is More: Why SSL VPN is NOT What You Think It Is” that explores the inherent flaws of SSL VPN. The reality is, SSL has been buoyed by a staggering number of myths and security assurances promised by vendors and assumed as safe by VPN users. But in fact, high profile security breaches have occurred as a result of using key security building blocks of SSL VPN technology. These have included various Certificate Authority (CA) breaches, such as those at ComodoDigiNotar, GlobalSign, Gemnet and KPN.
So, why is this happening? Do users implement the technology incorrectly, or is it simply not as good as all the hype makes it out to be? Is there something else or different we should be doing? What are solutions to the underlying problems?
These are the very questions I’ll answer in this session, drawing upon my 20 years of experience in the networking and security industry. As CTO, Americas for NCP engineering – I’m confronted with examples of SSL misunderstanding and misuse on a daily basis. With this session, I’ll expose SSL VPN security myths and dispel dangerous hype, which is leading to over-reliance on the protocol. I’ll also leverage real-life examples and provide practical ways you can strengthen your remote access connectivity.
Clearly, confusion exists about the security capabilities of SSL. Ultimately, this misinformation undermines the technology and lessens its appeal in scenarios where SSL is an ideal solution. This session will put the most persistent SSL myths to rest and clarify the technology’s capabilities – and its limitations. I’m looking forward to seeing you there.
The session Less is More: Why SSL VPN is NOT What You Think It Is will be held Thursday, May 10, 2012, 11:30am – 12:30pm at Interop 2012.