Update: I just installed the SmartConsole tools for R75.40 and they take up a whopping 663MB of space. Over half a Gig for the SmartConsole Tools? Wow.

The crowd at IANS was also a little different. Normally when I present for Tufin (in-person or web conference) I am usually speaking with more technical groups and their managers. The initial interest tends to come from operations and engineering teams. At IANS, the groups were more GRC focused. These are the people that need visibility into the access control layers, but rarely have it in a format that best supports their initiatives. Their access is usually limited to certain policies and time frames determined by the operations/engineering teams. Products like Tufin give GRC groups near real-time/read-only access into the firewall policies and allow them to look for items of interest like:

• Unauthorized changes
• Changes outside of administrative windows
• Changes that deviate from common “best practices”
• Changes that violate internally defined security polices
• Risk trending as it relates to access controls on the network
• Firewall/ACL rule metrics
• Just to name a few…

This was the second year for the Minneapolis IANS show, and it was well attended. Most of my four sessions were full, and there was some great interactive discussions. I would say about half of the attendees were existing customers wanting to get a look at the new R12 release. Most of the people that stopped by our room were from well recognized enterprise organizations (retailers, banks, healthcare, carriers) which gives a good indication of the type of crowd IANS tends to draw. There seems to be something about Minneapolis security conferences in that they are usually well attended: this show easily surpassed the one in Chicago.

One other thing I will mention, is that Marcus Ranum was in one of my sessions. A bit of a shift to have a headline speaker show up for a vendor presentation (completely unexpected and maybe one of the benefits of the IANS show: more speaker interaction). The guy is one of the early pioneers for firewall technologies (DEC/Alta Vista firewall) and IDS/IPS (Network Flight Recorder). Made for some interesting conversation.

The next conference I will be presenting at will be the Secure360 event in May 2012. We tend to do some pretty serious dining, so stop by the booth and say “Hi.”

• TCSE Training Guide
• Tufin Secure Knowledge Access
• VMware running SecureTrack

Network Security Management tools are becoming more common in the workplace as firewall policies and router/switch ACLs continue to increase in size and complexity. Adding the TCSE to your resume might be a great way to demonstrate to an employer that you are staying current with the tools and methodologies used for security policy lifecycle management. If you work for a reseller or are a consultant, the TCSE is a great plus for developing a closer relationship with Tufin.

Click for larger image

The “Self-Study” portal has not been updated with any R75 material, so we will have to wait to see if check Point will still continue with that practice (the material was actually pretty good, especially the practice exams). Looks like they have a free training video on the Application Control Blade. Unfortunately it does not come with any lab material.

One can only hope that Check Point will seriously consider updating the CCMA exam, as that material was painfully outdated. I took the written exam in April of 2011 and was disappointing to see so many in-depth questions on SmartDefense, Connectra, and (wait for it…wait for it) Interspect!!?? Seriously Check Point you owe me $300USD or at least a free testing voucher if you release a new test.

Several key enhancements in this new version include:

Visual Topology (think of SmartMap for all of your Check Point and non-Check Point firewalls and ACLs).

Tufin 6.0 Topology

High Availability

Palo Alto support for User-ID and App-ID

CIS Benchmark Audits (very very cool stuff for Cisco IOS)

What’s New in R71.40

Upgrade from R70.40 directly to R71.40

Security Management

• IPS improvements
  • SmartEvent enhancements.
  • Increase pattern granularity – Header rejection, HTTP worm catcher and Cifs worm catcher patterns were converted into separate protections, giving more granularity in their settings. This feature is installed during the first IPS update process (online update, offline update or scheduled update).
  • Implied exceptions – Built-in exceptions to allow Check Point products trusted traffic.
• Support for UTM-1 Edge 8.2 gateways.

Security Gateway

• IPS Geo database – The Geo country-ranges database accuracy has been significantly improved.

Security Gateway 80

• Support for VPN Link Selection.
• Support for local masters file.
• Improved communication when Security Management server is behind NAT.
• Support for IGMP Proxy.

Windows 7 32-bit and 64-bit Support

• Secure Workspace supports Windows 7 32-bit and 64-bit.
• Mobile Access clients with Windows 7 64-bit can connect to Connectra and SSL VPN gateways.
• Support for SSL Network Extender Application mode and Network mode for Windows 7 32-bit and 64- bit.

Enhanced Secure Workspace

• Faster and better performance.
• Enhanced allowed application configuration by software vendor. You can easily allow all applications from a specific vendor.

VPN Client

This version includes a deployment package of Endpoint Security VPN R75, which replaces SecureClient and Endpoint Connect. For automatic deployment of the new VPN client, select a client upgrade mode in Global Properties > Remote Access > Endpoint Connect.

Security Management

• IPS improvements

• SmartEvent enhancements

• Increase pattern granularity – Header rejection, Http worm catcher and Cifs worm catcher patterns were converted into separate protections, giving more granularity in their settings. This feature is installed during the first IPS update process (online update, offline update or scheduled update).

• Implied exceptions – Built-in exceptions to allow Check Point products trusted traffic.

• Support for UTM-1 Edge 8.2 gateways

New Remote Access Client Support

• Improved SSL Network Extender application control by software vendor so you can easily choose to allow all applications from a specific vendor

Security Gateway

• IPS Geo database – The Geo country-ranges database accuracy has been significantly improved.

Security Gateway 80 Series

• Support for VPN Link Selection

• Support for local masters file

• Improved communication when Security Management server is behind NAT

• Support for IGMP Proxy

Windows 7 32-bit and 64-bit Support

• Secure Workspace supports Windows 7 32-bit and 64-bit.

• Mobile Access clients with Windows 7 64-bit can connect to Connectra and SSL VPN gateways

• Support for SSL Network Extender Application mode and Network mode for Windows 7 32-bit and 64-bit.

Enhanced Secure Workspace

• Faster and better performance.

• Enhanced allowed application configuration by software vendor. You can easily allow all applications from a specific vendor.

VPN Client
This version includes a deployment package of Endpoint Security VPN R75, which replaces SecureClient
and Endpoint Connect. For automatic deployment of the new VPN client, select a client upgrade mode in
Global Properties > Remote Access > Endpoint Connect.

Another temporary “dead-end” release. This means that there are now two releases (R71.30 and R71.40) that cannot be upgraded directly to R75. Also interesting that you can upgrade from R70.40 to R71.40, so you now have two options to move off R70.40: R71.20 and R71.40. I am running out of room on the Roadmap and Upgrade Path diagrams, so I have to see how I can fit this new information.