Microsoft is very close to releasing the full version of its Internet
Security and Acceleration (ISA) Server 2004, according to sources close to
the matter.
The Redmond, Wash.-based firm Tuesday made a second public beta of the software, three years in development, available for download.
The software is geared to drive a server that sits above the application layer, where
it would work as a combination application layer firewall, virtual personal
network (VPN) and Web caching repository.
Microsoft said the software helps
protect applications such as Microsoft Exchange, Internet Information
Services and SharePoint, but in theory, ISA could protect any application
within its boundaries, including ones running on Linux or UNIX.
“Hackers tend to target the point of least resistance in a network, and
lately that’s been the application layer because network firewalls are not
traditionally designed to detect and prevent these types of threats,” said
Charles Kolodgy, research director at Framingham, Mass.-based IDC.
But while Microsoft’s policy is to remain hush on future release dates of
its platforms, Yankee Group analyst Laura Didio, who has been following the
ISA saga since the beginning, told internetnews.com the software
should hit the market in the next three to four months.
“This is a much more mature server software than previous versions,”
Didio said. We are expecting ISA to ship 90 to 120 days barring any
unforeseen ‘gotchas’.
By “gotchas,” Didio said unforeseen problems always seem to crop up in
beta testing, such as compatibility issues. But in terms of security, she
said the company has done the lion’s share of its work on ISA in trying to
raise the bar on security.
“A hack delayed is a hack denied,” Didio said. “They are protecting the
application layer, which is higher up the stack. They simplified the user
interface to make it more user friendly and added more policies. The
software lets you delve more into the protocols and the packets.”
Didio said ISA’s software not only makes it harder to get in, it sets
alerts that notify system administrators so they can provide additional
protection. The proxy part also allows the software to protect applications
from the inside out, such as in academic environments.
Microsoft said its new management tools make the product easier for
security administrators to learn and, ultimately, help customers avoid
security breaches that can occur due to firewall misconfiguration.
“Customers have told us they need an integrated firewall solution to help
them address the growing number of application-based security threats,” said
Jonathan Perera, senior director of Product Management in the Security and
Business Technology Unit at Microsoft, in a statement.
Despite its wide-ranging security blanket, the ISA
platform calls into question whether or not Web-based applications are the
best way to protect an overall system. Instead of using Windows Server 2003
as the baseline, could Microsoft’s other software platforms like Office
alternatively be tweaked with Web services
the same purpose? Didio says no.
“Certainly ISA is not the end-all-be-all,” she said. “It is one more
layer of security. Web services are here, but remember originally, some
people were afraid that electricity would burn down their houses.”
Ironically, the server software beta was released to the public on a day
that most server rooms and data centers could have used a little extra
security.
Thanks to some malicious code, the MyDoom
virus spread quickly through mail servers at the beginning of the week.
Though its mass e-mail properties, the virus is expected to serve as a
direct denial of service (DDoS) attack on some select Web sites starting
February 1.
