Tunnel-based solutions don’t really work that well in cloud networks due their point-to-point nature. Since “points” move around very quickly in clouds, point-to-point technologies can easily cause problems with scalability, management and performance in clouds.

I am intrigued at how Certes Networks approaches this problem. They just announced vCEP  (Virtual Certes Enforcement Point).  According to the release “the vCEP is a virtual appliance that allows organizations to protect sensitive network traffic among virtual servers and between clouds without using tunnels. It encrypts network traffic from IaaS cloud infrastructures to data centers across the WAN and from server to server within the cloud.”

Huh? Encrypting network traffic without tunnels? The OSI model must be quaking in its boots.

Although they’re not a household name, Certes Networks is a pioneer in network encryption, having deployed the first group encryption solution years ago.  Group based encryption removes the need for point-to-point key negotiations, which in turn eliminates tunnels and makes data in motion encryption scalable and transparent to the infrastructure. Since cloud infrastructure is always shifting its configuration, transparent encryption is really important.

The other interesting thing here is that the Certes policy and key management system allows IaaS clients to maintain control of their own policies and keys. This really matters for regulated or sensitive workloads.  It should also be a welcome development to cloud providers who can address client concerns about security without bearing the legal and administrative burden of owing (or having access to) their client policies and keys).

The availability of cloud security for data in transit fills the security gap between the client’s trusted network and the data protection offered by Trend Micro’s SecureCloud data-at-rest encryption.   This doesn’t exactly spell the end of IPsec, but it does make it easier to cryptographically isolate your data and traffic from other cloud clients. And that’s a good thing!

Updated definitions:
====================
Win32.TrojanPWS.Agent
Win32.Trojan.Agent
Win32.TrojanClicker.Agent
Win32.TrojanDownloader.Adload
Win32.TrojanDownloader.Delf
Win32.TrojanSpy.Zbot
Win32.Trojan.Inject
Win32.Worm.Mabezat
Win32.Trojan.Autorun
Win32.TrojanDropper.Crypter
Win32.Trojan.FakeAV
HTML.TrojanClicker.Iframe
Win32.Trojan.Genome
Win32.P2PWorm.Palevo
Win32.Adware.Gamevance
Win32.Worm.Vbna
Win32.Trojan.Scar
Win32.TrojanDownloader.Genome
Win32.Adware.ScreenSaver
Win32.Trojan.Jorik
Win32.IMWorm.Sohanad
Win32.Trojan.Menti
Win32.Worm.Shakblades
Win32.TrojanRansom.Pornoasset
Win32.TrojanPWS.Tepfer
Win32.Adware.ArcadeWeb
Win32.TrojanDropper.Injector
Win32.Worm.Ngrbot

MD5 checksum: aaw2009-excluded-build-150.838.aawdef: 7b450296bd5d8b997dcae8ca91cef0dc