Microsoft Targets Network Security with ISA Server 2004 and NAP

by Alex Woodie

On the final day of its Worldwide Partner Conference 2004 in Toronto, Ontario, yesterday, Microsoft unveiled its Network Access Protection (NAP) roadmap to improve network security and interoperability with third-party antivirus and security products. The company also announced the general availability of Internet Security and Acceleration (ISA) Server 2004, its "next generation" firewall and VPN that works with Windows Server 2003, as well as a security appliance from Hewlett-Packard built on the ISA software.

Over the past two and a half years, Microsoft executives have placed a heavy emphasis on improving the security of Windows products, and have gotten mixed results. In his recent e-mail to employees, Microsoft CEO Steve Ballmer admitted that people still harbor doubts about the security of Microsoft products, and he reiterated the need for improved security (see "Microsoft CEO Steve Ballmer Says Company Needs to Refocus"). While the company's recent security shortcomings have materialized in Internet Explorer, its server products deserve a piece the security burden, too.

Microsoft claims it has "significantly" improved security with the new version of ISA Server, which provides firewall, virtual private networking (VPN), and Web caching capabilities and runs on Windows 2000 and Window Server 2003 operating systems. The product is primarily used to secure access to Web-based e-mail, portals, and internal Web sites, and works in conjunction with other members of the Windows Server System, including Exchange (with Outlook Web Access), Internet Information Services (IIS), and Office SharePoint Portal Server.

Perhaps the biggest enhancement to ISA Server 2004 is the introduction of application-level filtering (or "deep stateful inspection") of HTTP traffic in the firewall component. With application-level filtering, Microsoft has given ISA Server 2004 the capability to block access to all executable Windows content, regardless of the file name extension used. Numerous other enhancements also spawn off this key new feature, including the capability to set much more detailed security policies. More granular control of IP-level protocols, a new user interface, new configuration wizards, and improved authentication have also been added to the ISA product, the company says. In all, Microsoft lists 55 new features or improvements to existing features in ISA Server 2004 (the entire list is available on Microsoft's site).

ISA Server 2004 replaces ISA Server 2000 and runs on Windows 2000 Server or Advanced Server, with Service Pack 4 or later, Windows 2000 Datacenter Server, or Windows Server 2003 Standard Edition or Enterprise Edition. Pricing for ISA Server 2004 Standard Edition starts at $1,499 per processor and will install on servers with up to four processors. There is also an ISA Server 2004 Enterprise Edition in the works, a kicker to the ISA 2000 Server Enterprise Edition that Microsoft created for high-bandwidth Web sites that need to cluster servers to create much larger Web caches and firewalls. Microsoft has not talked about the pricing or delivery date for ISA Server 2004 Enterprise Edition, except to say that it is coming soon.

In addition to selling ISA Server 2004 as a stand-alone product, Microsoft is partnering with hardware vendors to sell firewall and VPN security appliances, including HP's ProLiant DL320 Firewall/VPN/Cache Server, which Microsoft and HP announced in May (see "HP, Microsoft Partner on Security Appliance, Tools"). Several other partners have also announced plans to deliver hardware solutions based on ISA Server 2004, including Celestix Networks, Pyramid Computer, RimApp Technologies, Network Engines, and Wortmann AG. Microsoft has also partnered with leading antivirus, antispam, encryption, and Web filtering vendors for ISA Server 2004.

In a related enhancement, Microsoft announced its Network Access Protection (NAP) technology and roadmap for supporting NAP, which will provide a framework for checking users who try to access a network. If somebody tries to access a network using a PC that is not fully patched or presents other security risks, full access to network assets won't be given until that person complies with the company's security policy.

Microsoft is working with 25 antivirus, patch management, and systems management vendors to support NAP, says Mike Nash, corporate vice president for the security business and technology unit at Microsoft. The NAP capability will be delivered with the upcoming "R2" release of Windows Server 2003, he says. That R2 release is due in 2005 and should not be confused with Windows Server 2003 Service Pack 1.