Articles by Daniel Fages

This week, we visited the Infosecurity show in Paris where we sat up a large number of meetings with potential customers, journalists and analysts working in the IT security field.

The main goal was to feedback and validation from the market on our vision, our speech and the “Virtual Browser” solution. The result exceeded our expectations: absolutely ALL the people we met were very positive about the approach and the solution; a certain number of pilot projects have to be planned at customers premises; journalists and analysts confirm that the market is realizing the security risks of web browsers and that security vendors have to work on this topic (Solange Belkhayat-Fuchs, Chief Editor of cnis-mag told us “2009 will be the year of the web browser”). This really is a good news !

We had some fears about the famous “Time to market” - is it too early to launch the “Virtual Browser” solution? These two days proved us that the timing is just perfect. In short, very promising first contacts…

A few months ago, Checkpoint/ZoneAlarm launched ForceField, a “Virtualized Browser Security” solution. When you look at the product description, you can read:

“ZoneAlarm ForceField provides a protective layer around your browser, shielding you from drive-by downloads, browser exploits, phishing attempts, spyware and keyloggers. So your passwords, your confidential information, and your financial data remain protected“. ZoneAlarm then asserts that ”Nothing else protects you like ZoneAlarm ForceField“….

This seems very promising and could be a very good answer to the multiple browser security issues. But then comes the reality… maybe you’ve already read this excellent article from Infoworld that explains that Robert Grimes needed only 60 seconds to bypass ForceField protection. In fact, this is not really surprising; it was already the case when the same Grimes tested GreenBorder (bought by Google) a few years ago. This is not really surprising because it’s not the implementation of the “sandbox” technology which failed but the concept itself of using a sandbox to protect the web browser. Moreover, the experts at Checkpoint/ZoneAlarm themselves admit: for optimum security, you have to use an updated and secured underlying system !!! Where is the virtualization ? This type of product is just one more security layer you have to install and manage on the user workstation…

What’s the solution ? A REAL virtual browser, REALLY executing in a distinct environment, which doesn’t need an updated and secured underlying system to provide a ”stress-free Internet” experience.