Massive Security Bug In OpenSSL Could Affect A Huge Chunk Of The Internet
The latest heartbleed OpenSSL vulnerability (CVE-2014-0160) is again a re-affirmation that using non-certified security modules for enterprise security is a really bad idea. You can be certain that every IT security guy out there felt that they were doing all the right things to secure the enterprise. The problem isn't the intent or implementation, the problem is the premise. You can't rely on integration platforms that have security add-ons for your enterprise risk mitigation.
This is yet another day where Forum Sentry customers can revel in their decision to go with a industry-proven, independently certified, secure product. Every system that is deployed behind Forum Sentry API gateway is secure, and none are susceptible to any OpenSSL vulnerabilities because Forum Sentry does not use OpenSSL for SSL or encryption. Rather, Forum Sentry uses FIPS 140-2 and NDPP certified technology to provide the SSL and cryptographic features.
There is a huge difference between "an integration device with security features" (hey CA, IBM, and Intel, are your ears ringing??) and "a security device with integration features" purpose built per Forum Sentry API Security Gateway.
It's not often that risk mitigation can be easily monetized as it takes a breach to truly represent the impact of lost passwords, lost keys, and lost trust. Today that is on display in dramatic form, but Forum Sentry customers can simply relax and enjoy the security.
