Foundstone, Microsoft Extend Security Relationship.

Business Editors

SAN JOSE, Calif.--(BUSINESS WIRE)--Feb. 19, 2002

Foundstone Analysis Establishes Microsoft ISA Server with

Service Pack 1 as Trusted, Reliable Choice for Secure

Web-Based Networking and Services

Foundstone Inc., the premier provider of managed and professional security assessment services and education, today announced the latest results of its continuing security evaluation of Microsoft Corp. products and services. Foundstone examined Service Pack 1 for Microsoft Internet Security and Acceleration (ISA) Server 2000, building on Foundstone's audit of ISA Server's initial release last year.

The first product in Microsoft's newly formed Security Business Unit (SBU), ISA Server provides secure, fast and manageable Internet connectivity by integrating an extensible, multilayer enterprise firewall and a scalable high-performance Web cache. Based on Foundstone's attack and penetration tests, ISA Server with Service Pack 1 includes a strong, robust security architecture to help deliver trusted, high-performance Web-based networking and services.

The ongoing relationship between the two companies takes advantage of Foundstone's world-class security expertise and Microsoft's worldwide leadership in software, services and Internet technologies. In addition to the ISA Server and Service Pack 1 assessments, Foundstone performed a security audit of the recently released .NET Framework development environment, and continues to evaluate other products and services for Microsoft.

"Our relationship with Foundstone is critical to developing and implementing Microsoft's overall security strategy," said Ari Fruchter, international product manager for ISA Server at Microsoft. "Foundstone's contribution to the development of ISA Server security has been indispensable, and its thorough analysis of Service Pack 1 reaffirms why we rely on it as the leader in security testing."

"Building on our work with ISA Server last year, our recent analysis of Service Pack 1 was even more rigorous and extensive," said Joel Scambray, Managing Principal at Foundstone and technical lead on the ISA Server security audit. "The results of the evaluation demonstrate that ISA Server offers world-class security and reliability, and our ongoing work with the ISA Server development team shows their continued commitment to the gold standard of independent security review."

The security architecture of ISA Server contains several core elements, including application-level security gateways, secure server publishing, and tight integration with Windows 2000 authentication and virtual private networking features. Foundstone's analysis focused on the application-layer gateway and secure server publishing functionality of the product. "Our testing indicates that ISA Server is a reliable choice for delivering high-quality, secure Web-based connectivity and services," said Scambray. "This functionality is central to the emerging, next-generation Internet."

Foundstone's work is part of the Secure Windows Initiative, which is a crucial component of Microsoft's long-term commitment to security under its Trustworthy Computing program. Foundstone is also contributing to the security development of all aspects of Microsoft's .NET architecture, including its analysis of .NET Framework mentioned above.

".NET Framework technology will be part of the platform for emerging Web-based services, and Microsoft is committed to ensuring its security," said Scambray. "We are pleased Microsoft is relying on Foundstone to help achieve this goal. It is another example of how Microsoft's relationship with Foundstone continues to develop and extend."

About Foundstone Product Testing Services

Foundstone provides independent technical security evaluations of software products and Web services using the assessment methodologies made famous in the international best seller "Hacking Exposed: Network Security Secrets & Solutions," written by Foundstone executives. Foundstone determines the true security capabilities of a product from a hacker's perspective by combining its acclaimed FoundScan technology with hands-on consulting. Evaluations take place in Foundstone's security testing lab or onsite, and experts work closely with the client's product team during the development lifecycle. For vendors, Foundstone provides a private analysis of how a product stacks up against its competition. Product testing services include functionality verification, security weakness identification and security improvement recommendations.

About Microsoft Internet Security and Acceleration Server 

Internet Security and Acceleration Server provides secure, fast and manageable Internet connectivity by integrating an extensible, multilayer enterprise firewall and a scalable high-performance Web cache. It builds on Microsoft Windows 2000 security and directory for policy-based security, acceleration and management of internetworking. ISA Server includes an enterprise firewall featuring security with packet-, circuit- and application-level traffic screening, stateful inspection, broad application support, integrated virtual private networking, system hardening, integrated intrusion detection, smart application filters, transparency for all clients, advanced authentication, secure server publishing, and more. The ISA Server Web cache can maximize performance and save network bandwidth resources by storing and serving locally cached Web content. For more information, visit www.microsoft.com/isaserver; ISA Server Service Pack 1 is available for download at www.microsoft.com/isaserver/downloads/sp1.asp.

About Foundstone

Foundstone Inc. addresses the security and privacy needs of Global 2000 companies with world-class Enterprise Security Software and Managed Security Services, as well as Professional Consulting and Education solutions. Foundstone has one of the most dominant security talent pools ever assembled, including experts from Ernst & Young, KPMG, PricewaterhouseCoopers, "Black World" defense contractors and the United States Air Force. Foundstone executives have authored seven books, including "Hacking Exposed: Network Security Secrets & Solutions." Foundstone is headquartered in Mission Viejo, California, and has offices in New York, Washington, D.C., and Seattle, WA. For more information, visit www.foundstone.com or call 1-877-91-FOUND.

Note to Editors: Foundstone is a trademark of Foundstone Inc. All other companies, brands names or products are trademarks or registered trademarks of their respective companies.