NetScreen Technologies

» see netscreen.com as it lived, on the wayback machine

~ the last words ~

A firewall in 1997 was software on a general-purpose computer, and it was slow in the way that software doing packet work on a general-purpose computer is always slow. Three engineers incorporated NetScreen Technologies in Delaware that October with a different answer: build the inspection into an application-specific chip and let the silicon do the checking at line rate. They called their chips GigaScreen, and the NetScreen-1000 was the first gigabit-speed firewall any manufacturer had built.

Ken Xie was the chief technology officer and the first chief executive. He handed the top job to Robert Thomas, who arrived from Sun Microsystems in 1998, and then left altogether in 2000 to start Fortinet, which sold hardware-accelerated security appliances in direct competition with the company he had co-founded. That is an unusual exit even by the standards of Silicon Valley, and it worked out for him. Fortinet is one of the larger security companies in the world today and still trades under its own name. NetScreen went into Juniper's catalog as a brand and came back out of it.

The money arrived late and then arrived fast. NetScreen went public on Nasdaq in December 2001, three months after the September attacks and in the middle of the worst market for technology listings in a generation. Revenue for the year to 30 September 2002 was $138.5 million with a loss in every quarter. The next year it was $245.3 million with a profit in every quarter. By then the company had 646 people, 181 of them writing code.

~ the record ~

~ the chip was the argument ~

Everything NetScreen sold rested on one claim, which was that security belonged in hardware. The product line split into chassis systems for data centers, the 5400 at the top and the 500 below it, with fixed appliances for everywhere else. All of them ran the same embedded operating system, ScreenOS, and all of them used the GigaScreen family of chips to do the encryption and the stateful inspection without a general-purpose processor in the path.

By 2003 the pitch had moved on from raw speed to what the company called Deep Inspection, delivered in ScreenOS 5.0, which added intrusion detection to the firewall rather than selling it as a separate box. The technology for that came in from outside: NetScreen bought a company called OneSecure for $45 million in stock in 2002, and then paid $20 million in cash plus 9.7 million shares for Neoteris on 14 November 2003, which is how SSL VPN got into the portfolio five months before Juniper arrived.

~ the founders scattered ~

The genealogy of this one company is unreasonable. Ken Xie left in 2000 and founded Fortinet. Through the OneSecure purchase NetScreen also acquired Nir Zuk, an Israeli engineer who had been one of Check Point's earliest employees and who left in 2005 to start Palo Alto Networks, along with his OneSecure co-founder Rakesh Loonkar, later of Trusteer. The Neoteris product became Juniper's secure access line and was eventually spun out again as a separate company.

Shareholders of both companies voted on 16 April 2004 and the joint press release said the parties expected to close by the end of business, Pacific time, that same day. The ratio was 1.404 Juniper shares for every NetScreen share, against a merger agreement dated 9 February. The deregistration form went in five days later.

~ the code that was not theirs ~

In December 2015, eleven years on from the merger, Juniper announced it had found unauthorized code sitting in ScreenOS, the operating system NetScreen had written, present in shipped firmware from 2012 onward. One part was a root password backdoor. The other was an altered point in the Dual_EC_DRBG random number generator, which would let whoever held the matching key passively decrypt VPN traffic going through the device.

Nothing in that story is NetScreen's doing. The company had been gone for over a decade and the code was modified long after the founders had scattered to their own firms. It is still the reason most people have heard the name, and there is something bleak about an engineering effort whose whole premise was putting security beyond the reach of software ending up remembered for software somebody quietly edited. netscreen.com has not gone away. Type it in and you land on Juniper, and Juniper now forwards you to HPE.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »