TMWD Tumbleweed Communications Corp (MM)

Tumbleweed(R) Communications Corp. (NASDAQ:TMWD), a leading provider of e-mail security, file transfer security, and identity validation solutions, today announced that the United States Marine Corps (Marine Corps) has achieved enterprise-wide digital certificate validation with Tumbleweed Validation Authority, the most widely deployed public key infrastructure (PKI) validation solution in the US Department of Defense (DoD). Based on the open standard Online Certificate Status Protocol (OCSP, RFC 2560), VA validates the status of digital certificates in real time, ensuring that revoked credentials cannot be used for secure email, smart card login, web access, wireless, VPN, or other electronic transactions. Prior to January 2002, the Marine Corps had deployed a PKI validation solution that relied on Defense Information System Agency (DISA) generated certificate revocation lists (CRLs). In operation over time, these CRLs became so large in size and number that Marine Corps mission critical applications would ultimately "time out" when attempting to obtain, process, and make a determination on a digital certificate's validity for a given transaction. The growing size of these CRLs threatened to degrade the performance of the Marine Corps operations, increasing costs and undermining the integrity of its PKI system, particularly with respect to e-mail communications and other applications dependent upon authentication. The Marine Corps objective was to find a PKI validation solution that could speed the real-time validation of digital certificates, ensure secure communications, and support the system-wide use of Common Access Cards (CAC) for cryptographic access to desktop, server, and network resources. The organization was also looking for a solution that would work with its existing consolidated deployment of Responder servers/hardware signing modules (HSMs). Adding more HSMs would increase security compliance costs substantially, since these devices are subject to strict physical and logical security requirements. Other considerations necessitated the ability to provide multiple level failover and backups to ensure continuity of validation in disconnected operating environments. After a thorough evaluation of PKI validation products and vendors, the Marine Corps selected Tumbleweed VA as the solution that could best support these objectives. The Tumbleweed VA deployment was implemented in a Repeater--Responder configuration to achieve the highest level of reliability, availability and performance. The Repeater component of this configuration also kept deployment and infrastructure costs in line by preserving the previous consolidated deployment of multiple Responder servers/HSMs. Unlike Responders, VA Repeater servers do not require the same level of security and can reside in a wide range of environments at reduced cost. Today, the Marine Corps is relying on VA to provide enterprise-wide, real-time digital certificate validation throughout the organization, ensuring that revoked credentials are not used for secure email, smart card login, web access, or other electronic transactions. The VA Repeater--Responder configuration is delivering faster, better, and more cost effective identity validation at the desktop and server environments and maintaining system-wide authentication even in disconnected operating conditions. "Tumbleweed's Validation Authority's comprehensive, scalable and reliable framework for real-time validation of digital certificates has allowed us to strengthen our security posture significantly," said Joseph Seitzer, PKI Integration Team, U.S. Marine Corps. "Its robust security capabilities, ease of administration, and extensibility are ensuring the requisite level of validation essential for establishing the trusted relationships on which our operations depend, whether for exchanging sensitive information, processing transactions, or accessing network systems critical to strategic and tactical units." "The size and number of CRLs is no longer an issue," Seitzer added. "VA is allowing mission critical applications to perform real-time queries on the status of digital certificates in a much faster, reliable, and cost-effective manner. The speed of secure e-mail communications has increased substantially, server validation is ensuring that only authorized individuals gain access to system resources, and cryptographic logon via smart cards has eliminated the need for multiple passwords for accessing network systems." The innovative VA Repeater--Responder architecture has already demonstrated its capabilities for maintaining continuity of validation. In one situation, a power outage at a facility caused the responders to go off-line when network connectivity was lost. VA's robust replication system mirrored certificate revocation data across the array of VA servers, allowing the Repeaters to continue providing seamless authentication despite the temporary loss of the Responders. This multilevel support for backup, load balancing, and failover is critical for maintaining the integrity of communications, especially with expeditionary forces. About the Tumbleweed Validation Authority Tumbleweed Validation Authority (VA) ensures the validity and integrity of highly valued and trusted transactions. Validation Authority is a Certificate Authority (CA) neutral, extensible server that utilizes multiple validation protocols for checking the validity of X.509 certificates within Public Key (PKI) environments. Validation Authority delivers a comprehensive, scalable, and reliable framework for validating digital certificates in real time, and can validate a certificate issued by any CA. It complies with Federal Information Protection Standard (FIPS) 140-l, DOD Joint Interoperability Testing Command, and Identrus standards. Additionally the Validation Authority is completing Common Criteria (ISO/IEC 15408) Evaluation Assurance Level (EAL-3) by the National Information Assurance Partnership (NIAP), a collaboration between the National Institute of Standards and Technology (NIST) and the National Security Agency (NSA). About the United States Marine Corps Established in 1775 by the Continental Congress, the United States Marine Corps (Marine Corps) is the only branch of the armed services specifically organized with air, land, and sea-based expeditionary fighting capabilities. Renowned as the "First to Fight," the Marine Corps is a force of more than 40,000 personnel that has a unique and complex mission, particularly with respect to the global war on terror. To this end, the organization is committed to exploiting a wide range of technologies to maintain its capabilities for responding to a broad range of contingencies and conflicts anywhere in the world. For additional information, go to www.usmc.mil About Tumbleweed Tumbleweed provides security software and appliances for email protection, file transfers, and identity validation that allow organizations to safely conduct business over the Internet. Tumbleweed offers these products in three comprehensive suites: MailGate, SecureTransport, and Validation Authority. MailGate provides protection against spam, viruses, and attacks, and enables policy-based message filtering, encryption, and routing. SecureTransport enables businesses to safely exchange large files and transactions without proprietary software. Validation Authority is the world-leading solution for determining the validity of digital certificates. Tumbleweed's enterprise and government customers include ABN Amro, Bank of America Securities, Catholic Healthcare West, JP Morgan Chase & Co., The Regence Group (Blue Cross/Blue Shield), St. Luke's Episcopal Healthcare System, the US Food and Drug Administration, the US Department of Defense, and all four branches of the US Armed Forces. Tumbleweed was founded in 1993 and is headquartered in Redwood City, Calif. For additional information about Tumbleweed go to www.tumbleweed.com or call 650-216-2000. SAFE HARBOR STATEMENT Tumbleweed cautions that forward-looking statements contained in this press release are based on plans and expectations as of the date of the press release, and that a number of factors could cause the actual results to differ materially from the guidance given at this time. These factors are described in the Safe Harbor statement below. Except for the historical information contained herein, the matters discussed in this press release may constitute forward-looking statements that involve risks and uncertainties that could cause actual results to differ materially from those projected, particularly with respect to the functionality and performance of Tumbleweed products. In some cases, forward-looking statements can be identified by terminology such as "may," "will," "should," "potential," "continue," "expects," "anticipates," "intends," "plans," "believes," "estimates," and similar expressions. For further cautions about the risks of investing in Tumbleweed, we refer you to the documents Tumbleweed files from time to time with the Securities and Exchange Commission, particularly Tumbleweed's Form 10-K filed March 16, 2005 and Form 10-Q filed August 9, 2005. Tumbleweed assumes no obligation to update information contained in this press release, which represents the Company's expectations only as of the date of this release and should not be viewed as a statement about the Company's expectations after such date. Although this release may remain available on the Company's website or elsewhere, its continued availability does not indicate that the Company is reaffirming or confirming any of the information contained herein.