The Ashimmy Blog

The last friggin' tag of the year

So I have been watching all the tagging stuff going on and laughing.  After a while I was a bit perturbed that no one tagged me, but was glad not to join in the nonsense.  But count on my friend Michael Farnum to drag me in.  I was thinking of ignoring it, but Mitchell, Michael at MCW Research and Mike Rothman responded, so how can I not respond.  Before I do, let me congratulate and offer my thanks and respect to both Michael Farnum and Michael from MCW Research for their valiant service on behalf of our country.  You are both real, live American heroes.  Also, I am not going to tag 5 more people, as Mitchell said by now everyone I know has been tagged.

So here are my 5 things you probably did not know about me:

1. I am a sore loser but worse than that, a terrible winner.  I have sent people home from football parties crying because my team beat theirs.  It is something I try to control but can't help it sometimes.

2. I am a frustrated guitar player.  I took lessons for about 4 years when I was a kid and then twice again later on.  I have recently got the bug again and am looking at guitars to buy and start playing.

3. I started college when I was 16 and could not go out drinking or driving (not at the same time though) for my first year of college.  As a result, I pretty much was a social loner my first year.

4. Until recently I was not a big fan of wine, but have developed a taste for red wine over the last 2 years.  Still my favorite drink is a Grey Goose Martini, straight up, dirty and extra olives stuffed with blue cheese preferably.

5. I was actually a jock in school and until I was about 17 played sports just about every day of my life.  As a result I was late to the whole social-partying scene (but made up for it later)

There you have it.  Happy New Year everyone.

StillSecure, After all these years, Podcast #26 - Biggest Security Stories of 2006

Episode 26 of StillSecure, After all these years is a year end wrap up of the biggest security stories of 2006.  It is a little different than most, in that Mitchell and I have asked some of our good blogging and podcasting friends to give us their biggest stories of the year.  Mitchell and I are joined by none other than Mike Rothman in then discussing these stories.  In addition to Mike Rothman, Mitchell and I, you can hear:

1. Martin McKeay from Network Security Podcast and blog
2. Michael Farnum from Information Security Place
3. Perry Carpenter from Security Rennessance blog
4. Ravi Char from Musings on Information Security
5. Larry Pesce from Paul Dot Com
6. AndyIT Guy from Andy ITGuy blog
7. Michael from MCW Research
8. Mike Murray from epistome.ca blog
9. Dan York from Blue Box VOIP podcast and blog

Unfortunately, I recorded this from the road over the holidays and the sound engineering is less than the best.  There was something wrong with my microphone that was clicking and the remix did not come out as good as I would like.  I may upload a newly mixed copy over the New Years holiday.

Happy New Year to everyone!

We hope you enjoy the show and please send any questions, comments or suggestions to us at podcast@stillsecure.com.

Thanks to ClickCaster for hosting our podcast. Tonights music is the usual, To the Summit by Jon Schmidt. You can hear more from Jon at http://www.jonschmidt.com.

View this Podcast at www.clickcaster.com

http://clickcaster.com/resource/audio/stillsecure-after-all-these-years-podcast-26.mp3

Happy, merry and healthy holidays

Bonnie, the kids and I leave today for a 10 day vacation to NYC and surrounding areas to visit family and friends and show the kids the big city.  I don't think I will have much time to blog, so don't expect too much content between now and the first of the year.  Maybe our end of year podcast, if I can find time to edit it.

So to all of you from me, have a merry, happy and healthy holidays and here is to a great 2007!  Thanks for reading my blog and listening to our podcast.

The Knack of NAC on eWeek

An interview I did with Matt Hines for the OnSecurity podcast on eWeek posted today.  Matt is a great guy even though he is a Red Sox fan ;-).  You can go to the site to download here or download the mp3 directly here. Matt had some really good questions that made it easy for even me to answer.  Some good stuff. If you get a chance give it a listen. 

More on Net Clarity and Sourcefire

Following up to my article yesterday I had a chance to catch up with Gary Milefsky, CTO of Net Clarity. I have known Gary for years now, going back to my Interliant days.  Gary assures me that the lawsuit against Sourcefire has merit and they are confident of winning this trial.  I did not get into the merits of the suit with him, as I don't think it is fair for Gary to comment on a case currently in trial.  However, Gary does feel confident of victory.

On the issue of Nessus, Gary says Net Clarity has a policy that they do not divulge what they use or do not use in their product.  However, he gives me his assurance that they do not violate anyone's IP or copyrights or licenses.  Now I had heard the nessus stuff independently of my own knowledge from 3rd parties.  Not having used the Net Clarity product, I don't know for sure.  But if Gary wants to be less than truthful with me, that is on his own conscience.  I will give him the benefit of the doubt based up on the years I know him and say OK, they are not violating anything here.  If someone knows differently please feel free to comment or drop me a line.  Gary, I am changing my mind and taking back what I wrote earlier based upon your representations to me and our long relationship.  I hope that trust is not misplaced!

Spam levels hitting new highs

Good article by Ellen Wulfhorst in ComputerWorld about the increased levels of Spam we are seeing this holiday season.  Postini says 93% of email was spam over the last few months.  I would tend to agree with that.  Even with all the spam filters that we have at the gateway, on the server and in my mail client, it is still getting by way too often. 

The article points out that the reasons for this increase are that spammers are using new tricks to get by the filters.  They are using image e-mails that account for 30% of spam. Another big player are the phishing emails, which appear to be legitimate. But my all time insidious ones are the pump and dumps.  I have been getting hit especially hard with these lately.  Maybe you have too, the email is from a persons name, like John Doe and subject is, It's John. Or some similar use of the persons name. What boggles my mind, is who in their right mind would read this crap, let alone go out and buy a stock they were touting.  However, one thing about spammers, if they are not making money, they don't do it, so there must be some idiots who act on this.  For me, I never have a problem hitting the delete button early and often.  Real simple, don't buy anything or respond to the Spam, take the economic incentive out of it and we will all save the billions of dollars it costs us!

The pot calling the kettle black and not all open is open source

I have been following the Sourefire IPO saga for some time now, literally since the Checkpoint deal was quashed and Team Marty announced they were going to IPO.  Like others here and here, I never thought that the IPO would actually happen.  I thought that someone would come in and snatch them up.  However, recently there has been some scuttlebutt about the potential liability from the Predator Watch/Net Clarity lawsuit hanging over the IPO.  Nick Selby over at the 451 Group wrote an article detailing the facts as they are known publicly here.  Then Dave Rosenberg questions how there can be IP questions when the source code is readily available for review.

I find Dave's comments frankly naive.  I don' t think the Predator Watch/Net Clarity law suit has anything to do with open source or a similarity in source code, but rather a similarity in functionality. Nor would a similarity in source code have anything definitively to do with the merits of the suit, unless the source code itself was copied, which is not the claim here I believe.  I think the claim is that the idea of how it works was what was allegedly divulged to Sourcefire. That being said though, I think Nick gives this suit more than its due. I think ultimately this suit amounts to little more than aneffort by a small business trying to cash in on someone else's success.  What is even more ironic about this particular tale is that the company doing the suing does not exactly have clean hands, as far as I can tell about using someone elses IP.  I think they still are using the Nessus scanner and NASL rule set in possible violation of the license for such as issued by Tenable Network Security.  There is a principle in law that a plaintiff should have "clean hands".  If that principle is applied here, Net Clarity's use of Nessus and NASL scripts could be construed as not having clean hands on the matter. Now they are calling in Checkpoint, to see if they found anything out about this in the due diligence for the aborted acquisition.  Sounds like a classic fishing trip to me and the court should stop this farce and waste of time and get to the facts of the case.

For a good look at a VC's view of this sort of issue, I know Brad Feld has written about why VC's don't sign non-disclosure agreements.  It is exactly for this type of situation.  I think the Predator Watch/Net Clarity people are going to find out that they are better off trying to build a business based on their products working better than the competition, than trying to beat them in the courtroom.

Is this a sign the apocalypse is near?

Reading the article today in darkReading about a working group formed by the IETF to set a NAC protocol that will work across Cisco NAC, TCG, NAP, Juniper, Microsoft, etc.,  I thought for sure hell must be freezing over.  Further, reading that the two co-chairs of this working group were representatives from Cisco and Juniper and that Microsoft was involved as well left me with no other conclusion than the apocalypse must be upon us and this really is the end times.  What else could be behind bringing these diametrically opposed forces together for a common good.

On further consideration though a few things come to mind.  First of all, are Cisco and Juniper realizing that many of the NAC start ups are in fact eating their lunch in this space with better products.  The absence of a true industry wide standard is allowing these smaller and nimbler competitors to thrive in a fragmented market.  By coming to terms on a common standard, they can then use their combined market girth to force customers to adopt their standards and their products?  Also, before we all pop the champagne corks, lets remember this is just the formation of a group.  From what I am told about how the IETF works it still may be a number of years until anything comes out of this.  However, make no mistake in hindsight this does have the potential to be a major story for 2006 and NAC.

Checkpoint finally gets their IPS

In a case of try, try again until you get it right, Checkpoint announced today that they have acquired NFR Security.  NFR is a long time player in the IDS/IPS market.  Frankly, they have been regulated to a 2nd or even 3rd tier status for some time.  Many people had wondered what was going to happen to keep the doors open at NFR and this answers that question.  From Checkpoints point of view, they obviously wanted to bring some IDS/IPS technology in house and this gives them something.  The question is what.  NFR has made some noise with their Sentavist IPS which combines some vulnerability detection and correlation with the base IPS.

With just 22 employees and little presence in the market, I don't think this is anyway near the impact type of acquisition the Sourcefire deal would have been.  But on the other hand they paid just 20m total here.  That seems really cheap!  Tells me that NFR did not have many alternatives or leverage, the revenue was not there and security companies are getting cheaper to buy.  I don't believe that last one, I think security companies that don't have a lot of revenue or strategic value are cheap, but quality always costs money.  Anyway, I don't think the government will hold deal this up.  The question will be as to how well Checkpoint integrates this technology into their products.  Only time will tell, but consolidation in the security market continues.

StillSecure, After all these years, Podcast #25

Episode 25 of StillSecure, After all these years features Michael Farnum as our special guest.  Michael blogs lives security and blogs as well.  You can read his blogs at Computerworld and his own blog, An Information Security Place.  Michael also recently made the switch from security manager to security sales engineer and talks about how his new role is effecting his views on security, software, vendors, customers, etc.  Michael takes his security very seriously and is a great guy to talk to.  You will find him very interesting.

In "The Converging Minute" Mitchell talks about Cisco's announced move towards becoming a software company.

"This Week in Security" finds Mitchell and I discussing:

1. The Big Yellow Worm and Bot attack
2. UCLA data compromise
3. The future of vulnerability assessment

We hope you enjoy the show and please send any questions, comments or suggestions to us at podcast@stillsecure.com

Thanks to ClickCaster for hosting our podcast. Tonights music is the usual, To the Summit by Jon Schmidt. You can hear more from Jon at ttp://www.jonschmidt.com.  Music transitions between segments are by our own Mitchell Ashley!

View this Podcast at www.clickcaster.com

http://clickcaster.com/resource/audio/stillsecure-after-all-these-years-podcast-25.mp3