The Ashimmy Blog

No iPhone envy here

So I have been watching half amused, half interested in iPhone mania this weekend.  I guess with this kind of hype some disappointment was bound to happen.  Sounds like Brad Feld and some others have had a rocky road to getting their iPhones up and running. Nothing more frustrating for a gadget boy or girl, than to have the pretty new toy and you can't get the friggin thing to work.  I am sure over this week (maybe not with the holiday actually) the iPhone hook-up problems will subside.

In the meantime the reasons I have heard that people want the iPhone (besides the coolness factor) is that they want to combine phone, music, email and browsing. The negatives I have heard about iPhone is no tactile keyboard, no true exchange integration and no 3G connectivity. 

I read most of this news about the iPhone problems today while sitting poolside at the Naples Grande Resort.  I was reading it while cruising the web at real 3G speeds and using Newsgator Go! for RSS feeds.  I was directly connected to our Exchange server via Microsoft Active Push technology and was listening to a new playlist of songs (no iTunes DRM issues here) I had downloaded to my phone (ATT 8525).  I also responded to email using my large tactile keyboard that slides out of the phone and at the same time, when phone calls came in, I answered them, speaking through the same headphones I was listening to the music on (in fact the media player stops when the phone rings). I have touch screen, but no flick, 2 megapixel camera/video and bluetooth.  So while my first 8525 was defective, since ATT replaced it, I have not had any problems.

iPhone envy?  Not here.

3Com spinning off Tipping Point?

OK, I didn't read this in a fortune cookie, but I have heard it from multiple sources in the analyst community over the last weeks that 3Com is spinning off Tipping Point.  I guess someone had to pay for buying out the Huawei partnership. Seriously, lets look at what this could be about.  First of all I understand at first blush that this could look like the EMC-VMWare spin-off, where EMC is just selling 10% of the company off. I understand that initially 3Com will spin off just a % of Tipping Point.  But my sources tell me that the plans are that they will follow this by selling most or all of their stake in the IPS vendor.  Background is that 3Com paid 425 million for Tipping Point just about 18 months ago.

So why would 3Com do it.  Do they need the cash?  Spin off Tipping Point, establish a market value and then sell stock off in TP piece meal, like going to the piggy bank. I thought they actually had secured funds for the Huawei purchase and were actually still sitting on a ton of cash, so I don't think that is the issue.  Do they think Tipping Point is past  its prime?  IPS is increasingly a commodity business, even at the top end and can Tipping Point continue to grow at past rates?  Tipping Point has tried to break out beyond IPS into NAC. But in my opinion their NAC product was far from best of breed. What do they do to follow up IPS?  They have tried to move into UTM, but with Fortinet, Cisco, etc. that is another rough market.  Much of their special sauce seems to work only on 3Com switches. Maybe the 3Com folks think they can pull out the most value from spinning it off now, before the bloom is off the rose.

Here is another possibility.  Can it be that despite best efforts, it was just a case of irreconcilable differences in culture.  No matter how big the merger, if corporate cultures clash, it just doesn't work.  With 3Com up in Massachusetts and the TP gang down in Texas, could they not work out the roles and get the organizations on the same page,acting as one company?  In my opinion, the Tipping Point folks have always been embarrassed and reluctant to acknowledge that they were part of 3Com. Current 3Com CEO, Edgar Masri has his roots in the 3Com switch and network business.  I don't know for sure, but that could be the real reason for this.

In the interests of full disclosure, StillSecure is partnered with 3Com. We also compete with Tipping Point in the IPS market with our Strata Guard product. We have dealt almost exclusively with the switch folks up in HQ and have not dealt much with the TP folks.  The switch folks we have met are on the ball and seem to know what they want. Recently, 3Com has made some aggressive moves in both the SMB and enterprise switch and network gear business.  In the far east they are still a power and of course the Huawei partnership business has a lot of upside they say.  A 3Com without Tipping Point, I think is still a powerhouse in the network space.  A Tipping Point without a 3Com big brother is going to have to go head to head with some bigger players in the crowded IPS space like IBM/ISS, McAfee, Cisco, etc.  They could be just another player in a crowded field.

As usual, time will tell.  Stay tuned for more details.

Authors note: After publishing I see that Mitchell wrote his own story on this based not upon my sources but from a Edgar Masri interview. I guess that makes it official.

Novell gets into endpoint security with Senforce OEM

A particular focus for me at StillSecure is our OEM relationships.  OEMs represent a terrific force multiplier for a smaller company to compete in the market against many of the Goliaths in the security business.  I was very happy to see the recent announcement that Novell is OEM'ing the Senforce endpoint security tool.  Congratulations to Mike Hall, Nolan Rosen and all my friends at Senforce.  Like StillSecure, Senforce has executed several OEM deals in the past.  This Novell deal has the potential to be a good one for the Drapier gang. 

By way of disclosure, Senforce and StillSecure have in the past announced a partnership and relationship around security. Senforce has built a great endpoint tool that goes beyond what many larger companies offer today.  Of course now the hard part starts.  Helping your OEM partner to be successful in selling your product under their brand is not easy.  It may not be a huge focus for the company selling it and sales and technical support have to be in place.  OEM is certainly a rewarding line of business, but you need to give your partners what they need for success. The Senforce guys seem to know what to give, the question will be:  Are people going to look at Novell for endpoint security solutions?

VM- still in the hamster wheel - It has to be about soloving problems!

Was just reading Kelly Jackson Higgins report over at Dark Reading about Vulnerability Management growing up.  It is based on two new reports put out by the Burton Group. Of course, I have written and believe that vulnerability management as defined by the Burton Group is actually dead and no one has told them yet.

The Burton reports note that one issue around vulnerability management is the answer to everything is not necessarily just to patch. In fact, patching is almost a reactive counter-measure.  You need to handle some vulnerabilities by doing things other than patching them.  I think the problem is how can you automate handling other types of vulnerability remedies without making them labor intensive.  The Burton Group reports talk about several companies trying to do this.  Patchlink with its Harris Stat scanner for instance.  Again, beyond patching the vulnerabilities, without human intervention how are non-patchable vulnerabilities handled?  How about gaging the risk accurately? We develop new rating systems for vulnerabilities, but do they accurately gage the risk to the organization?

Here is my big problem with the vulnerability hamster wheel.  Does it actually solve a problem and makes peoples lives easier or does it create more work and problems?  If the answer is it creates more work and problems, it just may not be worth it.  Lesson learned:  Look for your security tools to solve problems for you, not create them!

NBA - Can it be the star of the show?

No, I am not talking about Kobe, Shaq, Tim Duncan and the rest of the athletes over at the National Basketball Association.  I refer of course to Network Behavior Analysis.  The estimable Mr. Rothman in his daily rant laments the fact that 5 years later we are still trying to explain what it is and that is pretty sad.  I don't think it is sad at all, it is just the facts.  In spite of this though, I think NBA has made terrific strides. Here is why:

1. NBA has grown to encompass a wide range monitoring and detection technologies and techniques which can actually detect potentially malicious behavior and traffic.

2. NBA has shown itself to be one of the best ways to detect zero-day type of attacks (if you don't have a signature for it, you can't detect it).  With security practitioners increasingly concerned about zero days, NBA seems to have found a niche.

3. As Mike points out, NBA has found its way into several other security product lines and adds real value.

Ultimately Mike I think you have to get your head around the fact that NBA may never be a successful stand alone security product.  However, its transition to feature inside of other security products is well under way.  If you want to find more about "market (or product) vs function" I refer you to Mr. Hoff (of the joining with Shimel to pile on Stiennon and promote our own products fame). Of course if you are a stand alone NBA vendor, I would probably be pursuing a very aggressive partnering and business development strategy.  If any NBA business development types are reading this, give me a call.  I think this technology is a great fit for some of the things we are doing at StillSecure.

I guess reservations don't mean anything anymore

With StillSecure being based in Superior, Colorado and me living in Florida, I obviously travel out here quite a bit.  When I do I stay at the Comfort Inn Hotel, right across the street from the office in Louisville.  It is far from a deluxe resort, but gives me a king sized bed, clean room and a great rate.  Most of all it is convenient. I have stayed at the Comfort Inn for years now.  I know the owner of the hotel and most of the people who used to work there.  Whenever I would come in, usually at night as I like to fly in the night before being in the office, my room would be waiting and the paper work done.  Last night my flight was late arriving in Denver and by the time I picked up the rent a car, grabbed dinner it was 10:00 PM by the time I arrived at the hotel. 

I knew something was up when I saw two police cars outside the hotel. The lobby had about 6 people inside who were quite upset and loud.  I went about my business and went up to the desk to tell them I was here.  The desk clerk then told me that the people making reservations had messed up and that all of these people in the lobby also had reservations and the hotel had no rooms.  I said I was sorry for those people, but I am here every other week how can they not have my room.  Well they didn't.  The owner got on the phone to apologize, but it seems the people there were just taking reservations with no idea of how many rooms they had available!  I realize the Comfort Inn is not the Ritz or Waldorf-Astoria, but geez they have a computer system.  What kind of rocket scientists do they have over there.  After listening to the owner apologize, but do nothing for me, I took my bags and left as the police were not taking kindly to the other people who were livid.

It seems there is some sort of girls softball tournament in town this week and all of the hotels in town were booked full.  It was 10:00 a night and I don't have a reservation to sleep anywhere.  Finally, I came to the La Quinta Inn not far from the office. I explained my situation to them and it seems we have a corporate rate here.  They had rooms and I was able to finally get to bed in a nice room there.  It was a double bed, not what I am used to, but when you are looking at sleeping in the car, it looked pretty good. 

I think the Comfort Inn in Louisville has seen me for the last time.  I don't understand how a business can run like that and stay in business.

IDC claims NAC market to reach 3.2 billion by 2010

The latest analyst to publish NAC market data appears to be IDC.  According to this press release, IDC expects the NAC market (interesting they call it network admission control, not access control.  It could be an anti-Gartner thing) to reach 3.2 billion in 2010.  However, they have the market at 526 million in 2005. In the hide the salami numbers game that analyst reports play in, these type of numbers lead me to believe that IDC is talking about switch and network gear as part of the NAC market. That would put this number in the same ballpark as the Infonetics research of a few years back.  To give you an idea, Infonetics also said that this year the NAC appliance market will probably be around 200 million.  So you see, actual NAC hardware and appliances are a small part of the total expenditures attributed to NAC in many of these analyst pieces.

Still it is good to see such a bullish NAC forecast from IDC.  According to Chris Christiansen, VP of IDC's security products and services group, unmanaged devices and users are a major driver in NAC adoption.  This is what we have seen as well.  Exactly why when the patch managers and security configuration crowd claim they solve the NAC problem, I ask what about unmanaged devices.  With more and more of these unmanaged users coming on the network every day the ability to make sure they comply with policy and do not harm anything on the network is crucial.

Other factors figuring into the projected growth are the recent interoperability agreements between the TCG/NAP/Cisco, IT executives agreeing that NAC is an essential part of overal security strategy an the simplicity of NAC appliances.

IDC has put out a full report on their findings (I have not read this yet, but will try to soon) and is put together a special study to track vendor offerings in the NAC market. Sounds like it could be worthwhile if you are looking at NAC.

Managing the Unmanageable: Network Admission Control (NAC) Market to Reach $3.2 Billion by 2010, IDC Says

Shimel the hypocrite

A recent visitor to the blog commented that my last post about what Hooter girls use for protection was hypocritical in light of my anti-booth babe stance.  I did some soul searching and have to agree with the comment. It was a sexist post on two counts.  One was the tongue-in-cheek play on the word protection, which frankly I could live with.  The other thing was relying on the picture of the two hot Hooter girls to get your attention (and frankly I didn't mind looking at them myself).  That was clearly exploitive and sexist and the reader was right to call me on it.

So in the interest of fairness and to keep my reputation for speaking out  against sexual exploitation, I am posting this picture of a Hooter's guy.  You can assume that he is using Sophos for protection as well.

What do Hooter girls use for protection?

OK, I could not resist after reading this article in ITPro.  Looks like the food chain with the scantily clad women is replacing their current anti-virus solution with Sophos.  Sophos is doing a good job of moving beyond just AV into endpoint solutions.  It doesn't sound like this is a NAC deal, but the way Sophos is packaging they have certainly moved beyond just AV.

The article points out that the Hooters folks especially liked a special "Sophos Competitor Removal Tool" that uninstalled their old AV automatically without even rebooting (removing some of these AV programs are a pain I know).  They also tout automatic updates.  If this was a factor, I would love to know what AV they were using that did not automatic updates. I thought they all did at this point.

In any event I am sure we will all sleep easier and be more likely to frequent Hooters knowing that the Hooter girls are using protection ;-)

Long live the revolution!

Rich Stiennon is someone that I have blogged a lot about.  Of course Rich is perhaps best known for his "IDS is dead" prediction while at Gartner.  Over the last few years, Rich and I have gone back and forth on NAC and his secure network fabric concept. But I think history may record another Stiennon prediction as perhaps his most insightful.  But if they do, let them also record, StillSecure was there first!

Rich writes in SC Magazine today about his vision of the 4th generation of UTM. Now I am not going to say that Rich took his idea from us (I was on a UTM panel with him at RSA), but this article reads like a Cobia PR piece.  Let me give you some quotes here:

We are rapidly approaching the advent of the fourth generation security platform. This is a device that can do all of the security functions that are lumped in to UTM but are also excellent network devices at layers two and three. They act as a switch and a router. They supplant traditional network devices while providing security at all levels. Their inherent architectural flexibility makes them easy to fit into existing environments and even make some things possible that were never possible before. For instance a large enterprise with several business units could deploy these advanced networking/security devices at the core and assign virtual security domains to each business unit while performing content filtering and firewalling between each virtual domain, thus segmenting the business units and maximizing the investment in core security devices.

One geologic shift that will occur thanks to the advent of these fourth generation security platforms is that networking vendors will be playing catch up, trying to patch more and more security functions into their under-powered devices or complicating their go to market message with a plethora of boxes while the security platform vendors will quickly and easily add networking functionality to their devices.

Fourth generation network security platforms will evolve beyond stand alone security appliances to encompass routing and switching as well. This new generation of devices will impact the networking industry it scrambles to acquire the expertise in security and shift their business model from commodity switching and routing to value add networking and protection capabilities.

I swear. if Rich would have mentioned open source and Moore's Law providing the horsepower to make this happen, I would have sent him a check from the Cobia marketing budget!

But lets not be naive.  If Rich is writing this, you can bet his employer, Fortinet will be coming out with a network/security convergence box shortly.  We already have almost 2 years into Cobia development and welcome the company.  It will be interesting to see if Fortinet tries to do everything themselves or opens up the platform for 3rd parties.  In any event, another prescient prediction from Stiennon. Maybe this will go down as the beginning of the secure networking revolution.