The Ashimmy Blog

This weeks Yiddish word of the week - Naches

Non-Security post to follow, stop reading now if not interested.  According to Wikepedia the Yiddish or Jewish word naches means: feeling of pride in the achievements of one's children.  Growing up, my grandmother used to use this word all the time to describe the joy she felt whenever my siblings or I would do anything noteworthy.  As I grew up I tended to put this word into the pile of other obscure Yiddish words that my grandmother used.  When she passed away I didn't really know anyone else who spoke the language and I began to forget them.  My mother-in-law used Yiddish words like that as well and I learned some more from her, but when she passed away too, that was pretty much the end of my learning the language.  Today I got an up close and personal lesson on the the meaning of naches. 

As I have written about before my oldest son Landon's (8) baseball team is having a tough season. We have not won one game all season. In fact in many of the games we are not even competitive.  I had moved Landon up to this level of play even though he is a year or more younger than most of the other kids in the league.  The level below though was one he was in for two years and made the all star team last year.  So we moved up to kid pitch and took our chances.  Landon started off slow with the rest of the kids on the team. However, he kept working and has been pitching and playing 2b and SS most of the year.  He has also been working on his hitting.

While most of the kids on our team have shown steady improvement, Landon has really come in to his own.  Not only in raw baseball skills but in situational awareness of the finer points of baseball (knowing when to throw and where).  In today's game our other two pitchers were not at the game. I had Landon pitch the whole game.  He did great, making a bunch of great plays in the field.  He also had three hits, each time picking up an RBI.  He hit the ball hard each time. We lost again, but it was a close game.

At the end of the game, both the umpire and the coach of the other team came over and not knowing Landon was my son told me that he was a great player and the best player on the field.  Last game the coach of the first place team came over to tell me when he picks the all star team to play travel ball, he wants to pick Landon on his team.  After all these years (like the title of my blog), I finally have learned what my Grandmother meant by the word naches!  I am really proud of Landon and all that he is accomplishing in baseball.

10, 9, 8, 7, . . .

The ball has begun to drop in the countdown to the RSA Security Bloggers Meet up.  Jennifer and the rest of the event committee have made the list and checked it twice.  Naughty or nice, we just can't fit another person in.  The buzz around this years event is palpable.  Both in person at several events I have attended, as well as on email and especially with the tweet crowd, the security bloggers and media are all a twitter (OK bad pun I know) about the event.  Whether it be a chance to hoist some cocktails with friends old and new or ask that question you have always wanted to ask that person, we are just a week or two away.

Remember, there will be live audio and video podcasting for you to join in the fun (you will have to buy your own drinks though) if you are not there in person.  Also, we think the live Twitter feed should add a new dynamic element to the virtual attendees.  Be sure to follow the feed @RSABloggers2008.

We are already looking at other blogger meet ups at other events.  If you are interested please drop us a line or leave a comment.  To everyone who has RSVP'ed already, we are really looking forward to seeing you at the event!

If it quacks like a duck, walks like a duck, it must be NAP

I had an interesting meeting with Microsoft on NAP the other day.  While, I think you would have to pretty delusional to not realize that eventually NAP will dominate pre-connect health checks of devices, I was surprised at the "Microsoft-ease" they still speak about around NAP. First of all they insist that NAP is not a product or even in deference to my friend Hoff, a feature. Instead NAP is a platform. Implying that other products will run on top of it. Next they again reiterated what we have heard before, that NAP is not a security tool, but just a real estate play.  Enabling devices to be up to spec.

My take on this is I don't know if the Microsoft folks are being disingenuous regarding these two points or just are they that naive?  My gut tells me that Microsoft is usually not naive.Yes, third party vendors can show that they can add more tests than NAP will have. Yes, you can use SHVs and SHAs, but how much are people really going to value them?  You can take the information it generates and do some reporting around it. But lets be clear the NAP "platform" is most certainly going to be used as a product. 

It will be used as a product, it will be a security product at that.  Configuration management could be said to be borderline security by some.  But when you add the ability to deny access to those not up to snuff on configuration, I think you have clearly crossed the line into security.  I think Microsoft would come of better saying that NAP is not meant to keep out the determined hacker, but saying it is not a security tool just doesn't ring well.

So what is the rest of the NAC vendor world to do?  Should we all pack up and follow Vernier and Lockdown to the next cool thing?  No, not at all.  I think there are exciting opportunities at hand with NAP. Yes it is a security product, but it also is an enabler for more NAC features. The successful NAC vendor has to figure out what those are and capitalize on them.  Also NAP is all about health checks.  Post-connect, identity based NAC and other NAC  features can be used here to enhance the health checks.  Overall NAP will drive the NAC market to move beyond just health checks and that will be a good thing for the NAC market and customers.  But guys lets be real, it is a security product!

Is there a better way to design interfaces?

Michael Farnum has a great post up today wondering if we in the security industry have been stifling our creativity by designing all of our management interfaces in one of two paradigms. The GUI kind of look and feel pioneered by Checkpoint or the command line standard that Cisco has made their own. It struck a chord with me because it was actually the second time I have heard the same comment this week alone. In speaking with one of the big analyst firms our own VP of product strategy, Andrew Grealy made the same comment.

This actually goes to the heart of what we are trying to do, especially with our Cobia product. We think there has got to be a better way. Why can't products just work, the way Apple does it for instance. So many things in the Mac interface are binary. You plug a mouse in, you don't get a message that the system has detected a new pointing device and goes through the install and you may have to pick a driver. You plug it in and the mouse works. If it doesn't work, something is wrong. Andrew has some great ideas on this around security. Instead of plugging in your IPs and stuff, wouldn't it be great to just tell your security product to protect your web servers? Is there a better way to let you manage a firewall? We think there is.

At StillSecure we have a history of creating easy to use GUI that are powerful yet intuitive. Andrew and his team are working on a rework of our Cobia GUI and some of our other products that we think are going to break out of the Checkpoint/Cisco mold for good once and for all. We hope the market will reward the innovation and the easier way to do business.

My new favorite hotel chain - Hyatt Place

As most road warriors will tell you, generally we pick a hotel chain and try to stay there as much as possible.  Whether it be Marriott or Hilton, Choice or Priority Club, Hyatt or Starwood, we all have a favorite that if available we will choose.  Generally, I try to stay at reasonably priced hotels and don't stay at anthing over a Courtyard very often.  However, I have a new favorite chan.  Hyatt Place by Hyatt is cool!  Not too expensive, they offer 42 inch HD TVs, spacious rooms with bedrooms and sitting areas, wet bars, work desk and upscale decor. Wireless phones and Internet included. They also have a very nice lobby, with a 24 hour kitchen and a very different check in process. Your Hyatt Gold Points are good here as well.

They are just getting rolled out in some parts of the country.  But next time you are on the road and there is one conveniently located for you, I highly recommend you check it out for yourself.

Virtualization and security

No doubt about it, virtualization is quickly becoming the new darling of the security media. Of course I am judging strictly by the media requests we are receiving for interviews. I am still learning about all of the different issues here and will have to pick Hoff's brain a bit, but thinking out loud, here is what I am seeing in terms of categories:

1. Utilizing virtual machines for security versus securing virtual machines. In another words is virtualization an enabler of security. Many security companies by allowing their products to run in a virtual machine claim they have a story around virtual security. To me they are just using virtualization as an enabler to let their product be more efficient and less hardware intensive. However, I don't quite buy that this is virtual security.

2. Virtual to real security - This is security that plays at the intersection of virtual data flows into "real" networks. I don't think you need that much virtual special sauce to play at this intersection, but there are companies jumping the virtual bandwagon by doing just this.

3. Server vs desktop virtual security - A lot of focus has been on the data center/server/application virtualization aspect. I do think that this is where we are going to see a lot product innovation in the coming months. However, over the longer run we are going to see security issues around desktop virtualization. Whether it be desktop agents or better sandboxes that are more OS and HW independent (not just floating on top of the OS), I think there is opportunity here for innovation as well.

4. Virtual to virtual security - this is the part that has me most excited. I think controlling this virtual to virtual data flow is going to take a new class of security. More than the APIs in VMsafe, we are already starting to see a new products and companies filling this niche.

I will be watching RSA carefully to see if this virtual security theme is the "next big thing" for this years show. I think you should too!

Thought I was going to miss my plane, but it is US Air - no way

I was scheduled to fly out of Ft Lauderdale today up to Charlotte on a non-stop US Air flight.  It was a crazy day as I tried to do everything I could before leaving for a week of business.  I raced to the airport, but a traffic accident slowed me up and then there was no parking on the airport.  All the time I was doing press interviews over the phone.  I knew that I probably blew my flight and was looking at a later flight.  But never fear US Air is here!  Of course my flight was late, so far just 90 minutes.  The hilarious thing is first the attendant tried to tell me it was due to weather in Charlotte.  When I told him that I was on the phone with my friend who was switching planes in Charlotte right now and the weather was beautiful, he rechecked and told me yes indeed it was a mechanical problem.  Anyway, sitting here at the gate again.  I don't know when I am going to learn my lesson about flying this airline!  ARGH!!!

I will be in Charlotte Tuesday for the ISSA conference

I am scheduled to appear at the 5th annual Charlotte ISSA conference at the Charlotte Convention Center this Tuesday.  I will be leading a session on NAC. If you are in the area, please stop by and say hello.

Also, besides RSA and Interop in April, I am speaking at Intrusion World in Baltimore May 14th and moderating an All-Star panel on NAC at the IT Hot Topics conference in Greensboro, NC on the 16th.  If you are attending any of these, it is always nice to meet people who read the blog at these shows.

Drop me a line and we can plan to meet up.

Blogging for the sake of blogging

So I guess all of this back and forth on the NAC market and Lockdown has some people getting a little emotional. First, founder #4 (I wasn't even aware there was a founder #4) of Lockdown, Daevid comments on my last post taking me to task for having the audacity to moderate my comments, even after I require people to put in their name and email address in order to comment. I think Daevid is under the impression that I wouldn't publish comments critical of me and that this is cowardly of me. He thinks that this somehow gives me the courage to speak my mind.

Wow. First of all I guess Daevid has never had a blog before, so is not aware of the blog spam problem that forced many of us bloggers to install moderated comments. As I am sure most of you are aware, but for Daevid's benefit, I don't censor any comments to my blog, in fact I encourage them. I just won't allow spammers to use my blog. It has nothing to do with my courage or cowardice, it is more to do that I think blogs should be two way conversations. It makes blogging fun. It goes to blogging for the sake of blogging, something I am not sure Daevid quite understands. I do understand that this is a difficult time for Daevid. No one likes to see something they helped start not be successful. I am sure he thinks that I was not sensitive enough to the situation there. But anyone who has read my blog for a period of time knows that my views on Lockdown Networks have been pretty consistent for a long time. I am sorry if that ruffles his feathers, but I do blog for the sake of blogging and say what I think. One thing though, if I say something, I always have the courage to say I said it and put my name to it. Whether to your face or on this blog, I am pretty straight forward and don't hide behind anything.

Now, that leads me to a comment I read on another blog involved here. A really brave guy who signs himself in as James Kirk, leaves a comment and urges another vendor/blogger on NAC to "try and be as neutral to the industry as possible" and not be a new blogger "that blogs for the sake of blogging". He goes on to say some other things that my own paranoia makes me pretty sure he is talking about me. The neutral thing though is a bit naive, don't you think. If someone is blogging on a company blog, don't you think they are going to try and put their company in the best light and not be just neutral? Come on Kirk, you should have learned that in your first day at Starfleet Academy. You as the reader should be the arbiter of what is true, partially true or false. But the naievite of that comment pales in comparison to the second quote. Don't blog for the sake of blogging. James Kirk, to quote one of your friends, that is not logical. Why else should you blog, but for the sake of blogging? Bloggers blog because they want to hear themselves and they want the world to hear them as well. Blogging is singularly an ego-driven sport. Your total lack of understanding of this fact makes it clear why you did not have the courage to use your real name. You just don't get it. James Kirk maybe you should stick to fighting Romulans and leave the blogging to us.

My kids get XO's, I go to the command line

They finally came! My friend Raj Bhargava bought my two sons laptops from the OLPC project around the holiday season. Unfortunately due to the high demand, the project ran out of laptops and we have been waiting 3 months for them to arrive. They finally came on Friday. This was part of the buy one, donate one program so two other lucky children in the world have computers now too thanks to Raj's generosity. For those of you not familiar with the project, this was born out of Nicholas Negroponte's MIT lab to bring a $100 dollar laptop to children the world over. While they have not quite hit the $100 dollar cost, they are under $200. The laptop's are called XO laptops.

The laptops use low power, are extremely rugged and kid friendly and run Linux. The interface is called Sugar and is very different than a Windows type of metaphor. It takes some getting used to, but my kids seem to have picked it up pretty quickly. The wireless networking is great. In addition to regular wireless access points, the computers network in a "mesh" network that allow them to share information and chat with each other with the pre-installed software. My kids discovered chat pretty quickly and now sit next to each other chatting away over the computer. Why they just don't talk to each other I guess is part of the magic of computers. It also has a nice Mozilla based browser, a word processor, video camera and a bunch of other software. The boys are having a blast using the machines and take them everywhere. All of their friends who see them want one too, so maybe it will lead to more folks joining the buy one, give one program.

My kids are also really into webkinz. One of the first things they wanted to do was get on the webkinz site with their new machines. The webkinz site uses flash extensively. The XO laptop though only comes with open software, free is not enough. So they use an open source flash plug in, but it does not play all flash files. You can download and install the flash plug in for Linux, but this takes a little behind the scenes Linux command line work. So Dad told them to go to sleep and when they woke up, their machines would play webkinz in the morning.

It has been years since I had to work on a Linux/Unix system in the command line. Actually since I first started TriStar Web hosting with my partners and a few nights a week, I was the designated graveyard shift technical support dude. Even then, I knew only enough to get myself in trouble. Kill a process, grep files, chmod permissions, stuff like that. These laptops, while they run Linux, have a different kind of file and directory structure as to where they keep and store files and the naming system is weird. Files are truncated into numeric named files that bear no resemblance to the file name that shows up in the Sugar GUI. You have to go by the date created and size to recognize the file you are looking for and then you can rename it. The script I was trying to run got messed up in the word processor that comes with the laptop, so I had to go into Vi and fix that. It has been a while since I have used Vi too. Than the script did not have execute permissions set, so I had to do that. Well I have to tell you that this all took a few hours, but when the boys woke up in the morning, they turned on their computers and went to webkinz world and just as Dad promised, everything worked fine. I wish all of their wishes and wants were solved so easily!