The Ashimmy Blog

I'm the security guy. I used to have a security guy, but he died. Now I'm the security guy

While attending the SANS event in Orlando this week I had a chance to meet a fellow who works at a company that is a StillSecure customer.  I had never met this particular guy before, so I asked him how long he had been working in security at the company.  The answer I got reminded me of an old quote from the move "The Producers" -

-Who d'ya want? -I beg your pardon? -Who d'ya want? Nobody gets in the building unless I know who they want. I'm the concierge. My husband used to be the concierge, but he's dead. Now I'm the concierge.

This guy had worked at the company for a number of years in the network department. They had a "guy who did the security".  He is the one that bought the StillSecure product.  Evidently a while back the security guy left the company.  It is not clear whether he quit or was asked to leave, but the bottom line is they had no security guy. Instead of hiring another security guy, they made this poor SOB the security guy.  He inherited a bunch of security products including our own and a bunch of "open source stuff".  This guy didn't even know where to begin.

After floundering around for a while, he made a smart move and signed up for some security training from SANS and is just beginning to realize how much he doesn't know.  But it will still be some time before he is in a position to handle the security at his company, that by the way has SOX issues to deal with.  I suggested that perhaps he look into some MSSP service to help him out.  I am going to try and help this fellow out as much as I can, but he has a tall order.

How many others are out there in the same boat?  How many people have had the security role thrust on them, without the training or expertise to make it happen.  The greatest tools in the world, won't make up for this lack of skills and experience.  Is it any wonder that we have a breach a day announced and our security seems to be in such disarray? We should let security be handled by security professionals or else we deserve what we get!

I guess wireless IPS didn't cut it

For a long time I have heard rumors that the companies in the wireless IDS/IPS space were having a tough time getting a lot of traction.  There were battles around who had what patent and so forth, lots of partnerships and OEMs, but at the end of the day I don't think it led to a lot of revenue.  Confirmation for me on this came last night at the SANS 2008 conference In Orlando.  The booth next to ours is AirTight Networks. 

Two StillSecure employees went to AirTight some time back and have since moved on from there.  However, I was very familiar with their positioning and products. So I was very surprised to see the tag line next to the AirTight logo saying, "The global leader in wireless vulnerability management".  OK, so they have moved from wireless IPS to wireless VM?  What could be next, wireless DLP?  A look at their web site shows that they have lost the wireless IPS entirely and are all about compliance these days.  I think becoming a compliance only solution is a mistake, but it really comes down to me thinking it is a technology in search of a solution.

Bigger picture, the question is, do we really need a wireless only security solution at all or should security cross over wireless and wired?  Also shouldn't wireless security be built into the wireless gear itself?  For that matter shouldn't security be built into all networking gear?  All good questions with obvious answers.  In the meantime I think we see another group of companies caught by Shimmy's theory of security industry relativity.

Reply from Mike Baglietto, Director of Product Marketing, AirTight Networks - Mike was not able to post a comment to my post and asked that I post his response.  Here it is:

Interesting observations and points well taken in that AirTight may not have expressed our position as well as we should have. About the only quarrel we have with your statements is that we did this because WIPS was not working (for us or anyone else). AirTight actually views wireless IPS (WIPS) as an important technology but also as part of a larger wireless vulnerability management market. While our new website may have swung the pendulum too far towards our new positioning, WIPS is still the core part of our business. AirTight has not given up on our WIPS heritage, WIPS products or WIPS customers who come from diverse vertical markets including financial services, federal, and retail. But even in the even the most security sensitive markets, many organizations don’t always have the budget to procure, maintain and support an overlay wireless security system. AirTight’s objective with our recent SaaS announcement was to deliver a wireless security solution for them as well as the underserved market of smaller enterprises who have no wireless expertise, constrained resources, and limited budget to address wireless vulnerabilities/threats. In fact, many organizations that we speak with have little or no visibility into their wireless security posture, so implementing a full wireless IPS system before they understand their wireless posture may be a bit overkill to begin with. What AirTight is trying to do is offer both WIPS and a modular SaaS approach so customers have a choice in how much wireless security they purchase and how they choose to manage it. Yes, wireless security should be built into the infrastructure, but in reality its not. It still falls well short of the purpose built capabilities that the wireless IPS companies can provide.

My only follow on, is I don't understand equating a SaaS wireless service with a wireless vulnerability management message.  They are not synonymous in my mind anyway.

Microsoft buys Xobni?

Back in February I wrote about how much I liked Xobni for Outlook. Now Fred Wilson reports thats Microsoft has bought Xobni. Fred is linking to this Techcrunch article on it. Though it is still sketchy at this point, I think it would be a great pick up for Microsoft. After using it for a few months, I find it very useful. I think picking it up now, while still in beta is a cheap deal for Microsoft and will save them a ton of money having to buy it later!

Congrats to the team at Xobni for building a product that had obvious appeal.

At SANS Orlando Monday and Tuesday, Interop next week

I will be up in Orlando Monday and Tuesday for SANS 2008 in Disney World.  Next week I am in Vegas for the big Interop show. If you are attending either one of these and would like to chat, please drop me a line and let me know.  You can stop by the StillSecure booth as well with a good shot of finding me somewhere near there.

Rich or poor, its nice to save some money

In response to my article yesterday about network convergence, Don Marti over at LinuxWorld responds that he is all for convergence.  But he argues, why not converge on a 2 to 4k box, rather than a 10k Cisco box.  Amen to that Don! On the Network Cisco Subnet blog, after rehashing Don's and my positions, the point made is that:

The point of convergence is to save money, as well as to ease administration. At the point where it costs more money or requires more admin than the "old way" of doing things, network pros will have a hard time swallowing it.

I guess they are referring to converging more functionality on one box, you could make administration more complex thereby negating the potential cost savings. I agree.  That is one of the biggest things we have been working on the Cobia platform. How to make managing these diverse applications easier and more efficient.

Back to Don Marti's comments on cheaper boxes though.  There are actually a few rising tides that are floating the convergence boat.  The vastly increased power of off the shelf hardware at those prices is the true enabling technology. Having a cheap box does no good if it doesn't have the horsepower to get the job done.  At the end of the day, that is what kills the 10k Cisco box.  There is no need to pay 10k for the power that the box has when more powerful boxes are cheaper.  The caveat though is, how long do you think it is going to take Cisco to realize that too?

We have contemplated all of these factors in our strategy around Cobia.  We think virtualization is another key driver in this convergence revolution.  Also, by distributing source code with the product, allowing for 3rd party innovation and collaboration, we can leverage a wider community to speed development.

Linux as the common OS underlying much of the convergence trend is a key driver, but there are other forces at play that ensure that we will continue to see consolidation and convergence in the months and years ahead.

Its about convergence, stupid

Dmarti's blog over on LinuxWorld has an article up titled "Dumbest networking vendor idea since Network Access Control", which talks about what a dumb idea it is for Cisco to allow Linux apps to run on their ISR routers. Besides the fact that the title of the article alone is enough to make me want to tear this one apart, the underlying logic of the authors argument is just weak.

On one hand he talks about why would someone want to run Linux apps on a router, it is potentially bad design. On the other hand he says it is better to run them on a cheaper router alternative like Vyatta and than spouts some PR by Vyatta about their price/performance advantage over Cisco.  They back up this advantage with "3rd party testing".  Turns out the testing is by Tolly Group.  Oh, now that changes everything.  Have any of you ever had a Tolly evaluation done? Anytime you submit a form that contains what you would like to see the testing show in the final report and the final report shows it, well you know what I am saying. But seriously if it is good for Vyatta, why would it not be also good for Cisco?

Here is the real issue though that the author misses.  We live in an age of convergence!  The idea of having a stand alone box that only does routing is history and when Cisco themselves acknowledge it, you know it is fact.  People want more functionality out of their hardware.  Now that is not to say that your router should be your database server or mail server.  But there are certainly network functions that make sense to put on a router. Security is a no brainer to start. IPS, VPN, firewall, gateway AV- easy.  What about network functionality like DHCP, DNS, Radius, etc.  How about some next gen network stuff like WAP and VOIP?  That would make sense. By embracing Linux on the router all of these things and more are possible.  By the way you can do all of this now with our own Cobia platform.

That's right, we had this idea 2 years ago and have been working on it since.  With the convergence of networking, security, VOIP and wireless technologies, why wouldn't you want a multi-use box that can deliver all of this.

A better DOS than DOS and a better Windows than Windows

Anybody remember that slick marketing line?  You are a winner if you picked OS/2. OK I will admit it, I was an OS/2 user. I liked it much better than Windows 3.1 and used it even after Windows 95 came out. I still think it was a superior product to anything that the guys from Redmond put out.  Why don't we all run OS/2 today instead of Windows?  Good question, I ask myself that all the time.  Some say it is because Microsoft used strong arm tactics to persuade ISV's from developing apps for OS/2.  That may be true, but for me the real problem was IBM's strategy was instead of fighting the fight to get OS/2 apps developed, they said go ahead and run Windows and DOS apps on OS/2, we can run them better.  They could, but at the end of the day they were still Windows and DOS apps and this gave Microsoft an inherent advantage that could not be overcome.

I was reminded of this today while reading an article in eWeek by Joe Wilcox on how Microsoft is in so much trouble and how nobody is using Vista (better not tell the 100 million or so users of Vista that). Joe points out the recent Gartner report that says Microsoft is headed for a train wreck around 2011 or so because Windows is vulnerable (to competition that is, not necessarily to vulnerabilities.  Well actually it is vulnerable to those too, but that is for another blog).  Not to be outdone by the G-men, straight off the shrimp boat the Forest-er Gump crew come out with a pair of reports (here and here), that detail Vista's adoption issues.  The net of one is that while tech folks see the benefit of upgrading to Vista, it is a tough sell to the CIOs and CFOs of the world.  Many according to the article are saying they will wait for Windows 7, whenever that comes out.  I don't buy this myself. I remember similar talk when XP came out. 

Where I really disagree with Wilcox though is his comments regarding Mac OSX replacing Windows in the enterprise:

I disagree that Mac OS X is no alternative, particularly when businesses must swap out hardware anyway and Exchange-supporting Office 2008 is available. Mac OS X nicely plugs into Active Directory. I don't expect massive conversions to Mac OS X, but I strongly disagree with contention that it's "simply not a viable option."

What will enable this Mac revolution? Virtualization according to Wilcox and those who believe as he does. This is where they step in the footsteps of OS/2 before them.  If OSX is a better OS, fine. But don't fool yourself. If you are going to rely on Microsoft Exchange, Microsoft AD and other Microsoft server products plus Microsoft applications and you are going to run your Mac hardware running Windows in a virtual hypervisor on top of it, you are just a "better Windows than Windows" but you still run Windows.  Microsoft will use its stranglehold on the applications to make sure that they run better, faster, cheaper on the real Windows.

Gartner, Forester and Joe Wilcox miss the point here.  Windows will not be in serious danger of losing its preeminent position on the desktop until there are enough applications that run natively on another OS and don't run on Windows.  I don't see many application developers willing to walk away from the Windows market for that to be a reality.  That makes desktop Linux, Mac OS and the rest just more OS/2s.

Anyone want to know about learning to fly?

Just a quick shout out to another new blogger. Jake Reynolds, StillSecure IT guru has joined the blogging world. Jake's new blog, Expect Left Traffic is up and running. Jake says he is going to write mostly about his love of flying and his experiences learning to be a pilot. Jake also like motorcycles, so I am sure we will see some stories on that. I would not be surprised though to see some IT related and security stuff sneak in there.

Welcome to blogging Jake and good luck!

Mothers, let your sons (and daughters) grow up to be hedge fund managers

When I was a kid it was fashionable to think that your mother wanted you to grow up and be a doctor, a lawyer or some other such professional. A policeman or fireman was dangerous, a sanitation worker did not have much prestige. By the time I was in college, the smarter kids were going to work on Wall Street, instead of going to medical or law school. Later during the dot com bubble, many of the best and brightest were siphoned off from Wall Street to go into technology. It is obvious that bright young adults are going to follow the money. Well if that is the case, there is no alternative but to grow up and become a hedge fund manager according to this article in the NY Times today.

Several of the most successful managers made over 3 billion dollars each last year alone! That is not that their companies cleared 3 billion, they themselves made 3 billion. In fact to make it to the list of the top 25 hedge fund managers in terms of compensation you had to earn at least 360 million dollars last year alone. Think about that in terms of the median American family income was $60,500.00 dollars last year. So ask yourself, what are you doing securing networks or whatever you do. Stop wasting your time and go get into the hedge fund business.

Seriously, think about it. Hedge funds don't manufacture or make anything, they don't sell a product per se. They manipulate money and make bets on what will go up or down. Sort of the ultimate riverboat gamblers. They aren't teaching our kids to be better people, they aren't making the world safe or making the environment better. But the rewards for what they are doing are almost beyond belief. What message does this send as a society? When I see companies that won't spend a couple of dollars to make sure that your confidential information remains confidential and than see these kind of numbers, what does this society value?

But who am I to rain on the parade of these Titans of Wall Street. I am going to go home and start working on my sons to think about thier future. Like they told Dustin Hoffman in "The Graduate", just one word - Plastic HedgeFund!

Old blog, new blogger

I wanted to take a quick moment to welcome Samuel Colt Van Ryder to the blogosphere. I know Sam for a number of years now. He was a sales person here at StillSecure for a long time working both with channel partners and direct sales. During that time I got to know Sam pretty well.  He is an interesting fellow.  A genuine Texan, Sam is a descendant of the Colt 45 Colts.  He moved to Switzerland, where he met his wife.  They then moved back to Texas where he has raised his family and worked in the security industry.  Always a stand up professional, I have stayed in touch with Sam after he left our company and went to work at Alert Logic. 

It seems that Sam has grown tired of trying to get Misha to blog regularly on the Alert Logic blog, so he has taken it over himself.  He posted his first article today. Good for Sam and we will be reading to see what he adds to our community discussions.  Welcome aboard Sam!

Speaking of community, the Alert Logic blog was already a member of the Security Bloggers Network.  However, the network is over 135 blogs strong with a combined distribution of 50,000 feedburner subscribers!  You can subscribe to the combined feed of all of these blogs by clicking here.