The Ashimmy Blog

Are you going to the Gartner IT Security Summit?

Monday is the start of the annual Gartner Security Summit in Washington, DC. Actually at the Gaylord National Hotel this year.  Besides the obvious presentations by the Gartner analyst staff, it is usually a good chance to catch up with the security industry.  I will be there from Monday morning through Wed afternoon.  StillSecure is not presenting or exhibiting at the show this year, so I will be in lots of meetings and listening in on some tracks myself.

If you are going to be at the show and want to get together for a coffee or other beverage, drop me a line at podcast@stillsecure.com with a suggested time and place at the show.  Hope to see some new and old faces at there and will be blogging from the show as well.

Not 'who you gonna run to" but "who you gonna call"?

You could try ghostbusters, but don't bother calling the PCI council. So says Mike Fratto and Martin McKeay in response to my earlier article about when you have an obligation to go public. Of course I was responding to Martin's earlier post on the TJX employee getting fired. What all three of us agreed on though is that there is no place or person that an employee or any other person frankly can call to report a company that is not in compliance with the PCI.

Mike Fratto says "PCI has no teeth because VISA/Mastercard doesn't want to bite the hands that feed it." Martin says the PCI council has established a way for people to report violations because "that’d make the Council responsible for acting on those reports. And that’s something they really, really don’t want." So are the PCI regs toothless. I wouldn't exactly go that far. I think we have to draw a distinction about having the power to act versus actually exercising that power. Mike is right, so far the PCI council has to exercised the powers they were granted to impose sanctions and penalties. That doesn't mean they won't in the future though. I think they will have to make some "examples" otherwise people are going to begin to ignore the requirements all together.

Without some process to report violations the credit card companies are inviting the government to step in. This is exactly the reason as Mike Fratto points out that they imposed the PCI regs to begin with, that is to keep the government out. Until they do though, I think going public and the court of public opinion may be the only recourse.

Those wild and crazy guys are back! - SSAATY #54

Mitchell and I are back!  It has been a few months, but the stars finally lined up to allow us to record a show.  It was great being back behind the microphone again.  Mitchell and I discussed a number of topics:

1. Recent penetration of the FBI
2. TJX fires an employee for disclosing lax security
3. Barracuda makes an offer for Sourcefire
4. G.hos.st

Along with the usual back and forth. Hopefully it will spur us on to do more of podcasts!.

If you like the content of these shows or have any other comments or questions, please drop us a line at podcast@stillsecure.com

Thanks to ClickCaster for hosting our podcast. Tonights music is the usual, To the Summit by Jon Schmidt. You can hear more from Jon at http://www.jonschmidt.com. Music transitions between segments are by our own Mitchell Ashley!

What's the deal with the Barracuda offer for Sourcefire?

By now you probably saw that Dean Drako and Barracuda have made an offer of $7.50 a share (in cash) for Sourefire. This values Sourcefire at about 200 million dollars and is a 13% premium over the Friday closing price. Of course this is well below Sourcefire's historical highs, but than again who is worth what they were a few months ago.  I have a chart on the left that shows stock prices.

So what is behind this deal? I think it is all about ClamAV and the Trend Micro suit.  As readers of my blog know, Trend Micro sued Barracuda a few months ago for patent violations around the way Barracuda uses ClamAV in its appliances.  I think Dean was looking to Sourcefire as the owners of ClamAV to step up and help in the defense of the suit.  I believe to date, that has not happened and Dean is upset with it.  In fact Dean actually mentions that suit and Sourcefire's lack of response on it as one of the two reasons why Barracuda's acquisition would make sense. For the other reason Dean takes a swipe at the Sourcefire management team, saying "We believe that the recent FIRE stock price reflects the execution challenges faced by the company’s management to date." 

I am not sure where Dean comes up with the 200 million to complete this deal, but assume he has lined up financing.  However, at this price I don't think this is more than a stunt.  If Barracuda goes beyond $7.50 a share to $10.00 a share or so, it gets real interesting.  Maybe this puts Sourcefire in play and someone else comes forward with another offer, who knows.  But right now I think Dean is just looking to stir the pot.

Update: As I expected, this morning Sourcefire rejected the Barracuda offer according to this article in BusinessWeek. The Sourcefire board said the 187.4 million dollar offer "is not in the best interests of Sourcefire and its stockholders".  Lets see what Barracuda does next.

When do you have an obligation to go public?

No, not IPO public, but public about disclosing employer secrets which could provide a risk to the public. My friend Martin McKeay has written an article over the recent firing of an employee of TJX for disclosing in a public forum continued poor security practices by TJX. The same TJX I might add that as a result of slipshod security practices caused 100s of thousands of dollars, if not millions of dollars in bank fraud to occur.

Many have categorized CrYpTiC_MauleR, the employee who disclosed the information on hackers.org, as a "whistleblower". The term whistleblower is a term of art and in many circles will invoke some special immunity for the person who disclosed the confidential information. However, usually the disclosure of this information is made to a person or entity with the power or at least willingness to take corrective action. In this case, I think that is the missing pre-requisite. Just disclosing this information on a public message board does not meet the burden of defining this as whistleblowing. I think Martin is right on there. He says CrYpTiC (If I can call him that), was not a whistleblower in the strictest sense of the word and is not due any protection. He is just another person who violated his employment terms and his termination by TJX was perfectly justified. Let me say that I don't disagree with Martin about TJX having the right to fire CrYpTiC. They certainly do.

I have a problem with Martin when says that CrYpTiC should have done what he has done and that is keep your mouth shut and move on to the next opportunity. I think depending on the level of wrongdoing, not only is that wrong, but by willfully withholding certain information from the authorities it could make you guilty as an accomplice! Think about it Martin, if you knew your employer was committing a crime and you just quit your job rather than report that crime, you are an accomplice. When does the responsibility for the general good, outweigh your obligation to your employer. Is sticking your head in the sand and moving on while letting illegal or irresponsible behavior go on the right posture? I say not.

I think CrYpTiC felt strong enough about what TJX was doing was wrong that he posted it publicly. Though he did it anonymously and did not think it would be traced back to him, he felt strong enough that what TJX was doing was wrong and he wanted the world to know. When he made that decision, he also made the decision that letting the world know the truth was more important than his job at TJX. I am sure potential future victims of TJX fraud that will now be spared that loss would thank him for it.

Martin, there comes a time where keeping your mouth shut and moving along does not cut it. You have a duty to alert the proper authorities for the greater good of the public. The question is when does your duty to disclose surpass your duty to keep your employers information private? I think that is a personal question that all of us have to answer ourselves. Clearly criminal activity should be disclosed, otherwise you risk criminal exposure. Beyond that it is a judgment call. But saying not to disclose and just move on is appeasement at its worst.

The real question is why doesn't the PCI council or the government have a forum for people like CrYpTiC to go to in the future. That is what is needed!

Do you have an example for FUD Watch?

My friend Bill Brenner has landed as Senior Editor at CSOonline.com. His latest article is introducing something called FUD Watch. Bill has had enough of his mailbox being full of every chicken little saying the sky is falling with the latest security threat. He gives on of many examples but is asking for others. An obvious one is the recent Symantec call for everyone to stop using Flash. Than today, it retracted saying that in fact the latest version of Flash was not vulnerable.

Do you have a good example of FUD? If so you can share it with Bill at bbrenner@cxo.com. In the meantime, we will be watching for some continued good stuff from Bill.

Can the Internet help bring peace to the Middle East?

For a long time I have believed that the Internet could be the single biggest tool for world peace ever. By bringing people together and allowing them to share common experiences and interact in a person to person environment, the Internet is a great equalizer. This view was reinforced for me today when I read the story of G.hos.st in the NY Times. G.hos.st is a free web based virtual computer that gives you storage, email and applications available anywhere. I have just signed up for an account, so will have to tell you about how it works later.

The thing about G.hos.st for me is that it is a joint Israeli-Palestinian venture with workers from both people working together. What a surprising and great idea. What better way to bring these people together than to make them both shareholders in a joint venture and let them work together. The article talks about some of the experiences of the workers who meet sometimes in person in Israel, sometimes in a no mans land near Jericho and sometimes have to have video conferencing. But the important thing is they are working together. Can you imagine if there was more of this joint commerce taking place? It can't help but make people more trusting, knock down the barriers of ignorance and prejudice and make the world a better and safer place for all of us.

I signed up for the service just to show my support for this type of change the world initiative. If you agree with me that this is just the kind of medicine this world needs, why don't you take a moment and sign up for an account as well!

Does VMware want to own the virtual ecosystem?

VMware has obviously staked out the clear dominant position in the virtual machine market. However, owning the hypervisor alone may not be enough. VMware announced the acquisition of B-hive Networks, a California and Israeli based company that developed application performance management for virtual applications. According to this article in ComputerWorld, the news is comes as bad news for several start ups that were were trying to establish themselves. With VMware themselves including virtual application performance management, a 3rd party competitor is going to be at an extreme disadvantage to the built in VMware solution. It clearly signals a move by VMware that they want not only to provide the environment for virtual machines, but also the necessary software to make them useful and productive.

This is in contrast to VMware's VMsafe program where they have made available APIs to allow security companies have access to secure the virtual environments. That would seem to indicate that VMware is willing and looking for 3rd party security companies to secure the virtual environment. Is this only a temporary condition and will VMware eventually seek to security the virtual environment themselves? Clearly it appears that Citrix will look to 3rd parties to secure their virtual environments.

At the end of the day does VMware take a page out of the Microsoft playbook and use their dominance in the virtual environment space to eventually also control and monetize the entire virtual environment? If so does that present opportunity to Citrix and Microsoft to form a consortium to take VMware on? I guess we will have to wait and see how this shakes out.

TippingPoint chief architect says embedding security in switches and routers is a fools errand

If there was any doubt in your mind about how much the TippingPoint team wants to be part of 3Com, you should listen to this video of Brian Smith, chief architect of Tipping Point talking to SearchSecurity.com.  Brian comes right out and says that the original idea behind the 3Com acquisition was synergies of putting security into switches and routers.  After about a year of trying to do this, he says that he realized it was a "fools errand" because security is evolving so much quicker than networking.  I don't know, but that is probably not the opinion of Cisco, HP ProCurve, Foundry, Extreme, Enterasys and Juniper who all seem to be doing exactly that. Perhaps it had more to with a clash of personalities there than technology?

Later in the interview Brian states that after the expected synergies never materialized it was decided to spin TippingPoint off on its own IPO. Luckily they had retained their own identity which Brian says may not have been possible if they were acquired by Cisco or IBM. He basically says that the merger was a failure and they wanted to go their own separate ways.  Than the Bain deal put everything on hold and now post-Bain deal they are becoming more and more autonomous.  Though he doesn't come out and say it, his body language is screaming that he cannot wait to be spun out from 3Com.

My advice is to be careful what you wish for.  The security industry is not what it was before the acquisition and without someone's deep pockets behind you and the inability to move out successfully beyond anything besides IPS, TippingPoint may not find it as welcoming as they think.

The best way to get customer service? Blog or Twit them

I was reading an article in the Orlando Sentinel newspaper this morning (I know who reads newspapers anymore), about how so many companies are tracking unhappy customers by monitoring blogs and even twitter messages. It reminded me of a story that Chris Hoff had a while back about Southwest Airlines monitoring his Twitter message

The story in the Sentinel had two opposite corporate views on this. One was Comcast who quickly turned a negative blog post and experience into a positive one by reaching out to the customer and fixing their problem. The customer than ran an updated blog post to commend Comcast. Much the same way Hoff did in his post on Southwest. The polar opposite of this was Spirit Airlines, whose spokesperson according to the article said, "she wasn't concerned and that Spirit doesn't let blog posts affect its policies and procedures." Well a year later that article is still the number 3 search result on Google if you pull up Spirit Airlines. It has over a 1000 comments with many people saying they didn't fly Spirit as a result. I wonder if Spirit Airlines still feels the same way about not listening to blogs?

The article mentions a few other companies that monitor blogs and twitter and message boards. It also mentions a web site called getsatisfaction.com where over 3000 companies monitor to help consumers iron out customer service issues.

They always said the pen was mightier than the sword. In todays world maybe the keyboard is too.