The Ashimmy Blog

The game is changing for appliance users too - preaching to the Cobia choir

Eric Ogren has a good article up on his ComputerWorld blog about recent advances by Intel/AMD that make it "increasingly harder to justify large engineering investments in custom-built ASICs or hardware that is not built on a standard platform."  Amen brother!  This is exactly what we have been saying with Cobia from the beginning.  Todays multi-core processors with virtualization technologies offer exponentially greater computing power than have ever been available before from off the shelf products.  To the point that justifying custom silicon hardware in most cases does not make sense.  The good news is that following Moore's Law, this advantage is only going to continue to grow.  Yesterdays dual core lead to todays quad core, who knows what tomorrow.

A couple of points of fact bring home the reality of this for me.  First is the results I have seen with deep packet inspection on these new systems with optimized software.  Though up to this point (as a comment points on Erics article points out) we have only seen sub-Gbps speeds, I have good reason to beleive that this barrier will be passed like the sound barrier in airplanes long ago.  Supersonic deep packet inspection on off the shelf hardware will be a reality in the market within a few months!  The second point of fact is a conversation I had with a security director at a large media company in NY.  He told me that just 2 months he visited a data center his company has over in NJ. The place was cavernous and mostly empty.  He returned just two months later and the center was filled to the brim with Dell servers and they are looking to build another data center.  But they are also mandating to move any and every application possible onto virtual servers.

I am not the first blogger to say that virtualization will revolutionize the data center.  But between virtualization and these powerful new processors, there is a revolution going on.  Check out Cobia and see the performance that these trends are putting in your hands without expensive silicon.  We are just at the dawn of the brave new world, but it promises to continue the computer revolution to empower us to do more for less!

We want you to develop a Cobia module

Developing the Coba platform has been a learning experience for us here at StillSecure. From the very beginning we wanted other software developers and ISV's to develop and/or port their applications to Cobia.  Early on in speaking to these developers it was obvious that Cobia needed an easy way for them to develop to the platform and develop a Cobia-like UI for their applications.  We wanted to develop something that would make it really easy to develop to, giving developers a lot of flexibility.  We also wanted to allow UI development beyond just a simple web GUI. We wanted a widget like development environment which would really put the power in the developers hands. 

Yesterday, we announced the release of the Cobia SDK.  Developed in close collaboration with the development community already working on Cobia, we think this SDK represents a game changing event in the Cobia community evolution.  If you get a chance have a look at the SDK documentation. If you work at an ISV who would like to use the power of Cobia to expand the distribution of your product, this SDK could be just the ticket for you.

I am interested in what others think of the concept of the SDK and what you think of the Cobia SDK.  Drop us a line with your thoughts.

Its that time of year again

Hands down the biggest security show of the year is RSA (most fun though is probably Black Hat, but thats Vegas).  One of the highlights of the RSA show for me is going to the SC Magazine Awards show.  It is a nice night, you get dressed up in a tuxedo, drink free and mingle with the industry.  The guys from HayMarket and SC Magazine always do a great job.  On top of this, unlike many other awards for sale, the SC Awards seem to be on the up and up.  Over the years we have won once (Safe Access, best endpoint solution) and made the finals a bunch of times, but either way it is always a good time.

Well though the awards (and the RSA show) have been pushed back to April (they usually are in February) this year, it is that time of year again.  Voting for the SC Magazine Awards has begun!  It seems like they have expanded the categories of Reader Trust Awards this year.  These are the awards you can vote for.  They have another set of awards that are selected by the judges.  Here are the categories for the Readers Trust Awards:

Reader Trust Awards

Best Anti-malware Solution
Best Email Security Solution
Best Instant Messaging Security Solution
Best Web Filtering Solution
Best Intellectual Property Protection
Best Endpoint Security Solution
Best Mobile Device Security Solution
Best Enterprise Firewall
Best Intrusion Detection/Prevention Solution
Best Wireless Security Solution
Best IPsec/SSL VPN
Best Identity Management Solution
Best Multi- and Second-factor solution
Best Integrated Security Solution
Best Managed Security Service
Best Computer Forensics Solution
Best Event Management Solution
Best Policy Management Solution
Best Audit/Vulnerability Assessment Solution
Best Security Software Development Solution
Best Security Company
Rookie Security Company of the Year
Best SME Security Solution
Best Enterprise Security Solution
Best Regulatory Compliance Solution
Best Professional Certification Program
CSO of the Year
Best Security Team
Best Professional Training Program
Editor's Choice Award

All four StillSecure products are nominated.  Safe Access in the endpoint category, Strata Guard in the IDS/IPS, VAM in the vulnerability management and making its debut, Coba in best integrated security solution.  I would love to see all of my readers vote for the StillSecure products, but since many of you work for other vendors nominated, that probably won't be the case.  In any event, if you get a moment go vote for your own choices, but at least vote!

Salmon swimming upstream

My friend and fellow StillSecure exec, Jayson Ayers recently returned from a salmon fishing trip to Alaska where he hooked some big fish.  It always fascinated me how salmon make their way "uphill" against the current to spawn.  Having to get by the fishermen, the Bears and everything else, it is a wonder of nature that so many of them make it.  I felt the same way reading Peter Stephenson's article today ranting against the trend towards all in one boxes.

Peter is a heck of a nice guy and runs the test labs over at SC Magazine.  He is also pretty smart.  That is why I was surprised to see him take such a contrarian view on this one. I frankly thought this was a battle that had already been fought and to the victors belong the spoils.  Peter thinks that putting multiple security apps on one box at the perimeter into a "SuperUTM" defeats the layered security model.  Peter makes two points that stand out to him:

1. The boxes represent single point of failures.  I don't think this one holds water.  Think about it, having separate boxes for firewall, IPS, etc. just represents multiple single points of failure.  If any of them fail, it could bring your network down.  At least in the UTM model you just have to worry about one box, not several.

2. A single box is not a layered, security in depth defense.  I disagree with this one as well. Just because they are on one box, does not mean that you are not deploying layered security defenses.  Yes if you can bypass the box, you bypass multiple layers, but that is easier said then done.  Also, you might bypass the IPS, but not the firewall.  Or you could bypass the content filter and not the AV. The fact that they are are on one box is not really the issue.

Lastly, Peter says having all of these apps on one box does not mean they are easier to manage.  That may have been true, but even Peter admits that is getting better.  It is certainly cheaper.  The question in my mind is do they all function on one box.  With virtualization and powerful off the shelf hardware, the age of multi-function boxes has arrived for sure!

Now Peter, once you get your head around a multi-function security box, let me introduce you to the next evolutionary step, a unified network platform, Cobia.

Long live the revolution!

Rich Stiennon is someone that I have blogged a lot about.  Of course Rich is perhaps best known for his "IDS is dead" prediction while at Gartner.  Over the last few years, Rich and I have gone back and forth on NAC and his secure network fabric concept. But I think history may record another Stiennon prediction as perhaps his most insightful.  But if they do, let them also record, StillSecure was there first!

Rich writes in SC Magazine today about his vision of the 4th generation of UTM. Now I am not going to say that Rich took his idea from us (I was on a UTM panel with him at RSA), but this article reads like a Cobia PR piece.  Let me give you some quotes here:

We are rapidly approaching the advent of the fourth generation security platform. This is a device that can do all of the security functions that are lumped in to UTM but are also excellent network devices at layers two and three. They act as a switch and a router. They supplant traditional network devices while providing security at all levels. Their inherent architectural flexibility makes them easy to fit into existing environments and even make some things possible that were never possible before. For instance a large enterprise with several business units could deploy these advanced networking/security devices at the core and assign virtual security domains to each business unit while performing content filtering and firewalling between each virtual domain, thus segmenting the business units and maximizing the investment in core security devices.

One geologic shift that will occur thanks to the advent of these fourth generation security platforms is that networking vendors will be playing catch up, trying to patch more and more security functions into their under-powered devices or complicating their go to market message with a plethora of boxes while the security platform vendors will quickly and easily add networking functionality to their devices.

Fourth generation network security platforms will evolve beyond stand alone security appliances to encompass routing and switching as well. This new generation of devices will impact the networking industry it scrambles to acquire the expertise in security and shift their business model from commodity switching and routing to value add networking and protection capabilities.

I swear. if Rich would have mentioned open source and Moore's Law providing the horsepower to make this happen, I would have sent him a check from the Cobia marketing budget!

But lets not be naive.  If Rich is writing this, you can bet his employer, Fortinet will be coming out with a network/security convergence box shortly.  We already have almost 2 years into Cobia development and welcome the company.  It will be interesting to see if Fortinet tries to do everything themselves or opens up the platform for 3rd parties.  In any event, another prescient prediction from Stiennon. Maybe this will go down as the beginning of the secure networking revolution.

Multi-core benefits the security industry and more

Carl Weinschenk posted an article today on ITBusiness Edge in the Network Sentry blog about how the security industry is benefiting from the multi-core architectures now available.  Carl highlights what Check Point is doing with VPN-1 and what American Portwell Technology is doing with security appliances based on dual core technology. Finally, Mindspeed Technologies recent announcement too.  The bottom line here is that with multiple cores available many processor intensive applications are able to run on off the shelf components at a fraction of what customized silicon cost.

This has application beyond security.  I know our own lab stuff has shown how Cobia can take off with multi-core technology.  When you start thinking of virtualization, multi-function and the like, multi-core processors really take it to the next level.  Our security R&D team has some amazing stuff they are playing with that takes advantage of this and I hope to be able to share that with you soon.

The question in my mind is, what does this mean for the custom silicon crowd? With this kind of horsepower available and the onward and upward march of Moore's Law, why invest in custom silicon except for the absolutely most demanding and rewarding applications.  Any appliance vendors who are not looking at running off the shelf hardware, have to be taking a long hard look and wondering why not.  Any customers who are still paying premiums for custom burned silicon that is not even upgradeable have to look at this as well.

Do multi-function devices confuse people?

Its been about a month or so since we publicly announced Cobia over at StillSecure. An interesting but puzzling fact that we have observed is that just because a device can perform more than one function, people think that somehow limits you from using it as a single function device.  Case in point is Cobia's firewall and router functions.  We have received more then one question asking if you can just use the firewall function in Cobia, without the router and other modules.  Similarly, we have been asked by people who want to just use Cobia as a router (sometimes just temporarily) but not any of the security functions.

This got me to thinking about UTM's and other multi-function devices.  Do people think just because they have a UTM, they must use more then one function.  I happened to come across a blog ad for Fortinet (they offer ads for the Security Bloggers Network), the only thing they mention in the ad is a fourth generation firewall.  Could it be that most people are just using UTM's for firewall. I know Chris Hoff reads my blog.  I wonder if Chris has any numbers on how many Crossbeam customers are just loading firewalls on their X-series boxes.  Does having all of these choices confuse people from using just one of them? I think this is a common problem in technology.  We tend to load so much functionality into our machines that they can be overwhelming and bloated.  Do you really want your toaster to be hooked into the net?

Of course if you're interested, the answer is even at this early stage, Cobia is a great choice for a free firewall or router or both.  The GUI allows for easy management and configuration.  If you need to drop a router in while performing some network redesign or just want to put an easy to use firewall in, even at home, give it a try. I promise you don't have to run everything else Cobia can do, unless you really, really want to ;-)

StillSecure, After all these years, Podcast #36 - Cobia

Episode 36 of the podcast has me interviewing Mitchell about Cobia.  For those who have not heard, Cobia is our Unified Network Platform (UNP), that we released this week in beta. Mitchell, who is the general manager for Cobia, tells us all about it.

If you like the content of these shows or have any other comments or questions, please drop us a line at podcast@stillsecure.com

Thanks to ClickCaster for hosting our podcast. Tonights music is the usual, To the Summit by Jon Schmidt. You can hear more from Jon at  http://www.jonschmidt.com.  Music transitions between segments are by our own Mitchell Ashley!

http://clickcaster.com/resource/audio/stillsecure--after-all-these-years--podcast--36---cobia.mp3

2 ComputerWorld articles, one on NAC and one that wants to be

I spoke with Jaikumar Vijayan of ComputerWorld today about the Cisco NAC "hack" by the researchers from ERNW GmbH.  By now, I assume most of you have heard about the tool they have built that exploits two holes in the Cisco NAC technology.  As a competitor I did not want to pile on Cisco about this unfortunate revelation.  In fact though one of the two holes is very specific to Cisco's NAC implementation and I don't think will effect other NAC products, the other could be a problem for other NAC products as well.  Anyway, I always enjoy speaking with Jai and hope to have him on as a guest on our podcast soon.

The other article by Eric Ogren talks about open source NAC and logging.  He mentions Sourcefire's new Daemonlogger logging tool and then Cobia.  I am not sure if Eric is confusing different briefings we did with him, but he seems to think Cobia is somehow a NAC play.  Shame on Mitchell ;-),  for not making sure Eric was better informed about what Cobia is.  I guess we are going to have to go back and re-brief him.  In any event, though some NAC functionality will be able to run on Cobia eventually, it is not a NAC play at all.

Duck! The sh*% is flying today

Well it seems my friend Thomas certainly stirred things up.  The whole open source, is it or isn't it thing has attracted a lot of action.  Probably not much from the people who matter most to me though, that is the people who are going to use Cobia.  But still you live and learn, and that I am doing.  I won't be able to respond any more until later tonight but, if you stop by here you may want to bring your own umbrella to make sure you are not hit with any of the stuff flying.