StillSecure, After All These Years

StillSecure, After all these years, #53 - SSAATY meets the Network Security Podcast

Someone put chocolate on our peanut butter!  Mitchell and I got on a party line to record episode 53 and who else was on? None other than that dynamic duo from the Network Security Podcast, Martin McKeay and Rich Mogull! The 4 of us had a great time talking about one of Martin's favorite topics:  Privacy. Should what you put on line be held against you by your employer. Do you have any expectation to privacy for all of this information you are posting on Twitter, Facebook, etc.  These topics and more come under the glare of the 4 of us.

We also talk about HP's boast of employing 9 of the top 11 security hackers (shades of the infamous top 59 list).  There is a special message for all security bloggers and podcasters, as well as security media types who are attending RSA, if you don't know what we are talking about contact us.

If you like the content of these shows or have any other comments or questions, please drop us a line at podcast@stillsecure.com

Thanks to ClickCaster for hosting our podcast. Tonights music is the usual, To the Summit by Jon Schmidt. You can hear more from Jon at http://www.jonschmidt.com. Music transitions between segments are by our own Mitchell Ashley!

Or download here:

mp3 

All aTwitter

OK, I must be getting old. I signed up for Twitter probably almost a year ago when I was at the cool festival in Austin.  Since that time I have probably updated my status maybe 4 times.  I keep getting these emails saying that this one and that one is now following me on Twitter.  I couldn't understand why anyone would want to follow me?  Last night I went to dinner with Mitchell and Scott Converse (who just launched a new company called Medioh, more on that later), after which we went back to Scott's studio and recorded a really fun podcast.  They both started talking about Twitter and how I am not active and am just missing the boat on this.

So bowing to peer pressure, this morning I have downloaded the twhirl desktop client and ceTwit for my Windows mobile phone and am all aTwitter.  I see some people I am following and will try to follow all the people who follow me.  Lets see what all the Twitter is about.  Will report back to you if I just don't get it or is it really that cool.  Until than feel free to Twitter me at ashimmy.

It is always fun recording a podcast in person rather than virtually. Mitchell is getting me the file to edit, but being live brings a whole new level to Mitchell and I interacting.  Plus Scott was our guest, so the three of us had a blast.  Afterwards I realized the diet Pepsi I was drinking was Pepsi MAX, so maybe the extra caffiene had something to do with it!

Does this make Mitchell Ashley the next "Chachi"?

OK, here is a little known fact about me.  When I was a little kid one of my favorite shows that I never, ever missed was Happy Days.  Yeah, thats right I loved Richie, Potsie, Ralph Mouth, Howard and Marion and the rest of the gang.  One of the things that was amazing about that show was like All in the Family, it gave birth to so many spin off shows.  Joanie loves Chachi is an obvious one.  Laverne and Shirley was another, and here is one you probably don't know, Mork and Mindy was actually a Happy Days spin off. 

Well today I am proud to link to the first "spin off" of the StillSecure, After all these years podcast.  Mitchell Ashley, my long time co-host has started up his own podcast on his Network World Microsoft SubNet blog.  Mitchell is taking the lessons learned on our podcast and is venturing forth on his own.  Here is the link to the podcast.  Good luck to Mitchell on the new show.  Of course I was smart enough to sign Mitchell to a long term contract to be my co-host (but not exclusive I guess), so he will still be doing our show together regularly.

We should be posting a new episode next week by the way.  Again, Good Luck Mitchell on the show! Now my only question is: if this makes Mitchell Chachi, does that mean I am the "Fonz"? Nah, no way. I was never that cool ;-)

The herd approach to security disturbs some folks

It seems my article the other day commenting on Matt Hines article on Andy Jaquith's report on security companies relying on "the safety in numbers" approach to security to protect the herd as a whole has invoked some feelings strong enough for people to comment. Currently there are three comments which I want to highlight.  The first is from Mike Fratto.  The Syracuse whiz I think agrees with me that this type of approach is pragmatic and ultimately delivers more results and protection than all of the so-called zero day protection that we have heard so much about.  Mike calls it dead on when he says bad guys make malware, good guys then have to find it and protect against it.  That is the way it is and the way it will always be.

Next is the middle approach from Shawn.  Shawn agrees that this is a logical first step, but sees the risk to the individual as a member of the herd. Can we truly trust the herd to protect us?  Do the ones keeping the herd have our best interests at heart? Is giving up some of our privacy and individuality worth the protection we potentially get?  All good questions by Shawn.  Whether we are talking about security or any other threat to a group, I think these are the questions that the herd mentality raises.  I think nature has already answered these questions and by by its frequent use of the herd behavior the answer is that it is worth the sacrifice and the risk for the greater common good.

Last and I think most disturbing to me is Mitchell's reaction.  I don't know, maybe since Mitchell left StillSecure he has been drinking heuristic Kool Aid.  Mitchell, I think says that the bad guys will always be faster in this "flawed model of security".  However, what I think Mitchell misses is that the bad guys are always faster anyway.  The security industry is always re-active to the bad guy almost by definition.  So why do Mitchell and those who agree with his view feel this way?

I think that in their quest to "win the war" on security they think they will move from reactive to proactive.  That they will outsmart the bad guys and be able to anticipate the next bad guy move.  They want to think they can win.  I think it is in what you define as winning.  I don't think we ever are faster than the bad guys or act before they do. I think a much more pragmatic approach is to do what we can to harden our systems against attack and mitigate the risk of attack, but assume a new type of attack can succeed because we just cannot anticipate everything the bad guys do.  Therefore in an analysis of the greater good, a pragmatic approach that leverages a "neighborhood watch" as Mitchell calls it offers real world, real protection, rather than pie in the sky, wishful thinking about out thinking the bad guys.

A funny thing happened on the way to the guest VLAN

Another eWeek article I read yesterday was by Brian Prince about Cisco's new Network Admission Control Guest Server (that sounds so new, that not even a marketing person has gotten hold of its name yet).  Mitchell blogged on this one too (now that he is doing his own thing, it is easier for him and I to blog on the same stuff). Mitchell liked the idea of allowing designated users to set up guest access for visitors, but Mitchell questions who will be given this responsibility in many organizations and if they recognize that it literally is the keys to the kingdom.  Mitchell also brings up a good point that the article at least doesn't say anything about whether or not these guests machines are checked for policy compliance or anything like that.  It is just a guest account set up on a portal and allows a user to move on to a guest VLAN or segment.  Their usage and presence on the network is noted, so that there is a trail of their presence.

So here is the Shimel view on this.  While I think the guest server has some limited benefit from an auditing and reporting prospective, I don't think it is what the market wants.  Increasingly I hear from customers about guest access that all they want is this:

1. Identify a guest user from an employee/managed user.
2. Test the managed user/employee and if they pass, give them their regular access
3. Move the guest into a "dirty" guest VLAN that has web and email access and little else.
4. They don't want to test the guest, as long as he is kept off the "real" network and don't care about what he does to other guests.

Frankly, they view the guest VLAN as almost outside their own network. If they can accurately identify guests, they have no desire to authenticate them, test them or anything else.  They just want to move them to the guest VLAN and forget them. To me what the customer wants is simple white listing/ black listing. Frankly, this was a hard lesson learned by us here.  We kept banging our head on the brick wall of insisting that they check the guests device too.  But people don't want that additional effort.  So as usual the market wins and we have made it easier than ever to set up guest VLAN access for our NAC product.  I am not sure I would call this out though as a separate server.  Clearly this is just a feature.  But I guess from Cisco's prospective it is another SKU they add to the quote, with another dollar amount in the column.

Mitchell begins his second blogging life

I wanted to take a quick moment and give a shout out to Mitchell and his "second life".  Mitchell h as started blogging a bit for Network World, in their Microsoft SubNet.  It will give Mitchell a chance to blog on more than security and exposure to a wider audience.   Head on over and see what he has been up to there. Of course I have cautioned Mitchell not to pull a Rothman and write anything disparaging about his new employers ;-). 

Give my regards to Broadway

Yesterday Mitchell announced on his blog that he has left day-to-day involvement in StillSecure to pursue his goal of "playing on a bigger stage".  While I am sad that Mitchell won't be there to give his all in helping us continue to build StillSecure, I am more sad that I won't be seeing or talking to my friend multiple times a day. As many of you do I bet, we spend more time interacting with our work colleagues than we do with our own family.  That is something that I think people who work from home or have their own single person based business miss.  The comradeship of interaction with co-workers is one of the most rewarding aspects of working in a company, especially in a high-energy, start-up environment. 

Mitchell and I over the past 7 years have grown to be great friends both on a professional and personal level.  At first glance based on our backgrounds, our close friendship would not be obvious.  Mitchell is an engineer from Nebraska, with mid-west values and personality, very involved in his church and music.  Me a typical New York'er from Long Island, loud and more involved in sales and marketing, Jewish and not very mid-west at all.  But Mitchell and I hit it off pretty quickly and we have become very close.  Bonnie and I always look forward to spending time with Mitchell and his wife Mary Ellen. Mitchell's kids have babysat for my kids when we are in Colorado and we are always in touch.  I am sure that our friendship can survive his not working at StillSecure.

One of the three biggest lies (I will let you guess the other two) is when a co-worker leaves, we all stay good luck and lets make sure "we keep in touch".  In the case of Mitchell and I there is no doubt that we will keep in touch.  We will continue to do our podcast together (we will probably have to change the SSATY name, how about "still crazy after all these years), collaborate on other projects and do family stuff together.  In the meantime, I wish Mitchell the wind at his back as sets sail to pursue his dreams!

It would be nice to be a guru, but I want a cool picture of me too!

Mitchell wrote today about his appearance on the cover and in an article in Redmond Magazine called "The Secrets of the Windows Gurus".  It is a pretty cool article and Mitchell is deservedly in some high company with the other folks profiled.  If you get a chance check it out.

What I really liked though was the cool picture and characterization they did of the Guru's for the cover and then the individual pictures.  Mitchell and I have worked together for a long time and it is rare that I am jealous of coverage he gets.  But I have to admit the picture was pretty cool and I wish I had one of me too!  Will have to work on that. Kudos to Mitchell for getting the gig though.

Let the pi$$ing match begin on GPL v3

Well the FSF has responded to Microsoft's declaration that they are not bound by the "anti-Microsoft" provisions of the GPL v3.  Matt Asay writes about it in his blog and says that clearly the gauntlets have been thrown down.  Of course Matt being the open source evangelist says that there will be plenty of people coming forward to the help the FSF and that Microsoft, if they push this could be in a heap of trouble.  I am not so sure.  I am not sure if the FSF crowd really wants to see the courts finally rule on some of the theories wrapped up around the GPL.  Mitchell has a good article up on a recent ruling that could have implications in any potential legal ruling on this stuff.  Me personally, I would like to see the courts get their hands on this and get a definitive answer, rather than the perpetual pi$$*ng match that we currently operate under with this stuff.

Clarification of Googles intentions on Postini deal

So Mitchell and the Hoff-meister both disagree with me on Googles intentions with the Postini deal.  They say no doubt about it, this is clearly a shot at Microsoft.  Well anytime Mitchell and Chris get together in an axis of evil without me, you have to ask why.  I did and actually commented on Christofer's article about it.  So let me take a quick moment and clarify what I said, so even Mitchell and Chris understand.

I am not saying that this is not going to put Google in competition with Microsoft or that this does not give Google a "foot-in-the-door".  I am also not saying that email is not a killer app (Mitchell, email a killer app?  That is so 1998).  What I am saying is that this is not as much about Google versus Microsoft, as it is software as a service versus traditional software.  This is equally a shot against any software vendor who delivers software the traditional way.  It just so happens that Microsoft is the dominant player in the traditional software world.

The fact is though that Microsoft itself is also moving into the SaaS world with their Windows Live line of SaaS. Microsoft agrees with Google that SaaS seems to be rising tide.  That is where the real Google vs. Microsoft battle will take place.