The Ashimmy Blog

An Incite-ful Tuesday: Playing catch up

It happens to me every year at this time. I want to enjoy the holidays with the kids. Friends are having parties, lines are long at the stores and it seems like I can never get to everything on my list.  On top of this I am hard at work putting everything together for the new venture. I almost forgot what its like to get the website together, power points, business cards and the thousand other little things in that make it real.  Luckily I have some great folks I am working with and I don’t have to carry the load myself. In the meantime I have like 6 or 7 tabs open on the browser (in Chrome as I am really liking it better than Firefox right now) on topics I want to comment on. So will do a Rothman and lump them together here.

Anyway, I am sure you are all busy with your holiday plans and activities as well.  It may seem like nothing ever gets finished and there is always so much more to do. But take a moment, look around and realize what the season is all about. Be grateful for what you have, it is probably more than most in this world have. Enjoy!

1. US, Russia and UN in SALT-START treaty negotiations on limiting cyberwarfare.  I am old to enough to remember first President Nixon and then many others signing treaties with the former Soviet Union limiting the number of nuclear missiles we had aimed at each other.  I remember always thinking phew, now each side only has enough to destroy the world 20, 10 or even 5 times over.  But bothering me was the fact that it would only take one time to destroy the world. I still remember shelter drills where we would have to either crouch down under our desks or go into the school basement in case we were attacked.  Like hiding under one of those crappy little desks at school was going to save us from a nuclear holocaust! Anyway, I was reminded of all this reading an article in the NY Times detailing that the US has joined the rest of the world, but especially Russia in discussing limiting cyberwar weapons.  My only question is you can supposedly count missiles, how are going to count logic bombs? But I am sure there are smart people working on all of this and will be watching what comes out of it.

2. Security is a people thing! One of the lessons I have certainly learned about security is that you can have the greatest technology in the world. You can have the latest new security gizmos and appliances, layered in one after the next. But if you don’t have the right people in place, empowered with the resources and authority they require, it just don’t mean a thing. Max Huang, CEO of O2Security says the same thing in this opinion piece over at SC Magazine. Good to see a vendor guy coming to the same conclusions.

3. NAC market shrinks to 37m in Q3. Jeff Wilson and his band of Infonetics have put out a new NAC report which I wrote about earlier. In this article in TMC Net they use Jeff’s numbers to report that the NAC market actually shrunk to about 37m last quarter. Of course you need to know what they define as the NAC market. Is it just appliances, is supporting gear included or agents? I think he is talking just appliances. In any event, I think that is widely optimistic. But even giving Jeff the benefit of the doubt, it pales in comparison to the wild numbers that were tossed around a few years ago by the analyst community on where NAC would be now.  But hey they weren’t the only ones wrong about NAC ;-)

4. Raising the barriers to resell your products – FAIL. I never understood this strategy. WatchGuard announced a new MSSP partner program in this report on the MSP mentor. Nothing special really, they are packaging the on premises appliances and remote management to the MSP partners to offer a turn key managed service for them to go to market with. Fortinet and others do the same thing.  But what Watchguard is saying is their special sauce is “is their 4-part certification process to become a partner, according to Chris McKie, director, global analysis and public relations, WatchGuard.” They are going to make partners go through 2 levels of technical certification. There sales teams have to be of a certain size and quality and WatchGuard’s support team has to approve the partner as well. 

I understand raising the bar and having skin in the game. But if you make it too hard for people to resell your products, guess what? That’s right, they won’t resell your products. I am not advocating that you have a Cisco situation with resellers cutting each others throats for a point or two, but when you are WatchGuard I would think you want to broaden the channel.

Anyway, that is it for today. I have a podcast scheduled for tonight with Mitchell and whole list of other stuff I have to get on to. Have a great day!

The evolution of NAC

Jeff Wilson over at Infonetics Research has always been one of the biggest supporters of NAC. It was early Infonetics reports that really helped fan the flames of the NAC craze. So while most of the world seems to have moved past NAC, Jeff and the Infonetics team are still beating the NAC drums.  Of course with companies going out of business and market numbers not growing as projected, you need to take a new angle if you are going to point to any kind of a rosy picture regarding NAC.  That is exactly what Jeff and team have done with their new whitepaper titled the “The Evolution of Network Access Control”. It is available for a free download if you still have any interest in NAC. 

Jeff points out how “modern NAC” products (all three of them) have moved beyond the original NAC mission to perform valuable tasks in today’s complex network environments. Frankly I think Jeff’s idea is right on, but I question whether today’s NAC solutions actually perform these tasks or is it more NAC hype.  In any event, the argument can be made that for many of these tasks there are other products that can perform these tasks better, cheaper and faster. NAC by definition can be complex, so without a clear cut mission worthy of the challenge of implementation it is a tough value prop.

One interesting thing is what respondents to Infonetics gave as drivers for buying NAC. Guest Access was near the bottom but stopping propagation of threats was still at the top. That hasn’t changed since the beginning of NAC.  I am just not sure that is a big enough mission to drive NAC though.

Bradford Networks distances themselves from NAC

Bradford Networks fresh off of winning a best buy award in a NAC group test from SC Magazine, yesterday announced an ambitious new line up of solutions based on what they are calling their Adaptive Network Security (ANS) platform.  Network Sentry is the new line and here is what Bradford says it is all about:

1. Protecting the network from unauthorized and at-risk users and devices;
2. Ensuring that confidential network resources are protected;
3. Eliminating endpoint vulnerability;
4. Ensuring that security policies are established and enforced;
5. Maximizing existing investments in security systems and network infrastructure;
6. Provisioning, securing and managing user, device and guest access;
7. Detecting and profiling managed and unmanaged devices; and
8. Automating security actions and policy enforcement to unburden IT staff.

What you don’t see there is NAC or network access control though.  Many of these functions were already accomplished by their NAC Director and guest access NAC products.  But they are clearly choosing to distance themselves from the word NAC.  Hey, who can blame them? 

What remains to be seen is if Bradford has the breath and girth in the market to make this comprehensive vision actually pan out.  They have a great base in the edu market and this could be just the thing to move them beyond that.

Also some of the traditional knocks on Bradford’s NAC product seem to have been addressed in the new release. GUI, set-up and reports all claim to have been upgraded.  I haven’t spoken to anyone yet who has used it to say for sure. 

In any event seems like another vendor trying to move away from NAC. The problem is that many of those who have tried have already spent too much time and effort and didn’t seem to have the fuel necessary to achieve escape velocity. But with Bradford building on what they already have, lets hope it turns out different for them.  Good luck to them and we will have to keep watching.

SSAATTY Podcast: Mirror Pond - The best Safe Access NAC ever!

This is a special edition of the StillSecure, After all these years podcast. I am joined by John Curry, director of customer security at StillSecure to discuss the latest, greatest version of StillSecure's Safe Access NAC product code named Mirror Pond.  Mirror Pond has won rave reviews from customers, media and engineers alike.  John tells why and what you can do with Mirror Pond.

WARNING: Listening to this podcast could change your attitude on how, when and why you should use a NAC solution. Listen at your own risk.

If you have any questions about the podcast, please write to podcast@stillsecure.com. If you have any questions about Mirror Pond, NAC or other StillSecure products, check out the StillSecure web site.

Mirror Pond - The best Safe Access NAC release yet!

StillSecure, After All These Years Podcast

Network Access Control for Dummies who like Juniper

At one time the “for Dummies” books were pretty cool. They had legitimate books that had simplified information on a range of topics.  Unfortunately the whole “for dummies” thing has been co-opted by marketing hucksters. Even in the infosec arena we have seen it happen. First it was Qualys coming out with Vulnerability Management for Dummies, now it is Network Access Control for Dummies by Juniper.  Hey I don’t blame them it is a great way to educate and steer customers to your point of view.  I guess what bothers me is that to the average user it is not clear that the book is written with a slant towards a particular vendor.

I have not read the entire book. I did read the first chapter which you can read here. The book appears to contain some good information. The thing is when you look at their descriptions and pros and cons of different types of NAC you can see the Juniper bias coming through.  Very 802.1x focused, but what do you expect from a Juniper NAC book?

Anyway my point is that if you really wanted a good NAC for Dummies book instead of having 3 authors from Juniper, a more non-biased or balanced group of authors would bring the book more creditability. My personal opinion is that NAC for Dummies is best done by using a managed service for NAC. NAC for Dummies is a bit of an oxymoron :-)

Related articles by Zemanta

• Knock NAC, Knack for NAC, Who gives a NAC? (stillsecureafteralltheseyears.com)

When you're a hammer everything looks like a nail

One of my favorite sayings and I have Mike Rothman to thank for it.  It popped into my head this morning while reading a guest opinion piece in SC Magazine by Jon Green, VP of Aruba Networks (VP of what I don’t know). Once you get past Jon’s cutesy wireless and NAC = BFF stuff and read what he is talking about there are some good things there about how NAC can help a network.  But you need to remember what kind of hammer Jon is. 

Aruba is a company that makes and sell wireless gear and OEM’s Bradford Network NAC product.  They sell a lot of the OEM’ed NAC into the edu market. So of course what Jon says is based upon the experience Aruba has selling NAC. Therefore when Jon says retrofitting NAC onto wired networks is much harder then putting NAC into the wireless networks understand the perspective. You see the nail?  He says this is because the wireless networks are new and don’t need to be retrofitted. But what about if you are upgrading the wired network too? That does happen.  At the end of the day if you are using 802.1x whether it is wired or wireless, NAC is much easier to do, assuming you know your 802.1x. 

Here is my point though, what good is just putting NAC on your wireless network if the wired network is not protected? As the song goes “it just takes one bad apple”. In fact NAC’ing your wireless network while leaving the wired network open is like locking the door but leaving your windows open.  If you are going to use NAC you need a plan that will have all devices coming on your network being authenticated and secured.  Not just the ones that come on through the gear you sell.  Otherwise instead of BFF, it is just BFD!

One other thing Jon, not sure how many actual NAC deployments with remediation you have actually worked on, but let me know how many endpoints are patched and remediated in a just a few seconds. Maybe the testing takes a few seconds but remediation takes longer then that. Makes your piece sound a little too PR'sh.

Knock NAC, Knack for NAC, Who gives a NAC?

I’ll tell ya, nothing like a NAC vendor going out of business to get the press to pay attention to NAC again. After cruising under the radar for a while allowing successful NAC vendors and users to actually get something done, ConSentry going under has brought the pundits out of the woodwork.  I wanted to just quickly comment on two articles/posts I came across today:

1. Pescatore on Knack for NAC – If you are in the security business you know Pescatore means John Pescatore the dean over at Gartner.  If you are not, you may think I am speaking about some seafood item on an Italian menu. Anyway, Lawrence Orans is the NAC point guy for the G-men, but John had an article up on the Gartner blog that I thought made some good points.

• Gartner’s definition of Network Access Control as a process has three elements:
  1. Noticing whenever something connected to your network and determining if it was one of your devices or not, and if it was one of your users or not.
  2. Determing the security status of the device connecting to your network.
  3. Given (1) and (2) deciding what to do.
• That despite the overhype there have been a number of success stories recently that “have taken phased approaches to NAC by first implementing (1) above to support guest networking and allowing unmanaged IT on the network. Once that is stable, turn on baselining - but still no quarantining. Once that is stable, start looking into (3) - what sort of network controls should be placed on vulnerable (missing patches) devices vs. dangerous (infected with malware) devices?” The distinction between vulnerable devices versus dangerous devices is a good way at looking at the classes of devices coming on.  Too often it is rogue versus managed or guest.  What is truly dangerous and what is just not in policy is a good way of looking at it.
• Guest Networking is the back door into many NAC deployments where customers did not go looking for NAC but in solving the guest network problem wound up with NAC. As a result according to Pescatore the market had some very hefty growth despite the economy.

2. Randy George at Information Week (is he Boy’s cousin or something. What is it with me and making fun of names today? I feel like Chris Berman on ESPN – He could go all the way!) on ConSentry going belly up being an ominous signal for system level protection technologies. Sorry Randy you got it all wrong. Randy’s mistake is classic. When you start with erroneous assumptions, you are going to come to erroneous conclusions (you know what happens when you assume). First lets look at his mistaken assumptions.

“After $80M invested by its VC partners, over $9M of which was received earlier this year in order to fund future growth, an innovator in the Network Access Control space, ConSentry Networks, closed its doors for good today.”

Randy here is the deal. Yes ConSentry burned through 80 million. But 71m or so was spent in an orgy of marketing and chip and hardware development during the NAC wars. ConSentry was locked in a battle with Vernier and Nevis, when the real enemy was Cisco. It was common knowledge that the only viable exit for any of the inline guys was to get bought by a switch vendor.  To compete in the switch market as an independent would require hundreds of millions of dollars, not 70!  By the time they raised the last 9m they were on life support. That 9m was a recap that crammed the original investors out. It gave ConSentry a short leash to remake itself as a switch, not a NAC vendor. Without some quick success in the switch market they would not be able to raise the additional dollars they would need to compete. That was the “funding future growth”. You may know how to test stuff in the lab, but you need a little help sifting through the PR speak.

Next ConSentry had not claimed to be a NAC vendor in a long time. They had been running away from the NAC moniker for years. The only ones who thought of them as an innovator or leader in this market were people at your magazine. They had less than 100 customers I believe. Again don’t believe the hype.

Finally, your biggest mistaken assumption of all. I just don’t get that because both both data protection and system protection are both hard and expensive, companies won’t do both, so are choosing data protection.  Faulty logic.  We could say the same thing about host based protection versus network based protection. Do you see UTM, Firewall, IDS/IPS, network vulnerability scans going away in favor of HIPS, personal firewalls and endpoint security? Can you say layered security? They are not mutually exclusive. As long as there is a problem that needs to be solved there will be system based protection.  NAC is not black and white and neither are the real world choices that security professionals make.  You can create a science experiment where you have to pick one or the other, but you need both!

One up, one down – are reports of ConSentry’s demise premature?

As I just wrote the other day I always thought of ConSentry Networks and Nevis Networks as the frick and frack of inline NAC.  They along with Vernier Networks form a triumvirate of failure. Proof positive that the inline NAC strategy is a failing one.  As much as Mike Fratto and others may hate to admit it, inline NAC is just not the right way to solve the problems that NAC address. It doesn’t scale, is expensive and cumbersome at any size.

In any event I was told by a source today that ConSentry closed up shop today. I have not confirmed this with management there because I have not been able to reach anyone. But this person was an employee until today.  In any event I actually liked many of the folks at ConSentry (especially Mario and MIchelle) and hope they find good new homes, if indeed this is correct.  I will follow with more details as soon as I have them.

Authors Note: Tim Greene published a story tonight confirming ConSentry closing with a quote from management. So I guess that is that.

Nevis Networks gets a heart transplant, but can the patient survive?

At the height of the NAC wars, ConSentry Networks and Nevis Networks fought it out trying to bring a NAC switch to market. I used to call the them the fric and frak of inline NAC. But alas the inline NAC market proved to be a graveyard for those who attempted to stake a claim. ConSentry almost went down for the count only to recapitalize and emerge with a new strategy and much smaller footprint. Vernier Networks just flat out died after a brief fling as Autonomic Networks. Nevis leaving their customers in a bit of a lurch went bankrupt as reported by the WSJ in May of this year. Now it appears that some folks have purchased the assets of Nevis and are re-animating the company.  The press release touts Aviram’s Nevis Networks having a “fresh outlook for success” and a new management team.

Here is a bit of advice that may help that fresh outlook for success.  Stop the marketing/PR nonsense! Announcing raising a company from the dead with a press release that touts it as “a market leader in identity-based security policy enforcement switches and appliances” is just so ludicrous that it is laughable.  How can anyone take that seriously.  Also calling Aviram Networks, Inc. “a Delaware corporation … a market leader in secure switching and identity-based policy enforcement appliances” is a bit ridiculous as well. It appears to be a holding company set up to buy Nevis’s assets out of bankruptcy and has done nothing to be touted as a market leader in anything!  While you are at, perhaps remove the link to the “what can Orange do for you blog” on the Nevis front page pointing to a blog that was nominally about Nevis to begin with and was shut down 4 months ago. 

Guys you want to play in this league you better take it up a notch. Otherwise you are the next Autonomic!

A busy Monday in the security-sphere

You can tell that Summer is starting to wind down (how did that happen, it was just the 4th of July). Today’s news was full of stuff that bear watching.  Watching the news as closely as I do it is easy to to see the rhythms and currents in the quality and quantity of the news.  Like the bears smelling the first snow of the season as a signal to hibernate, the pace of developments is telling me that we are heading into the back from vacation, lets get busy time of year.  So hope your vacations were fun, but better buckle down and get busy!

1. Fortinet to test the IPO waters. President Obama says the worst is behind us and the markets have been picking up.  Sounds like a great time to try a security based company IPO? Maybe not. The last few have not exactly blown the doors off of anyone, but maybe this time will be different. Fortinet certainly has the revenue to justify it, though I don’t think a 7.4 million profit on revenue over 200 million in 2008 is a great margin. Of course the question is what does 2009 look like for them. Has the recession hit them hard? Have the continued to grow? In any event, this may nudge along other less qualified security and technology companies to put their toes in the IPO waters. With valuations in money raising and M&A so low, something has to give to change the equations.  Good luck to the folks at Fortinet!
2. Marrying NAC to IPS? Why didn’t I think of that? Wait a second I did! Sourcefire and Bradford put out a press release detailing integration between Sourcefire’s IPS and 3D system and the Bradford NAC product. Funny I remember Bradford announcing this same functionality a year or two ago with Snort and then Top Layer and then Nitro. I don’t know this sounds too much like a me too Barney release for my tastes. But Bradford has been silent for a while, so I guess this means they are still in business.  The functionality addressed is actually very similar to how StillSecure’s Safe Access NAC product works with our Strata Guard IDS/IPS system. Safe Access can use Strata Guard as a dedicated post-connect NAC sensor or as a stand alone IDS/IPS with added functionality. StillSecure has been offering this type of functionality for years already, as has Bradford for that matter. This would have been a good announcement in 2007 but today, not so much guys.
3. Lifetime warranties, the new black in networking gear – Extreme Networks announced this a while back but just came across this article in AMEInfo detailing it. Extreme now joins HP ProCurve and Cisco is offering some type of lifetime warranty.  HP ProCurve started this trend but it looks like it is becoming the de facto standard in the network gear space.  I think it is great if there is not a lot fine print that renders them useless.
4. Seeding the clouds? Terremark which is supposed to be growing pretty rapidly (at least my friend Pete Nicoletti says so), reported a run rate of 2.5 million dollars a year in this article on MSPMentor. While more than 2 million dollars is a lot of money (I could use that right now), as an indicator of big things to come, it just doesn’t get my juices flowing.  I would expect more revenue from cloud services than that. Hell, I would like to see more from cloud security alone than that.  BTW, I am doing a podcast on cloud services and cloud security very soon, so stay tuned!

Anyway that is all I have for today.  Have a great day!