StillSecure, After All These Years

Rich Mogull does his best Stiennon imitation, says GRC is dead

Some of the Stiennon "magic" must have rubbed off on Rich Mogull when they were both at Gartner or maybe in a case of the imitation being the sincerest form of flattery, Rich M secretly admires Richard S. In any event taking a page out of the "xxxx is dead" playbook, Rich writes that GRC is dead. In fact Rich says it was stillborn and never really alive. There are many things that Rich says in his article as well as Gunnar Peterson's article that he references, that I agree completely with. However, overall I think Rich's fatal mistake is one of Titanic proportions. He is mistaking the tip of the iceberg for the entire mountain of ice that is under the water and not as easily seen. The reports and dashboards of GRC products represent the by product of much of the real work and value they bring not just to the "C" level but to the security practitioner who is tasked with ensuring compliance as well. I am seeing the compliance workload fall on the already over worked, underpaid security guy time and time again and they need help with it!

I know people like Mike Rothman say compliance is bull and if you just follow good security practices, compliance takes care of itself. However, lets be real folks, between PCI, SOX, FISMA, etc., compliance is driving budget in the security industry. In an industry where the "security guy" just did not have the tools to push through budget for the resources required, compliance has become the sledgehammer that the CISO and other security types use to crash through the doors into the CFO's office and get the budget required.

Before I delve further into why I disagree with Rich though, let me state where I do agree with him and Gunnar for that matter. I do agree that a by-product of compliance has been a move towards running your business as "audit-driven rather than business-driven". Somewhere along the line we have forgotten that the rules, regulations and statutes that compliance is driven by were put in place to provide a minimum of acceptable security and confidentiality to protect sensitive information. It was supposed to be about protecting the data, not about checking off the compliance box! I agree with Rich that it has become a way into the C-level office. But what is so bad about that? Symantec has been selling their security into the CFO for years. Rich not having worked at a vendor, I don't know if you realize how hard it is for the security folks to get budget approval for the tools they know they need. In order for security to get its fair share of the budget pie, it is imperative that security budget decisions are made at the C-level. If the security team can't get the approval, the security vendor is going to try and help.

While dashboards and reports are the tip of the iceberg and the shiny baubles that are used by the GRC vendors to get the attention at the C-level, I think that the bulk of the work takes place below the water. It is making sure that in fact the enterprise is in compliance. Making sure that everyone has the latest patch level, has AV installed and that data is protected from leakage is the real work. Testing and ensuring this is the real job of GRC, the reports and dashboard is just the way you can show it working. Rich I think you are the one being short sighted if you think these products are just about the reports. Without actually doing the analysis and investigation the reports are meaningless. In my mind is much like SIM reports. Without actionability and correlation, how much value are the SIM reports?

GRC is a needed tool in todays security practitioners tool kit. They are being placed in the position to ensure compliance and they need the ability to do so. They also need help getting the budget approved for the tools they need to do the job. We can rant all we want about compliance for compliance sake being asinine, but the fact is that is the world we live in right now and rather than spitting into the wind, lets figure out how to make it work best for us.

StillSecure, After all these years, #53 - SSAATY meets the Network Security Podcast

Someone put chocolate on our peanut butter!  Mitchell and I got on a party line to record episode 53 and who else was on? None other than that dynamic duo from the Network Security Podcast, Martin McKeay and Rich Mogull! The 4 of us had a great time talking about one of Martin's favorite topics:  Privacy. Should what you put on line be held against you by your employer. Do you have any expectation to privacy for all of this information you are posting on Twitter, Facebook, etc.  These topics and more come under the glare of the 4 of us.

We also talk about HP's boast of employing 9 of the top 11 security hackers (shades of the infamous top 59 list).  There is a special message for all security bloggers and podcasters, as well as security media types who are attending RSA, if you don't know what we are talking about contact us.

If you like the content of these shows or have any other comments or questions, please drop us a line at podcast@stillsecure.com

Thanks to ClickCaster for hosting our podcast. Tonights music is the usual, To the Summit by Jon Schmidt. You can hear more from Jon at http://www.jonschmidt.com. Music transitions between segments are by our own Mitchell Ashley!

Or download here:

mp3 

The Mogull's secret life

Rich Mogull was evidently inspired listening to me rant on the podcast about NAC the other day. So much so, that he imagined a place a long time ago, in a galaxy far, far away where it is said the secret origins of NAC occurred.  Of course I guess Rich knows about the dark secret life of many things about security and analysts and such.  Anyway, Rich actually agrees with me on the dilution of the term NAC.  Rich also goes against some of the prevailing wisdom and actually seems to come out supporting NAC as a valuable tool and one that Cisco and Microsoft may not have right. He also, I think correctly, points out that NAC being truly built into the network fabric is probably too far off to wait for right now.

So do I agree with all of Rich's secrets? Of course not, what fun would that be.  Besides how could Mike Fratto accuse of me having it both ways. I think that NAC can add a lot of value without actually quarantining anything or anyone. I think just finding out who, what and where is on your network is valuable in a lot of scenarios. I also think that alot of the other bells and whistles as Rich calls them will wind up adding a lot of value to NAC when they are better integrated and understood as part of the greater mission NAC can play. 

But all in all, I would say Rich seems to understand the secret world of NAC a lot better than some other analysts do.