StillSecure, After All These Years

SC Magazine article on clarification of PCI requirements

Martin and a bunch of others have written about the recent clarifications around section 6.6 and 11.3 of the PCI DSS. Jim Carr over at SC Magazine ran an article on it today that he interviewed me for. While I am not the PCI expert Martin is, I was happy to contribute my 2 cents (ain't I always).

Anyway, sounds to me like these new clarifications are going to wind up with a lot of web application firewalls being sold.  Here at StillSecure we are thinking about some ways to take those to the next level as well. Hopefully we can announce something soon on this.  Overall, just another indication that right or wrong, compliance is driving a lot of the spending in security today.

Safe Access wins SC Magazine Award Reader Trust Award, again!

One of my favorite activities of RSA week is getting dressed in a tuxedo and attending the SC Magazine award show.  As I have written before, I like the SC Magazine awards because it is one set of awards that I don't think you can buy. It is actually based on user votes.  This year for the 3rd time in 3 years our Safe Access NAC product was a finalist in the Best Endpoint Security Solution category.  We won in 2006.  This year we came back and won again! 

This year, with everyone throwing dirt on NAC it was especially sweet to win this award against the many other competitors. It is a great testament to all of the hard work that many people at StillSecure have put in to making Safe Access the best product in the NAC market.  I also want to thank the many people that voted for Safe Access as well. 

NAC is alive and well at StillSecure.  Thanks to Ilena Armstrong and the rest of the SC Mag crew for putting on another great awards show this year.

ArcSight IPO goes against the tide

Dan Kaplan over at SC Magazine had an article up today  (they use Intense Debate for comments too)about ArcSight's first day of trading.  It seems that in spite of the overall condition of the market, they went ahead with their planned IPO.  They picked a bad day to do so, as the NASDAQ was off 1.74%. Opening at 9 dollars a share (the low end of their expected range), they closed at 8.78, bouncing off an intra day low of 8.07.

OK not an auspicious start, but I think they deserve credit for putting the ship out in this storm. I remember when I was at Interliant and we were planning our IPO.  Trying to time the market is a fools game.  Sometimes you just have to go for it.  Only time will tell if the market rewards ArcSights gumption to go public at this time or punish them as they have done recently with Sourcefire. For reasons that include purely selfish ones would love to see the public markets be a viable alternative for security companies to pursue liquidity events and access to capital.  Without them no one will be able to gain the girth necessary to compete with the current security monoliths.

Have data breaches affected your information security plans? Here is your chance to have a say

My friend Ilena Armstrong, Editor-in-Chief over at SC Magazine is conducting a survey on on how news of breaches, thefts and exposures are affecting organizations info sec plans.  Below is a note from Ilena inviting you to participate.  If you have a moment please take the time fill out the survey.  Everyone who does gets a copy of the results as well as a chance to win a full boat pass to RSA.  Sounds like a  good deal to me!

Dear IT Security Professional,

I am writing to ask if you will take a few minutes to help with some vital industry research.

A legion of data exposures have occurred over the past year, with many affected companies not
only being forced to address customer and investor concerns, but also pay fines and adhere to prolonged sets of requirements administered by the Federal Trade Commission. So just how is news of such breaches, exposures and possible thefts affecting the way organizations -- large and small -- focus on information security plans?

This survey, Guarding against a data breach, aims to find out and should take less than 15 minutes to complete. Click here to take the survey:

To thank you for your time, we will send you a copy of the full results at no charge. Additionally, you will be placed in a drawing to receive one of two available full conference passes to the RSA Conference 2008, which will be held in San Francisco, California from April 7 -11.

Analysis of the feedback will appear in the form of a special section in the January 2008 edition of SC Magazine. All feedback will be analyzed in aggregate and responses will remain anonymous.

To participate, click here.

Please respond by Wednesday, Oct. 31 in order for your opinions to be used.

Its that time of year again

Hands down the biggest security show of the year is RSA (most fun though is probably Black Hat, but thats Vegas).  One of the highlights of the RSA show for me is going to the SC Magazine Awards show.  It is a nice night, you get dressed up in a tuxedo, drink free and mingle with the industry.  The guys from HayMarket and SC Magazine always do a great job.  On top of this, unlike many other awards for sale, the SC Awards seem to be on the up and up.  Over the years we have won once (Safe Access, best endpoint solution) and made the finals a bunch of times, but either way it is always a good time.

Well though the awards (and the RSA show) have been pushed back to April (they usually are in February) this year, it is that time of year again.  Voting for the SC Magazine Awards has begun!  It seems like they have expanded the categories of Reader Trust Awards this year.  These are the awards you can vote for.  They have another set of awards that are selected by the judges.  Here are the categories for the Readers Trust Awards:

Reader Trust Awards

Best Anti-malware Solution
Best Email Security Solution
Best Instant Messaging Security Solution
Best Web Filtering Solution
Best Intellectual Property Protection
Best Endpoint Security Solution
Best Mobile Device Security Solution
Best Enterprise Firewall
Best Intrusion Detection/Prevention Solution
Best Wireless Security Solution
Best IPsec/SSL VPN
Best Identity Management Solution
Best Multi- and Second-factor solution
Best Integrated Security Solution
Best Managed Security Service
Best Computer Forensics Solution
Best Event Management Solution
Best Policy Management Solution
Best Audit/Vulnerability Assessment Solution
Best Security Software Development Solution
Best Security Company
Rookie Security Company of the Year
Best SME Security Solution
Best Enterprise Security Solution
Best Regulatory Compliance Solution
Best Professional Certification Program
CSO of the Year
Best Security Team
Best Professional Training Program
Editor's Choice Award

All four StillSecure products are nominated.  Safe Access in the endpoint category, Strata Guard in the IDS/IPS, VAM in the vulnerability management and making its debut, Coba in best integrated security solution.  I would love to see all of my readers vote for the StillSecure products, but since many of you work for other vendors nominated, that probably won't be the case.  In any event, if you get a moment go vote for your own choices, but at least vote!

Salmon swimming upstream

My friend and fellow StillSecure exec, Jayson Ayers recently returned from a salmon fishing trip to Alaska where he hooked some big fish.  It always fascinated me how salmon make their way "uphill" against the current to spawn.  Having to get by the fishermen, the Bears and everything else, it is a wonder of nature that so many of them make it.  I felt the same way reading Peter Stephenson's article today ranting against the trend towards all in one boxes.

Peter is a heck of a nice guy and runs the test labs over at SC Magazine.  He is also pretty smart.  That is why I was surprised to see him take such a contrarian view on this one. I frankly thought this was a battle that had already been fought and to the victors belong the spoils.  Peter thinks that putting multiple security apps on one box at the perimeter into a "SuperUTM" defeats the layered security model.  Peter makes two points that stand out to him:

1. The boxes represent single point of failures.  I don't think this one holds water.  Think about it, having separate boxes for firewall, IPS, etc. just represents multiple single points of failure.  If any of them fail, it could bring your network down.  At least in the UTM model you just have to worry about one box, not several.

2. A single box is not a layered, security in depth defense.  I disagree with this one as well. Just because they are on one box, does not mean that you are not deploying layered security defenses.  Yes if you can bypass the box, you bypass multiple layers, but that is easier said then done.  Also, you might bypass the IPS, but not the firewall.  Or you could bypass the content filter and not the AV. The fact that they are are on one box is not really the issue.

Lastly, Peter says having all of these apps on one box does not mean they are easier to manage.  That may have been true, but even Peter admits that is getting better.  It is certainly cheaper.  The question in my mind is do they all function on one box.  With virtualization and powerful off the shelf hardware, the age of multi-function boxes has arrived for sure!

Now Peter, once you get your head around a multi-function security box, let me introduce you to the next evolutionary step, a unified network platform, Cobia.

SC Magazine gets blogs

My friends at SC Magazine have finally seen the light and have started some blogs on their web site.  I found two so far, IT Security Blog Roundup and The SC Magazine News Team Blog.  I see my friend Frank Washkuch is in both of them, so I assume he is driving it.  It is a long time coming, but I am happy to see SC Magazine moving in this direction.  It will give them a chance to use the technology to stay much more up to the moment and make reading the online version of the magazine more important.  Welcome to blogging Frank and SC Magazine!

SC Magazine Awards

Last night was the annual SC Magazine awards show.  It is the Oscars of the security industry and a great chance to clean up, get dressed, eat, drink and be merry.  All three StillSecure products were in the finals of their respective categories.  Unlike last year, when Safe Access won Endpoint Security product of the year, this year we were not fortunate enough to win.  In the endpoint category in a very competitive space, one of our partners, Senforce took home the prize.  Congratulations to Nolan, Mike Hall, Scott Richards and all of the folks back at Senforce.  Job well done gentlemen!

Win or lose, I felt the fact that all three of our products made the finals was a tremendous testament to the quality of our products across the board.  The folks at SC Mag do a great job of putting on a great night of entertainment and a chance for the industry to come together.  Lisa, Ilena, Frank W., Gil and the rest of my friends did a great job this year.  Thanks for your hospitality and putting on another great event.

OK, today starts the battle for next years awards.  We want to get back in the winners circle!

Are you underpaid?

I guess at some point we all wonder.  For the amount of aggravation and BS we put up with, no matter how much we love our jobs, is it worth it.  How do you find out if you are over or under paid?  I suppose you could go the free agent route and test the waters.  But lets face it, we are not pro sports athletes and don't have people like Leigh Steinberg or Scott Boras to fight for us.  This is why I usually support anonymous salary surveys.  They may not be 100% accurate if people don't tell the truth, but at least they give you something to go by and gauge yourself. 

SC Magazine has their annual salary survey up and taking anonymous respondents right now.  You can participate by clicking here.  I urge all of my security industry friends to take a moment and take the survey. The more data they gather, the better the findings will be, the more helpful it will be to all. 

Finally, lest I be accused of playing favorites, let me state, I do not get paid nor am I in any way affiliated with SC Magazine (though I am an Ilena Armstrong fan).

More trolling by Ross Brown, this time disparaging the SC Magazine awards

So I guess Ross really was as he says, in a snarky mood today.  After lashing out about what a failure open source has been in the security space, Ross next takes a swipe at the SC Magazine awards.  Seeing how all three of our products have made the finals for two years in a row, I feel compelled to refute this one as well.

First in way of background, lets talk Gartner.  Like Ross, I also do the obligatory  analyst dance with Gartner and the rest.  You can listen to our podcast with Amrit Williams to hear more about that jig.  However, lets be clear about how Gartner ranks companies and who they are geared to.  Gartner is geared to the Fortune 500, large enterprise market.  Nothing gets you further up a Gartner report than having large enterprise customers sing your praise.  Even up and comers need large references to make it to the top of the Gartner heap.  Now, everyone knows that large enterprises are usually more risk adverse and do not use the latest and greatest technology. Few big enterprise security managers want to take a chance on an up and comer.  So you cannot put much weight behind the fact that Gartner rankings do not equate with SC Magazine rankings.  If the awards were just based on revenue or big company presence, it would not be much of an awards show.  Sort of why a Star Wars should win best picture Oscar (hey maybe it should have) versus a more "artistic" movie just because it brought in more box office dollars.

Now, the SC awards themselves. Yes you have to pay to nominate your product.  I think the cost is a big 100 or 200 dollars.  Hardly a budget breaker for a company like Microsoft, Symantec or McAfee or even eEye I might add.  After that, for the readers choice awards anyway, I believe it is just a matter of how many votes are cast for each product.  Yes, companies try to get votes.  I think SC Magazine limits how many votes can come from a company email and you must fill out a questionnaire that I think is designed to thwart people from voting over and over again. 

Proof to refute Ross comes from the fact that even the major sponsors of the awards do not win the finals.  I remember last year having heard that Qualys underwrote a large chunk of the award sponsorship and yet Rapid 7 took the vulnerability management award.  The best proof I can give you though is our own example.  Truth be told, we spend very little money with SC Magazine.  I like Illena and the gang, I read the magazine regularly but anyone at SC Magazine will tell you that StillSecure does not spend much with SC  Magazine.  We really don't do print ads or on line ads for that matter.  We do our own webcasts .  I do remember doing one of their forums in wine country a few years back, but that is it.  We are not winning anything because of the money we spend with them.  Now, maybe the good PR they get on my blog has something to do with it :-)  Seriously, we do not have a PR roadmap or anything that has helped us here.

Ross you should know better than to believe the drunken ramblings of some PR person from a competitor.  I say put it to the test, put your products up and see how they do!  You really want to impress me go for it, I may even pay your hundred buck nomination fee if you need me to.