The Ashimmy Blog

Envelope please, and the winners are . . .

OK for the first time in public, here are the finalists for the 2010 Social Security Blogger Awards! The finalists were chosen by our blue ribbon panel of judges (Mike Fratton, Bill Brenner, Kelly Jackson-Higgins and Larry Walsh). The members of the Security Bloggers Network will be recieving ballots shortly with the names of the finalists and they will cast the deciding votes for who this years lucky winners are. So without further delay, the finalists are:

 

Best Technical Security Blog

SANS Internet Storm Center

Evil Bytes by John Sawyer

Praetorian Prefect

Darknet.org

Frequency X ISS blog

Best Non-Technical Security Blog

Security Uncorked

Schneier on Security

Krebs on Security

ThreatPost

TaoSecurity

Best Security Podcast

PaulDotCom

SANS ISC Stormcast

An Information Security Place

CSO Security Insights

Security Catalyst

Best Corporate Security Blog

JEREMIAH GROSSMAN (White Hat Security)

SOPHOS GRAHAM CLULEY BLOG

MICROSOFT SECURITY RESPONSE CENTER

FORTIGUARD BLOG

CISCO SECURITY BLOG

Most Entertaining Security Blog

Rational Survivability by Chris Hoff

Security Incite by Mike Rothman

Uncommon Sense Security by Jack Daniel

SecBarbie by Erin Jacobs

Emergent Chaos by Adam Shostack and ensemble

What an all star list of finalists. Each and every blog and podcast on this list are deserving of winning. It is a testament to the quality and quantity of blogs that the security industry has spawned. Congratulations to each and every one of them. May the best blogs win!

I also want to point out some honorable mention blogs and podcasts that did not make the finalists because they were not eligible, though they were nominated:

Securosis Blog

Network Security Blog and Podcast

and my own Ashimmy, after all these years.

Of course the winners will be announced at the Security Bloggers Meet-up at RSA in just over a month! Good luck to the finalists and hope to see you at the meet up.

Has Cisco taken Rohati back into the fold?

This is the time of year for M&A deals.  No I am not talking about the analyst deals of the last few days (but good luck to all of the Securosis-itcs). Not sure how the Gartner-Burton Group will shake out. Is
Gartner getting into the consulting business? But here is one rumor I heard today on good authority, but am trying to get more confirmation on: Cisco has acquired Rohati.

Who is Rohati you ask? Well I originally wrote about them back in June of 2008. My friend Richard Stiennon thought that they were the greatest thing since sliced bread. Then when Tom Noonan was appointed to their board, I had a chance to have Tom on the podcast with Mitchell and I.

Rohati was founded by a bunch of ex-Cisco folks and I always felt that eventually Cisco would take them back into the fold. If my information pans out, that may be just he case. I am very curious to see if this was a move to save what Rohati had developed (see my earlier posts for that) or did Rohati fetch a nice multiple for their founders and investors. 

It would be good to see the year get off to some good acquisitions, at good multiples!  If anyone knows anything, please speak up!

Related articles by Zemanta

• Research Consolidation: Gartner Acquires Burton Group For $56M In Cash (techcrunch.com)

Grumpy's Christmas Cheer

You gotta love Mike Rothman. There is something deeply rooted there that makes him who he is.  Just as everyone is getting deep in the holiday spirit, his inner Grinch comes out and he puts out his most vitriolic column in a long time.  Me on the other hand, I think of Mike as my own personal GI Joe. I dress him up with whatever hats and costumes I can find.  Here since he is the anti-thesis of the Christmas spirit, Mike dons a Santa hat.  Mike should just be lucky I don’t have any full length body shots of him otherwise he would really be in trouble!

Anyway, what has Mike so grumpy (besides canned muzak Christmas music that is). Well first it seems that its one thing to have to be drowned in end of year “what’s going to be big next year” predictions. It is quite another thing when those predictions suck.  Frankly, I don’t blame him. I have just shut down any page or article I have seen with that kind of blather.  It is far more fun to look at last years predictions and realize how wrong they were.  But Mike, if I am not mistaken, I have seen you make your share of predictions as well. And for the record not all of them were so good.

Next he takes a totally unprovoked swipe (well not a swipe, more like a left hook) at Dan Kaminsky.  Yeah, Dan is full of himself a bit, but he is pretty defenseless in this case.  I know your Mom taught you better then to pick on people.  While we are on the topic of picking on people, Mike also pokes Santa (that’s Michael Santarcangelo, not the guy up in the North Pole) for having a mobile home and wanting IT folks to develop a culture of compliance (for the record I thought it was a bad idea too. The culture of compliance, not the mobile home). 

Mike also goes after the Cisco blogger on Network World. OK, I will give him that. I don’t like that guy either. Next Imperva gets Mike’s Captain Obvious award and Russ Cooper is accused of skipping the egg nog and going straight to the heroin.

Mike finishes on a bright note though. He loves the idea that NSS kicked some IPS vendors in the nuts in their report (so did I) but can’t help himself by taking a swipe at Kevin Tolly and Tolly reports. (Mike I have done this before, expect a note from Kevin asking you to substantiate what exactly you mean there)

Then Grumpy has the balls to tell us to take note of how much we are working during this great holiday season, acknowledge our problems and take a bit of a rest getting ready for 2010?

Mike if you are going caroling next year, I would love to go with you. I can’t carry a tune, but afterwards we could pig out on the Chinese food!  Get in the spirit man!!

Is Vigilar done?

Rumors on Twitter today about Atlanta based security firm Vigilar closing its doors.  I tried to confirm but found out nothing determinative one way or another. It looks like nothing has been updated on the web site since this summer.  A call to the company line was answered by the telephone system, but I received the same voice mail message from the PR contact whether I hit the sales extension, PR or service.  Not a good sign for sure.  Usually the sales line will always pick up at most companies.

Anyway, I know AndyIT Guy and Mike Rothman are down that way.  Maybe they can find out what the story is. 

Authors Update: I just received a message from “deep throat” that the Vigilar marketing rep has been soliciting recommendations on LinkedIn. Usually indicative of something going on.  Again, just another brick in the wall, but not definitive.

Authors Update 2: I just had another contact tell me he is a creditor of Vigilar and received a bizarre email that they have shut down the VAR business due to an acquisition falling through. He further reports that all of the VAR/Services people have been laid off.

Usually where there is smoke there is fire.

An Incite-ful Tuesday: Playing catch up

It happens to me every year at this time. I want to enjoy the holidays with the kids. Friends are having parties, lines are long at the stores and it seems like I can never get to everything on my list.  On top of this I am hard at work putting everything together for the new venture. I almost forgot what its like to get the website together, power points, business cards and the thousand other little things in that make it real.  Luckily I have some great folks I am working with and I don’t have to carry the load myself. In the meantime I have like 6 or 7 tabs open on the browser (in Chrome as I am really liking it better than Firefox right now) on topics I want to comment on. So will do a Rothman and lump them together here.

Anyway, I am sure you are all busy with your holiday plans and activities as well.  It may seem like nothing ever gets finished and there is always so much more to do. But take a moment, look around and realize what the season is all about. Be grateful for what you have, it is probably more than most in this world have. Enjoy!

1. US, Russia and UN in SALT-START treaty negotiations on limiting cyberwarfare.  I am old to enough to remember first President Nixon and then many others signing treaties with the former Soviet Union limiting the number of nuclear missiles we had aimed at each other.  I remember always thinking phew, now each side only has enough to destroy the world 20, 10 or even 5 times over.  But bothering me was the fact that it would only take one time to destroy the world. I still remember shelter drills where we would have to either crouch down under our desks or go into the school basement in case we were attacked.  Like hiding under one of those crappy little desks at school was going to save us from a nuclear holocaust! Anyway, I was reminded of all this reading an article in the NY Times detailing that the US has joined the rest of the world, but especially Russia in discussing limiting cyberwar weapons.  My only question is you can supposedly count missiles, how are going to count logic bombs? But I am sure there are smart people working on all of this and will be watching what comes out of it.

2. Security is a people thing! One of the lessons I have certainly learned about security is that you can have the greatest technology in the world. You can have the latest new security gizmos and appliances, layered in one after the next. But if you don’t have the right people in place, empowered with the resources and authority they require, it just don’t mean a thing. Max Huang, CEO of O2Security says the same thing in this opinion piece over at SC Magazine. Good to see a vendor guy coming to the same conclusions.

3. NAC market shrinks to 37m in Q3. Jeff Wilson and his band of Infonetics have put out a new NAC report which I wrote about earlier. In this article in TMC Net they use Jeff’s numbers to report that the NAC market actually shrunk to about 37m last quarter. Of course you need to know what they define as the NAC market. Is it just appliances, is supporting gear included or agents? I think he is talking just appliances. In any event, I think that is widely optimistic. But even giving Jeff the benefit of the doubt, it pales in comparison to the wild numbers that were tossed around a few years ago by the analyst community on where NAC would be now.  But hey they weren’t the only ones wrong about NAC ;-)

4. Raising the barriers to resell your products – FAIL. I never understood this strategy. WatchGuard announced a new MSSP partner program in this report on the MSP mentor. Nothing special really, they are packaging the on premises appliances and remote management to the MSP partners to offer a turn key managed service for them to go to market with. Fortinet and others do the same thing.  But what Watchguard is saying is their special sauce is “is their 4-part certification process to become a partner, according to Chris McKie, director, global analysis and public relations, WatchGuard.” They are going to make partners go through 2 levels of technical certification. There sales teams have to be of a certain size and quality and WatchGuard’s support team has to approve the partner as well. 

I understand raising the bar and having skin in the game. But if you make it too hard for people to resell your products, guess what? That’s right, they won’t resell your products. I am not advocating that you have a Cisco situation with resellers cutting each others throats for a point or two, but when you are WatchGuard I would think you want to broaden the channel.

Anyway, that is it for today. I have a podcast scheduled for tonight with Mitchell and whole list of other stuff I have to get on to. Have a great day!

The Alan and Mitchell Podcast - Who is that masked man? Mike Rothman!

Hi-Yo Silver, Away! The Lone Ranger rides again. Well in this case the only thing silver may be his hair. But at least he has his hair, which is more than I can say.  Mitchell and I are happy to be joined this week by our old friend and once again chief Security Inciter, Mike Rothman.   It is always a pleasure to have Mike on and he is never at a shortage of things to say.

Mike, Mitchell and I discuss post-vendor puke life for all three of us. What’s next for us? Well you will have to listen to the show to know. Of course a podcast with the three of us would not be complete without ragging on some security issues. So we discuss the recent lawsuit against the POS provider for capturing and storing mag data from credit cards. Did IBM overpay for Guardium? Is the new “black screen of death” a hoax or has someone gamed Microsoft’s patch process?  Finally, what drives so many powerful, successful men to think they can get away with anything and do stupid things ala “Cheetah” Woods?

Anyway, always good to have Mike on the show and we will have him on again soon!

The Alan & Mitchell Podcast - Who is that masked man?

Alan & Mitchell's Podcast

Related articles by Zemanta

• Vista 7 Hit by Black Screens of Death, Bill Gates Subpoenaed over Red Rings of Death (boycottnovell.com)

SSAATY Podcast: PCI Wireless with an all star cast

Please join me in this new series of podcasts in the StillSecure, After all these years series. I am hosting these myself and inviting some of my friends in the industry.  In today’s episode I am joined by my friends JJ (Jennifer Jabbusch) of securityuncorked blog and CAD, Inc., Mike Rothman (not grumpy no more) of security incite and eIQ Networks and Dominick Genzano of STI Group. We talk about the recent guidelines issued on wireless networks and PCI compliance.  It is a good discussion that strikes a decent balance between technical aspects of compliance and business drivers. I hope you will find it interesting and helpful!

If you have any questions or suggestions for the podcast you can write me at podcast@stillsecure.com. 

Enjoy!

PCI Wireless with an all star cast

StillSecure, After All These Years Podcast

Related articles by Zemanta

• In search of Unicorns (stillsecureafteralltheseyears.com)
• 4 Years After TJX Hack, Payment Industry Sets Security Standards (wired.com)
• Detect And Screen Wireless Network Activity (techie-buzz.com)

Shimel’s Inciteful Thursday

So despite his promises to the contrary, my bud Mike Rothman has been a blogging MIA pretty much since RSA. Hey I am sure he has a good reason, like some journey for self-awareness or something that is keeping him away.  Not even a Social Security Blogger award could get his juices flowing again.  So in Mike’s absence I am going to do another in my incite series with a bunch of short stories and even shorter commentaries.

Truth be told, I had too many things to write about today, so I blamed it on Rothman!

Have a great day.

1. InfoExpress does a press release on managed NAC – Last night I banged on InfoExpress for claiming a managed NAC service as reported by Tim Greene. It just didn’t sound like a managed service to me.  Well not sure if Tim jumped the gun or not, but today IE put out a press release on their service (though they still have nothing about it on the web site). To be fair the press release talks about more management of NAC than Tim’s article did.  But here is a bit of advice for the InfoExpress PR team: If you are going to have customer quotes in a press release, it may be worthwhile giving their name and title.  Just having quotes attributed to anonymous customers is a bit unbelievable. Something I would expect from NAC used car salesmen.

2. Mystery Virus plagues FBI and US Marshalls – It seems that a mystery computer virus (no not swine related) has hit both the non-classified FBI network and the US Marshalls network.  The FBI had to take down their network from the Internet, but it has now been reconnected. The US Marshalls service reportedly had 140 machines hit with the virus. They had to be taken down and are being disinfected as you read this.  I don’t have any more information on this, but there are rumors of a one-armed man being seen in the vicinity.  Where is Tommy Lee Jones when you need him?

3. Microsoft puts the heat on security vendors – Looks like my friend Charlotte Dunlap has herself a regular gig over at Forbes writing an infosecurity column sponsored by Juniper.  This time Charlotte writes about Microsoft rolling out a hosted email security solution as part of Stirling-Forefront. Charlotte is right on when she says that Microsoft clearly has Symantec and McAfee in their sights with Forefront.  I have written about this before as well. Go ahead and make fun all you want, Microsoft is serious about this and will keep at it till they get it right.  Of course I love the fact that they are partnering with forward looking security vendors (like StillSecure) and think there is a real opportunity to shake up the security world here.

4. How much work can you do on an iPhone?  Earlier this week I wrote about an iPhone being a Prius to Blackberry being Pinto (hey not my words, but some other author). In continuation of that story, Galen Gruman writes about using an iPhone instead of a laptop for a few weeks. I don’t know but I find it near impossible to write more than a sentence or two with my iPhone. Maybe my fingers are too fat or I just don’t have good hand to eye coordination, but I find it painful compared to my old HTC Windows Mobile phone to type longer then that.

Anyway, that is a wrap on this incite.  Good day to you Mike Rothman, no matter where you are!

Report from RSA

So I have made the annual pilgrimage to the city by the bay for RSA.  As usual I got in late Sunday night in order to be at the Americas Growth Capital Conference on Monday.  This was the 5th AGC Conference. It has become a must attend event for many CEOs and other C level execs in the security industry.  Uncle Art of RSA delivered the keynote. Based upon his previous keynotes, I am surprised there was more than 3 or 4 companies there to listen to him, as we were all supposed to disappear.  Anyway his talk focused on DLP, GRC and encryption. Hey, when you are a nail, . . .

Anyway, the Qualys party was decent enough, very similar to last year. Tonight I will be a the SC Mag awards show.  If you are here at RSA stop by the StillSecure booth and say hello!

In other news:

1. What would you pay to put perhaps your biggest competitor out of business? If you are Oracle, about 7.4 billion. Hey and you get Java to boot!  Not sure what else they get though. Not sure of the future of Solaris or Sparc.  But Larry now has added another Silicon Valley legend to the stable.  What does the future hold for MySQL?  Will they just kill it? We will have to wait and see.

2. While we are discussing M&A, Lumension bought Securityworks and Symantec bought Mi5. Ok, seems like your average deals, but I bet the Mi5 folks are a lot happier with Symantec stock then the Securityworks guys are with Lumension.

3. Cloud and GRC – So far those are my votes for this years RSA buzzwords. They seem to be all over the place. Oh and DLP becoming real this year. That sounds like a familiar tune!

4. Shameless plug. If you are here at RSA be sure to join Mike Rothman, Rich Mogul, Michael Farnum, Mike Murray and I Thursday morning for a panel on good security in tough times. Catch it if you can!

Have a great day!

Have you seen this man?

Where is Mike? I know he is around, I have spoken to him, but he said he was in an undisclosed location. Is he on the lamb? Will he truly in fact be at RSA? Has he been working on his next book? I don’t know but his blog is looking for him. If you spot Mike please tell him to drop us all a note once in a while!