StillSecure, After All These Years

I'm shocked, shocked to find out that gambling is going on here

Dialogue from Casablanca:

Rick: How can you close me up? On what grounds?
Captain Renault: I'm shocked, shocked to find that gambling is going on in here!
[a croupier hands Renault a pile of money]
Croupier: Your winnings, sir.
Captain Renault: [sotto voce] Oh, thank you very much.
[aloud]
Captain Renault: Everybody out at once!

Pretty much sums what I was reminded of when reading about Symantec's "revelation" that the market for stolen data was in the hundreds of millions of dollars. Did Big Yellow think people were just doing this for kicks and giggles?

Round up the usual suspects.

Is security so boring that vendors have to resort to gimmicks?

OK, I was never a big fan of the Wall Street Journal.  I know some people consider it the bible of the business world, but personally I was more of a NY Times as the official word. nevertheless I respected what the Journal had to say. Since the WSJ was recently sold, I had serious misgivings that it would retain its objectivity. My friend Dr. Stanley Feld in discussing their recent writing on healthcare insurance coverage calls their objectivity into question.

All in all though, an article I read today is I have to admit right on.  The article says that tech security companies are resorting to gimmicks to get people aware and moving on security issues.  They give a few examples.  F-Secure calling for an international cyber-security police force, Panda making a connection between cyber attacks and stock market crash and the most gimmicky of all, McAfee appointing a chief cyber security Mom.  That's right a mother.

Agree or disagree with the gimmicks. You have to ask yourself why.  With all that we read and see about data breaches, with all of these compliance regulations and rules around, why can't people take security seriously enough? Here is one mans opinion.  Security is a bad news generator of an industry.  We focus on what happens when things go wrong. We focus on adding to the process.  We don't focus on the positive and the profitable.  There is enough bad news in the world for people to focus on right now.  They don't want the bad news that security makes them confront.  If we can figure out how to make security a way of bringing a message of good news, we wouldn't need to resort to gimmicks.

On Black Monday, security vendors are not immune

I don't have to tell you what a miserable day it has been on Wall St.  It is downright depressing.  One thing that has me even more worried is that with the past financial turmoil, IT security has remained solid.  The thought that organizations would do without security was just too radical to contemplate. In today's sell off though, information security has not been immune.  According to this article in Forbes, all software is down but information security companies are taking more than their full share of the hit. 

Now that doesn't mean that we are already seeing a slow down of spending on security.  But what it does mean is that the people buying stocks, whether they be smart or stupid, are thinking that our economic climate is going to effect the ability of these companies to execute on their plans and that means selling security solutions.  This is a problem.

I think we are past the time of quick fixes here.  We are going to have to take our medicine like it or not. As I have said before though in the long term it may be a good thing for security vendors. 

Are vendors holding back IT security progress?

I just read an article by Phil Muncaster in computing.co.uk.  It details a keynote speech by Neil MacDonald,VP of Gartner research at this weeks Gartner Security Summit 2008. I was not at this event, so can't report first hand on it, but taking Phil's article at face value, it seems that Neil was blaming security vendors for security professionals not being able to keep pace with the changing face of security threats.  Too me this is like blaming Smith & Wesson for not making better guns for police officers.  The fact that the bad guys are doing bad things somehow doesn't enter the equation.  IT security progress is being held back because the threats we are facing are growing more complex and sophisticated!  Lets not confuse the people trying to help with the solution with the people causing the problem.

On top of this, there are a lot of security vendor products out here that are not being used. I have yet to speak to an IT security professional who has the budget to get all of the security tools, training and services they need.  Overall the security industry is constantly trying to make 30 cents out of a quarter.  In an environment where the bad guys are making lots of money, resource starved security professionals are waging this war with one hand tied behind their back.  It is not a lack of security tools, it is a lack of resources and money to buy and deploy them. Don't underestimate the deploy them part of it.  How many times have we seen hard won budget dollars spent buying security products

That is not to say that security vendors are without blame.  Security products are too hard to use, don't play nicely with each other and we don't do a good job of arming security professionals with compelling value propositions to sell the solutions up the chain.

Related articles by Zemanta

• Vendors in the dock over slow IT security progress
• CSOs urged to dispel security myths

ISS 2 years after

Niel Roiter over at Techtarget has a good article up on what has become of ISS as it approaches 2 years under the rule of Big Blue.  Of course Mitchell and I had Tom Noonan on just a few weeks ago and as we spoke about, Tom is no longer at IBM/ISS. At the time of the ISS acquistion, speculation was rampant over whether IBM would continue the ISS product line or instead concentrate on the services side of the ISS business, which represented the majority of the revenue actually.

Coinciding with the 2 year anniversary, IBM/ISS actually released a slew of new/updated products:

• A new release of its unified threat management (UTM) tailored for small business, including, for the first time, an SSL VPN.
• A virtual appliance version of its network intrusion prevention system (IPS).
• An update to its network enterprise vulnerability scanner.
• An IPS controller, effectively a load-balancer to aggregate IPS appliances to achieve a greater throughput of up to 10 Gbps.
• A new release of Proventia Management SiteProtector, IBM's security management console.

So at first blush it seems that ISS/IBM is still very much concentrated on products.  It took 2 years to find their way within the IBM universe but are getting back to business.  But as Neil points out, a closer look at the new releases show two trends:

1. IBM/ISS is moving down to the SMB/SME market.  Clearly making products easier and better suited to a smaller customer was a driving force here.

2. MSSP or SaaS is the holy grail for them.  All of these products are being made to work together and be managed by a central outsourced MSSP.  IBM, like many others sees the security market for the mid-market moving to a managed model.  IBM wants to move down stream from managing not only the largest networks in the world, but managing every network in the world. 

Network management is more than just security, but security will play an in important role in it.  We are going to see IBM, HP, Verizon, etc. increasingly coming down into the SMB/SME market to offer to manage IT environments for customers. Historically this has always been like herding cats.  The question is, what will make it different this time?

 

 

Related articles by Zemanta

• IBM targets SMBs with security upgrades
• IBM and Tata Communications Dig Into Managed Security Services
• Security Products: Suites vs. Best-of-Breed

Fortinet adds to the chemistry with Secure Elements

Fortinet has been making noise about moving beyond the UTM space for some time. Today they took a very tangible step in that direction with the announcement that they have acquired Secure Elements. For those of you not familiar with Secure Elements, they were a DC-area based vulnerability management solutions provider. Their C5 platform started out as a run of the mill vulnerability scanning tool. I think they used the Nessus scanner and than started importing other scanner data.  Over time they morphed more to configuration management solution.

Secure Elements was virtually unknown outside of the Federal Government space.  I would bet 90+% of their customer base was in the Fed space.  They were one of the leaders in the FDCC and S-CAP requirements that NIST recently put out.  Their founders and pedigree had a long history of working in friendly confines of the DC Beltway. 

Fortinet on the other hand, while trying hard did not have a ton of success in the Federal space.  Is the fact that much of their development and design happens in Asia and China specifically represent a reason for this? Perhaps it did. Also beyond UTM what technology did they have. They recently announced an endpoint based agent for security that sounded suspiciously like a McAfee or Symantec type of play.  They had been making noises around doing vulnerability scanning and management as well.  Now the other shoe drops and we see where that comes from.

So what is Fortinet's end game.  Well certainly if the public markets were not in the sad state they are in, they would be a good candidate for an IPO. But beyond financial goals, what do they want to be when they grow up?  I think it is becoming clear.  They want to take on Symantec, McAfee, Checkpoint and others as providers of a full spectrum of security solutions. They want to use their base as an ASIC based UTM and move to the endpoint and beyond.  With the kinds of units they sell in UTM they certainly have the revenue to fund it.

My final question is:  How long until Fortinet offers a NAC solution?  If they are interested I know a company that is pretty good at OEM'ing their NAC solution to others.  You know how to reach me ;-)

Related articles by Zemanta

• Fortinet toasts sales success

Wall Street bailout - Do we need it?

Writing this one on the plane, where I just watched President Bush address the American people on why the Wall Street bailout plan is necessary.  I think that the President actually did a good job of explaining how we got in this mess, what the consequences are of doing nothing are and even a decent job of explaining what his plan will try to do.  He also was very clear about the fact that he is willing to accept changes to the plan suggested by a bi-partisan Congress.  All of this is good but frankly scares the hell out of me! Things must be truly bad to bring about such a coalition as we have forming here.  In that case I hope that what they have to do, they do quickly and smartly.

With everyone suspending everything to see this crisis through and put their 2 cents in, I wanted to put mine in too. For my part I would like to see something in the oversight of the financial industry that says all of these financial institutions must do something about information security and data protection.  Personally I think requiring intrusion detection/prevention, vulnerability management and network access control (especially if they all work together) for each each of these companies should be part of the package.  Of course if they do require that, I demand that they have no limits on the compensation paid to security company executives ;-)

Related articles by Zemanta

• Bush to speak on bail-out debate
• Will U.S really face financial armageddon without bailout?

McAfee takes Secure Computing out

McAfee wants to make sure it remains the biggest "pure play" security vendor.  One of the larger public pure play's in security, Secure Computing is the latest competitor that McAfee is taking off the board.  They have agreed to buy Secure for $5.75 a share.  This is quite a premium over the 3.50 to 4.50 range that Secure has been trading in prior to the deal.  For me though the Secure stock price was not indicative of Secure's true value.  I think it was much less. 

I think Secure Computing never really recovered from its acquisition of CyberGuard.  It never really hit its stride and made the expected for progress after that deal.  Yes it continued to acquire businesses, but mostly these were bottom feeding type of deals and didn't add a lot of quality to the mix.  Secure's most recent acquisition of Securify was a perfect example.  They bought a stagnant growth company doing about 12 million for 15 million, but what to do with it?  It seemed that they were just looking to pile up revenue with no real thought to how these all fit together. 

In any event, now it is McAfee's problem.  I like Secure's firewall product line and I think that is something McAfee does not have.  As for the rest of the portfolio, it remains to be seen what if any value McAfee will find in it.  In the meantime, security consolidation marches on.

Related articles by Zemanta

• Aladdin conjures SafeWord from its lamp
• Secure defends choice for singular distribution

StillSecure, After all these years, Podcast 57 - Thomas Noonan

Mitchell and I were lucky to have security industry pioneer and legend, Thomas Noonan as our guest for episode 57.  In case you don't know, Tom was the co-founder and CEO of Internet Security Systems (ISS) and than managed that division after its acquisition by IBM.  Well Tom has taken an "early retirement" from his IBM gig.  But don't look for Tom to be playing tennis or golf at some retirement village here in Florida. He is already looking at places and technologies that get his juices flowing and interest him.  One of those is Rohati.  I have written about Rohati before.  Their technology is tackling a problem where others have not treked before.  Thomas is now a member of their advisory board, but I would not rule out a bigger role for him with the company in the future.

Mitchell and I give Tom a chance to talk about his long strange trip in helping invent the security industry and what he sees as the future for himself and our industry. It is a good 35 minutes of insight from a true security original.  I hope you enjoy it. 

You may notice that the podcast is longer than 35 minutes though.  That is because after the interview, Mitchell and I do our usual shtick about what is going on in the industry.  We talk about acquisition rumors, virtual security (or what passes for it nowadays) and Apple - love' um, hate' um or leave' um. 

If you like the content of these shows or have any other comments or questions, please drop us a line at podcast@stillsecure.com 

Thanks to Pod0matic for hosting our podcast. Tonight's music is the usual, To the Summit by Jon Schmidt. You can hear more from Jon at http://www.jonschmidt.com. Music transitions between segments are by our own Mitchell Ashley! 

Enjoy the podcast! 

Send to Friends | Leave a Comment | Download | Permalink

Do we need a farm system in the security industry?

Just read a good article by Lisa Vaas on Computerworld titles "When security staffers fail up". The article talks about some of the challenges that are faced by companies trying to provide proper security. While one of the issues is "bundled badness" which I will talk about later, the bigger problem that Lisa writes about is the profile of our security administrators. It is a familiar story I am afraid. Security people don't do a good job of "humanizing" themselves. Their peers don't understand what they are trying to accomplish and too often we speak in geek terms and try to dictate how people conduct business. As a result we are the "people in the way".

The next thing Lisa hits on is the obsession with certifications. Too many people think having a CISSP is the be all and end all of security. First of all, you can't hire enough of them and many of them don't have the practical business experience to take it to the next level. Than there is the security "prima donna". They just think they are smarter than everyone else and too many tasks are below them as to elementary. We have all met these types before as well.

Quickly on the "bundled badness" thing. Lisa rightfully points out that in spite of Mike Rothman's feelings to the contrary, though CIO and CFO types like to buy the bundle and get the jack of all trades suite cheaper than buying best of breeds individually, at the end of the day it is hurting our security. If you are really serious about securing the environment there is a world of difference between buying the bundle of goodness versus best in class tools.

Ultimately though, what are we to do about getting better security pros in the workplace? Do we need to change the certification process? Should companies have a different profile of who they hire for security positions. Do we need to develop some sort of farm system where security pros can cut their teeth and learn their craft, like the guilds and apprentices of yesteryear? The construction industry used to work like that. Maybe we should consider it too?