The Ashimmy Blog

Don’t Forget To Vote

Just wanted to put out a reminder that there are less than two weeks left for voting in this years Social Security Blogger Awards. You can vote here:http://www.zoomerang.com/Survey/WEB22BQFS9A3BN/.

Remember you must leave a verifiable email address and blog address in order for your vote to count. From what I am told, our votes this year have already exceed the total number of votes last year. But make your choices known.

Here are the finalists:

Best Corporate Security Blog

• Veracode ZeroDay Labs (http://www.veracode.com/blog/)
• Fortinet - http://blog.fortinet.com/
• Symantec Connect (http://www.symantec.com/connect/)
• Gunter Ollmann/Damballa Research http://blog.damballa.com/
• Arbor Networks http://asert.arbornetworks.com/

Best Security podcast

• Pauldotcom http://www.pauldotcom.com/
• Southern Fried Security http://www.southernfriedsecurity.com/
• CERTS Podcast Series http://www.cert.org/podcast/
• The Silver Bullet Security Podcast http://www.cigital.com/silverbullet/

Most educational security blog

• Jeremiah Grossman (http://jeremiahgrossman.blogspot.com/)
• Chris Hoff – Rational Survivability (http://www.rationalsurvivability.com/blog/)
• Jon Oltsik, Enterprise Strategy Group http://www.enterprisestrategygroup.com/category/our-team/analysts/jon-oltsik/
• Naked Security/Sophos http://nakedsecurity.sophos.com/
• Evil Bytes /John Sawyer http://www.darkreading.com/blog/archives/evil-bytes/index.html

Most entertaining security blog

• Naked Security  http://nakedsecurity.sophos.com/
• View from the Bunker  http://viewfromthebunker.com/
• Uncommon Sense Security/Jack Daniels http://blog.uncommonsensesecurity.com/
• Securosis Blog/Insights/ Mike Rothman http://securosis.com/blog

Security Blog that best represents the industry

• Threat Post http://www.threatpost.com
• Krebs on Security http://www.krebsonsecurity.com
• CSO Online Blog http://blogs.csoonline.com/
• Threat Level (Wired) http://blogs.csoonline.com/
• Schneier On Security http://www.schneier.com/

The single best security blog post of the year

• The Death of Security as We Know It (http://techbuddha.wordpress.com/2010/11/16/2011-the-death-of-security-as-we-know-it-or-operationalizing-security/)
• CyberSecurity and National Policy by Dan Geer (http://www.harvardnsj.com/2010/04/cybersecurity-and-national-policy/)
• Ralph Langner, Langner Communications series on Stuxnet http://www.langner.com/en/2010/12/09/our-stuxnet-timeline/
• “SecurityBSides Turned Me into an Adult” by Michelle Klinger, from her Fear Not the Assessor bloghttp://topheavysecurity.com/2010/12/13/securitybsides-turned-me-into-an-adult/
• Brian Krebs (krebsonsecurity) Sept. 30, 2010 “U.S. charges 37 alleged money mules” http://krebsonsecurity.com/2010/09/u-s-charges-37-alleged-money-mules/
• “How to Become an Information Security Thought Leader by Chris Eng  http://www.xtranormal.com/watch/7897173)

This may be our strongest slate of finalists ever. Every single nominee is a strong contender. I am sure the races will be close, so every vote counts.  Don’t wait vote now!

Related articles

• Security Blogger Network Social Security Awards Voting has Begun! (securityheavy.com)
• And the winners are .. (ashimmy.com)
• Mike Rothman of Securosis on Dell buying Secureworks (securecloudreview.com)
• Social Security Awards (andyitguy.com)

And the winners are …..

It is that time of year again! Starting today voting is open for the 3rd annual Social Security Blogger Awards.  You can vote at http://www.zoomerang.com/Survey/WEB22BQFS9A3BN/. Be warned that you must leave a verifiable email and blog address in order for your vote to count. Of course the winners will be announced at the Security Bloggers Meet up at the RSA Conference next month.

Before I announce the finalists, I want to give a special thanks to our all star panel of celebrity judges:

1. Bill Brenner of CSOOnline

2. Ellen Messmer of Network World

3. Kelly Jackson-Higgins of Dark Reading

4. Larry Walsh of Channelnomics

Without further delay I am very pleased to announce the finalists for the 3rd Annual Social Security Blogger Awards:

Best Corporate Security Blog

• Veracode ZeroDay Labs (http://www.veracode.com/blog/)
• Fortinet - http://blog.fortinet.com/
• Symantec Connect (http://www.symantec.com/connect/)
• Gunter Ollmann/Damballa Research http://blog.damballa.com/ 
• Arbor Networks http://asert.arbornetworks.com/

Best Security podcast 

• Pauldotcom http://www.pauldotcom.com/ 
• Southern Fried Security http://www.southernfriedsecurity.com/ 
• CERTS Podcast Series http://www.cert.org/podcast/ 
• The Silver Bullet Security Podcast http://www.cigital.com/silverbullet/

Most educational security blog

• Jeremiah Grossman (http://jeremiahgrossman.blogspot.com/)
• Chris Hoff – Rational Survivability (http://www.rationalsurvivability.com/blog/)
• Jon Oltsik, Enterprise Strategy Group http://www.enterprisestrategygroup.com/category/our-team/analysts/jon-oltsik/ 
• Naked Security/Sophos http://nakedsecurity.sophos.com/ 
• Evil Bytes /John Sawyer http://www.darkreading.com/blog/archives/evil-bytes/index.html

Most entertaining security blog 

• Naked Security  http://nakedsecurity.sophos.com/
• View from the Bunker  http://viewfromthebunker.com/
• Uncommon Sense Security/Jack Daniels http://blog.uncommonsensesecurity.com/
• Securosis Blog/Insights/ Mike Rothman http://securosis.com/blog

Security Blog that best represents the industry

• Threat Post http://www.threatpost.com
• Krebs on Security http://www.krebsonsecurity.com
• CSO Online Blog http://blogs.csoonline.com/
• Threat Level (Wired) http://blogs.csoonline.com/ 
• Schneier On Security http://www.schneier.com/

The single best security blog post of the year

• The Death of Security as We Know It (http://techbuddha.wordpress.com/2010/11/16/2011-the-death-of-security-as-we-know-it-or-operationalizing-security/)
• CyberSecurity and National Policy by Dan Geer (http://www.harvardnsj.com/2010/04/cybersecurity-and-national-policy/)
• Ralph Langner, Langner Communications series on Stuxnet http://www.langner.com/en/2010/12/09/our-stuxnet-timeline/ 
• “SecurityBSides Turned Me into an Adult” by Michelle Klinger, from her Fear Not the Assessor blog http://topheavysecurity.com/2010/12/13/securitybsides-turned-me-into-an-adult/ 
• Brian Krebs (krebsonsecurity) Sept. 30, 2010 “U.S. charges 37 alleged money mules” http://krebsonsecurity.com/2010/09/u-s-charges-37-alleged-money-mules/ 
• “How to Become an Information Security Thought Leader by Chris Eng  http://www.xtranormal.com/watch/7897173)

Every single one of these blogs is already a winner having been selected by our blue ribbon panel of judges. Voting closes at the end of the month, so please don’t wait to vote!

Security Blogger Meet-up at RSA

Hey guys I know the security blogging has been a bit slow lately, but this time of year usually sees a pick up. Also have lots of new members join the SBN, so fresh content and fresh perspectives.  In the meantime, it is that time of year again.  RSA Conference is just a few short months away. That means it is almost time for the annual security bloggers meet up!

This years events promises to be bigger and better than ever.  We have changed the location to a very cool place. Can’t tell you more than that right now of course. Also our sponsors are all locked and loaded, so everything is set.  The first wave of invites will be going out soon. 

How do you get an invite?  Jennifer Leggio has an an excellent post up on the security bloggers meet up blog over at RSA Conference’s site. The post gives you 5 hot tips on how to score an invite to this exclusive invite only, blogger/podcaster only bash.  Over the past years, the security blogger event is one of the most sort after, hottest parties at RSA. So don’t miss out on getting your invite if you are eligible. BTW, all SBN members are invited. If you are in the SBN and don’t get an invite, let me know.

Also again at this years meet up, we will hold the 3rd annual Social Security Bloggers Awards. Each year the sort after awards are growing bigger and bigger. This years categories are:

Best Corporate Security Blog

Best Security Podcast

Most educational security blog

Most entertaining security blog

Security Blog that best represents the industry

The single best security blog post of the year

Sounds pretty good right? Our blue ribbon panel of security judges are already mulling over who the finalists will be. I don’t want to announce the judges just yet, as we don’t anyone trying to  scurry favor with them. 

We will announce the finalists around the first of the year. Then all SBN members will be eligible to vote for your winners.  We are looking forward to a really great lineup of finalists and some tough choices to vote for.

If you blog on security, we are looking forward to seeing you at the RSA security blogger meet up.

Related articles

• Social Business welcomes Rich Harris: father, artist, web ninja (zdnet.com)

Go to Hacker Halted and get an iPad for sure!

I was going to Hacker Halted in Miami October 13th and 14th. The Security Bloggers Network is going to be a media partner/sponsor.  I just received this from the show folks today.  Sounds like a great deal.  A great conference and an iPad!

Make plans now to attend the fifteenth annual Hacker Halted information security event - October 9-15 in Miami. The format includes a 4-day training Academy, followed by a 2-day conference on October 13-14 and 1-day of free Training (October 15) for all registrants. The two-day Conference features a comprehensive program presented in three tracks.
Register for the 2-day conference by August 31 and receive a FREE iPad onsite. No tricks or anything else to purchase.
Readers of this message may also receive a $100 discount off the 2-day conference fees - pay just $1,199 instead of $1,299 which includes the free iPad - by registering with the code HHQZM3 on the electronic registration page at www.hackerhalted.com  You MUST register by August 31 when this offer and discount code will expire.

Hope to see you there!

AppSec USA 2010, September 7 to 10 at the University of California at Irvine

My friend Richard Greenberg of the Los Angeles County Department of Public Health and co-chair of the organizing committee for AppSec USA 2010 has asked me to pass along the following info:

Open Web Application Security Project (OWASP) announces AppSec USA 2010, the premiere web application security conference in North America

Los Angeles, California - July 9, 2010 - Open Web Application Security Project (OWASP) announces AppSec USA, which will be held from September 7 to 10 at the University of California at Irvine.

The conference consists of two days of in-depth training classes on September 7 and 8, followed by two days of plenary sessions on September 9 and 10. BOF (Birds of Feathers) sessions and panel discussions round out the conference offerings.

Jeff Williams, keynote speaker and Chairman of the OWASP Foundation notes, "Software is simultaneously getting radically more critical, complex, and interconnected. This creates a perfect storm for attackers, who are having a field day with our systems. We will never hack our way secure. Instead, we need to change the way we think about software, build software, and buy software. OWASP's audacious goal is to reach all developers everywhere and help them build rugged code - because our future depends on it".

Williams continues, "I've attended many OWASP AppSec Conferences, and they truly bring together the leading researchers, innovators, and community leaders to focus on application security in a free and open noncommercial forum. There's a fantastic sense of community and shared purpose. We encourage anyone interested in secure code to come and find out what application security is all about. Our 501(c)(3) not-for-profit status allows us to keep prices extremely low".

Another keynote speaker, Bill Cheswick, is a well known security researcher with AT&T Research; his very popular book Firewalls and Internet Security has influenced many security practitioners.

The third keynote speaker, David Rice, is an internationally recognized information security professional. Mr. Rice , author of the highly acclaimed book, Geekonomics, which promotes awareness of the true cost of insecure software, made significant contributions to advance the security of our nation's critical infrastructure.

HD Moore, the final keynote speaker, is widely acclaimed for his creativity and technical skills, and brings a distinct perspective to AppSec. Mr. Moore's best known contribution to the security community is the Metasploit Project, an open-source project which can be used to find vulnerabilities in computer systems in order to protect or exploit them.

Irvine, located in Southern California, is beautiful year-round and the UC Irvine campus offers famous architecture, a large park, art, and modern facilities in a pleasant environment. Irvine is situated in the heart of Orange County and is next door to Los Angeles, San Diego, and many other attractions.

Richard Greenberg, Co-Chair of Conference Organizing Committee, says, "If you can only get away from the office for one conference, this is it. We all are aware of the insidious exploits taking advantage of all types of application security vulnerabilities".

Greenberg continues, "We need to learn from the experts in order to counter the attacks - to build solid and secure applications. The knowledge we pride ourselves of amassing is insufficient to meet the new evolving threats. Only by sharing our collective wisdom and experiences can we realistically expect to protect our assets".

The conference is still soliciting sponsors of different levels.

For more information on sponsorship, or to register, please visit http://www.AppSecUSA.org or contact Kate Hartmann at kate.hartmann@owasp.org.

Sounds like a great conference. If you can make it, you should check it out!

I want to go to VMWorld and need your vote

OK, here is the deal, plain and simple:

My friend Edward Haletky of the Virtualization Practice has asked me to appear on a panel at VMWorld in San Fran, late August.  The panel is on Compliance Challenges within IaaS. The abstract is:

"Compliance within the Cloud is just starting to be discussed, Get in on the ground floor with a discussion featuring industry, government, and compliance bodies. We will discuss the current and future directions of Compliance within IaaS as well as cost-effective guidance for implementation. "

The way VMWorld is doing things this year, if you register with VMWorld you vote for which tracks you would like to see. So if you would take a moment and vote for Compliance Challenges within IaaS I would be eternally grateful.

Take not that there are lots of great panels to vote for. My name is not mentioned on this one, the moderator is Peter Mell of NIST.  Please vote if you can. Also my friend Ed is up for a few more panels, if you can vote for more than one, vote for Ed too. He is a walking dictionary on VMware and virtual security and literally wrote the book on it.

The wild, wild west of PCI

Sorry for not blogging all week but I have been at the 20th annual ETA (electronic transaction association) conference at the Mandalay Bay Hotel in Las Vegas.  This was my first time attending the ETA show. I was very much looking forward to being at a non-security show of end users who are dealing with PCI everyday.

WOW! What an eye opener on many levels.  First the payment processors and merchant service providers. Even at this late date, they don’t believe the PCI Council is serious about enforcing PCI compliance on Level 3 and Level 4 merchants. After speaking to these people, I am convinced it is going to take the council making a few examples to show them they are truly serious.

Secondly, these same people just don’t see the lower level merchants as any appreciable risk. In spite of the fact that 85% of incidents take place at that level, they just refuse to acknowledge the fact.

Next, they believe that as long as they have a program in place, they have done their part. If the merchants don’t want to participate, so be it. They charge the merchant for the program. They pocket the money. Most of them only pay their PCI partner on completed merchants. The less amount of merchants who actually go through it, the more money the processor puts in his pocket. Risk be damned.

But the processors are not the only ones to blame here. There is a class of vendor who knows absolutely nothing about PCI who are the culprits here. They are offering ASV scanning and help with filling out SAQs for a dollar a merchant.

I spoke to two or three of these vendors. They were software developers who develop reporting software. They knew next to nothing about PCI or information security. They took the PCI council SAQs put them in a report format, cobbled together a scan or made a flat price deal with an ASV and that is it.

I asked them if they had ASV engineers reviewing the scans. They looked at me like I was crazy. One of these companies, DDS says they do this:

• Merchant Services
• Customer Service
• Agent Bank Reporting
• ISO Reporting
• Fraud Monitoring
• Management Reporting

Yet there they were pushing PCI compliance for a dollar a merchant. Sounds like they are security experts right?

Instead of taking the opportunity to reach perhaps the most important members in the payment card food chain, snake oil salesmen are pushing solutions that give a whole new name to checkbox compliance and security.

Faced with this, is it any wonder that PCI has not done enough at the Level 4 merchant level?

RSA beyond the bag

I was speaking to Adrian Lane of Securosis last night about the comment I made on their blog last week. I said, “does anyone expect to see a real live demo on the floor of RSA?”

Is there anything beyond the great bag you get when registering? Yeah, it sure is pocked full of paper, chatchkes, and CDs. Does anyone read that stuff? Do you? What is the real value of RSA to you?

The RSA show is a great event. It truly is where the security industry gathers. But does anyone actually look at demos on the floor anymore. Are we just so used to seeing paid magicians, booth babes (yeah they are here in force this year) and canned power points. Do we really want to see products working here? Hell I am not sure we really see if products are working when we buy them even.

But does that mean RSA is without value? Of course not. It is a great networking event and business development orgy. On top of that, if you don’t show up here people ask why. Did they not have enough money for a booth? Are there other problems there? Many companies spend their precious marketing dollars on the booths, the giveaways and all that is involved in bringing a team here for the show. But would they be better off keeping their powder dry?

The answer is you have to understand what are your goals for attending RSA. Based upon that you need to then figure out what resources are going to be required to achieve those goals. If lead generation is what you are after, frankly there may be more efficient ways of filling the funnel with leads. If branding and “being seen” are goals, there is not a better venue. If channel and partnerships, M&A and business development are on the agenda, RSA may very well be nirvana.

But if you have not figured out what is important before you jump in here, you are probably wasting money and time.  I see and unfortunately have been involved with companies that didn’t learn this lesson. Bringing down bloated amounts of personnel, signing up for a booth beyond their means and needs, just screams mismatch between goals, resources and methods. Don’t make that mistake. Dig in beyond the bag at RSA.

ATT useless in San Francisco

Here at the RSA show. Now I remember why I look forward to this show every year. But have to say that ATT positively sucks here in San Francisco. It is near impossible outside of the Moscone Center to get a phone call to connect. It is even impossible to send a text message.  WTF? 

I am surprised there are not more people really using their iPhone’s as bricks and throwing them right through the window of every ATT store in the city!

Pre-RSA clean up

My bags are packed and getting ready to go. But before I do I wanted to mention a few things:

1.There are still two days to vote for the Social Security Bloggers Awards.  If you blog or podcast go to: http://www.zoomerang.com/Survey/?p=WEB22A8BWJVVAE

2. My schedule is packed for RSA. But I am sure I will wind up with some free time, so if you see me be sure to say hi, but I apologize if I don’t have a lot of time to chat.

3. Will try to blog while I am out in San Fran but with so much on my plate, don’t be surprised if you don’t see anything from me.

I think it is going to be a great RSA show this year. Hope to see you there!

Related articles by Zemanta

• Only one week left to vote for the Social Security Blogger Awards! (ashimmy.com)
• Vote for the Social Security Blogger Awards (ashimmy.com)
• Social Security Blogger Awards 2010 (stillsecureafteralltheseyears.com)
• Security Bloggers Network news (stillsecureafteralltheseyears.com)