StillSecure, After All These Years

Do you need a free vulnerability management solution?

Vulnerability management is still one of the most important things you can do to increase your security posture.  To many people vulnerability management means scanning for vulnerabilities or applying the latest patch Tuesday updates.  Of course there is much more to it than that.  Managing the complete lifecycle of vulnerabilities is the key to successful risk management in this area.  Whether PCI, HIPAA, SOX or just good old fashioned common sense is driving you to do it, vulnerability management is the right thing to do.

This week StillSecure announced the latest addition to our line up of free security tools.  VAM Lite is a freeware edition of our award winning, enterprise class VAM vulnerability management platform.  VAM Lite has most of the features of the full VAM product but is limited to scanning just 100 devices and offers only our basic reporting package.  Because you can only scan 100 devices, it does not support the distributed scanner architecture that full VAM does either. 

If your organization can be scanned with just 100 devices or if you just want to give it a try and if you see the value possibly upgrade to full VAM, download it from our site. It can run on a dedicated server or in a VMware environment as well. 

If you like, try some of the other StillSecure freeware products like Strata Guard Free and Safe Access Lite as well.

Its that time of year again

Hands down the biggest security show of the year is RSA (most fun though is probably Black Hat, but thats Vegas).  One of the highlights of the RSA show for me is going to the SC Magazine Awards show.  It is a nice night, you get dressed up in a tuxedo, drink free and mingle with the industry.  The guys from HayMarket and SC Magazine always do a great job.  On top of this, unlike many other awards for sale, the SC Awards seem to be on the up and up.  Over the years we have won once (Safe Access, best endpoint solution) and made the finals a bunch of times, but either way it is always a good time.

Well though the awards (and the RSA show) have been pushed back to April (they usually are in February) this year, it is that time of year again.  Voting for the SC Magazine Awards has begun!  It seems like they have expanded the categories of Reader Trust Awards this year.  These are the awards you can vote for.  They have another set of awards that are selected by the judges.  Here are the categories for the Readers Trust Awards:

Reader Trust Awards

Best Anti-malware Solution
Best Email Security Solution
Best Instant Messaging Security Solution
Best Web Filtering Solution
Best Intellectual Property Protection
Best Endpoint Security Solution
Best Mobile Device Security Solution
Best Enterprise Firewall
Best Intrusion Detection/Prevention Solution
Best Wireless Security Solution
Best IPsec/SSL VPN
Best Identity Management Solution
Best Multi- and Second-factor solution
Best Integrated Security Solution
Best Managed Security Service
Best Computer Forensics Solution
Best Event Management Solution
Best Policy Management Solution
Best Audit/Vulnerability Assessment Solution
Best Security Software Development Solution
Best Security Company
Rookie Security Company of the Year
Best SME Security Solution
Best Enterprise Security Solution
Best Regulatory Compliance Solution
Best Professional Certification Program
CSO of the Year
Best Security Team
Best Professional Training Program
Editor's Choice Award

All four StillSecure products are nominated.  Safe Access in the endpoint category, Strata Guard in the IDS/IPS, VAM in the vulnerability management and making its debut, Coba in best integrated security solution.  I would love to see all of my readers vote for the StillSecure products, but since many of you work for other vendors nominated, that probably won't be the case.  In any event, if you get a moment go vote for your own choices, but at least vote!

My SLA can beat up your SLA

My buddy Ross Brown (you know I really do consider Ross a buddy, having had a chance to get to know him in person at RSA, but that is another story) has an article up taking a shot at nCircle's 24 hour SLA.  To tell you the truth, I was not aware of nCircle's SLA, but a long dormant brain cell in my head fired up something about me having written on this before.  A Technorati search of my blog turns up that exactly one year ago, Feb 16, 2006, I wrote about last years RSA and some of the SLA's and guarantees that were being offered.  Besides showing that very little in security is ever really new, I thought even back then, that SLAs in security seem to be long on marketing and short on real protection.

For the record, I agree with Ross, I think a 24 hour SLA is nothing to write home about.  We, like eEye and I am going to guess nCircle and most other companies do a good job of getting tests out for the new vulnerabilities (Ross I don't think nCircle is putting out patches, but rather tests to see if the patch is applied or if the vulnerability is present) pretty quickly.  Usually in just a few hours.  However, when you are going to put your money where your mouth is, I think you tend to be conservative. The 24 hour SLA  is not meant to be the normal expectation, but the worse case scenario.  Frankly, if you want to force nCircle to do better, come out with a better SLA, that they will have to match to compete. Let me know when you do and we will look at matching it here.  However, my question is this:  Is anybody buying product based on this SLA?  If the answer is no, who gives a hoot.

Vulnerability Assessment is dead, can I sell you a scanner?

Taking a page from the Richard Stiennon playbook, let me make an outrageous statement/prediction, that if it pans out will result in me being labeled a visionary (yeah right).  I say now that vulnerability assessment as it has existed for the last 5 or 6 years is dead!  I think everyone familiar with the VA market has been pussyfooting around this issue for a while now.  To understand why I say this, you need to take a look at the evolution of the VA market.

When StillSecure first entered the VA market back in 2002, the state of the art was that there were scanners out there that would scan your network for vulnerabilities and give you a report on what was found.  Players such as eEye and ISS sold commercial scanners and the open source Nessus scanner was by many viewed as the equal or superior of them. There was another category of vulnerability assessment that was performed via an agent like NetIQ and Pedestal Software (acquired by Altiris). Essentially, one was network scanner based, the other agent based but doing similar things.  The scanner based versions then matured to include distributed systems that allowed large enterprises to be scanned in a timely manner and centrally managed.

The next step in the evolution of VA occurred when some of the pure scan and report vendors started adding workflow and vulnerability management to the mix.  StillSecure's VAM and Foundstone were early entries in that space.  The next big trend in vulnerability assessment was its integration with other security and network management tools.  Integration with patch management, trouble ticket systems, asset inventory systems, network management, etc. began to integrate vulnerability assessment products into the larger fabric of IT management.  At the same time integrating and correlating vulnerability data with other security technologies also came into vogue.

The next big thing in VA was risk management/compliance (some might say it was all about risk management from the beginning).  Expanded, customized reporting that allowed administrators to manage their risk month to month and generate reports for auditors and geared towards compliance issues were a new way for VA to offer more value.

Over the past year, many have asked what is next for VA.  I think we are seeing the answer.  The answer is VA is morphing into security configuration management.  Ron Gula and the Tenable team have been pushing this with Nessus and their commercial products for a while now.  Now nCircle announces today their Configuration Compliance Manager.  At StillSecure we have had this ability for some time and our newer tests are more geared to this type of test and policies.  Our customized reporting lends itself well to this task. I am sure we will see the rest of the VA pack hopping on this bandwagon soon.

Why is vulnerability management in this torpid state and morphing into configuration management?  There is no easy answer.  First of all, even though it is not growing as fast as it was or is as cutting edge as it was, it is still a widely deployed and used technology and will continue to be so for years to come.  Much as IDS is dead, but alive and well in networks everywhere, vulnerability assessment will continue to live on.  However, it has seemed to loose some of its appeal.  The reasons for this are many.  One is the natural evolution of the security market.  Another is the basic fact that vulnerability assessment and the patch management market it works with is a hamster wheel game, bad news generator.  You scan, you find bad stuff, you fix, you scan again and again and again.  Can you ever get out ahead with that strategy? I think the market is looking to break the cycle and find a more efficient way of dealing with the problem.  In the meantime the security configuration management space is not an end game for VA, just a another step on the road.  The problem with using these tools for security configuration management is they do not have any enforcement or teeth.  Unless combined with some sort of NAC solution (that is where this stuff is really going), configuration scanning is just good for generating reports.  The market will demand action if these products are going to succeed.  Look for that action coming soon. 

At StillSecure we already have this.  We call it the policy driven network and we are implementing it with a large government customer.  This is the future of VA. In the meantime remember you read it here first, VA is dead!

StillSecure scores another Hat Trick

Well SC Magazine has just announced the finalists for their Readers Trust Awards for this year.  The winners will be announced at the SC Magazine award show at the RSA show in February.  I am proud to report that for the second year in a row, all three StillSecure products made the finalists in their respective categories! For endpoint security, the category that Safe Access won for last year, we are in a tough fight with Lockdown Enforcer, Mirage Networks NAC, Senforce ESS and Safend Protector.  Tough competition and it should be interesting!

Now I know some (Rothman) have said, bah humbug to these awards.  In fact, I myself have taken to task some of the awards in the past.  However, my problem with some of them, is that you can buy them, as in the case of the InfoSecurity Products Guide. There you can create your own category and no one else can compete in that category.  Mike points out correctly, that in SC Magazine there is a fee to nominate your product.  But from there it depends on reader voting to make the finals.  My understanding is that once you are in the finals, it then is up to a panel of judges to pick the winners.  I just think it is a much more legit way of doing these things. Hey, if we don't win anything, I may have another opinion ;-)

PCI compliance tools

As Mike Rothman points out, I am a vendor (actually Mike, I just work for a vendor), so I walk a thin line when it comes to competitors products. Make no mistake about it, I am partial to StillSecure products.  However, over the months on this blog I have tried to give credit where credit is due.  On that note, I wanted to talk a little about PCI compliance. Actually we have been doing a lot with all of our products to help our customers to comply with the various PCI standards.  You can read all about it here.  Be sure to check out the matrix that shows how each StillSecure product helps with what specific provisions of the PCI regs. Next week we should be announcing some more news around how we can help with PCI.

To be fair, I want to point out a new service Qualys has come out with aimed at SMB/SME merchants who have to generally perform self-tests for PCI compliance.  Called QualysGuard PCI, it is a pretty slick all-in-one solution for complying with the vulnerability assessment and reporting requirements under PCI for some of the lower volume merchants.  You can see a good flash demo of it here.  Now, while I think there is more to PCI compliance then just vulnerability management, I am happy to see these types of solutions coming to market.  Competition being what it is, it will drive the whole market to go one better and the eventual winner is the end user customer who gets a better product.

The future of Vulnerability Management

Ron Gula of Tenable Network Security hosted a webinar yesterday on the future of vulnerability management.  It was an excellent webinar that really started me thinking on what my own views are regarding the future of vulnerability management.  Many of the observations Ron made were in sync with our own experience here at StillSecure.  We see vulnerability management as undergoing a very profound change in the market and as security vendors it is important that we recognize this to stay current and relevant. 

To understand where the market in vulnerability management is going, I think you have to look at where is has been.  At StillSecure, our VAM product has been in the market since September of 2002.  We have seen many changes in the market since then and like to think that we helped bring many of them about.  So for a moment, lets go back to those dark days right after 9/11/01 when our ideas for VAM were being forumulated (VAM has nothing to do with 9/11, I just remember us working on the idea around that time).  At that time vulnerability management really meant scanning and reporting.  Generally a vulnerability scan was done, usually manually once a year or maybe twice a year.  A report was generated showing all of the vulnerabilities found.  This was usually put into a spread sheet, that someone was then responsible for tracking.  You had to track down and filter out the false positives and see if you could fix the real vulnerabilities.  I always say it was a form of job security, similar to bridge painters.  By the time you got done painting the whole bridge from start to finish, it was time to start painting again.  Same with vulnerability management. By the time you remediated the last vulnerability on the report, it was time to run a vulnerability scan again.

We saw two things that were critical to the process that were missing. One was the automation of network discovery and vulnerability scanning.  The second was a closed loop process to manage the remediation process through discovery to confirmation, repair assignment, verification of repair and reporting.  When VAM came out in Sept. 2002, this was pretty cutting edge.  Most of the competition were just manual scan and report.  Over time much of our competition has caught up and today there are several good VM commercial solutions available.  The next evolutionary step we saw in VM, was integration.  VM is very much an enterprise problem.  As such it does not exist in a vacum and works with and is intrinsically linked to other security and management processes and applications.  Therefore in order to be successful a VM tool has to be able to leverage your existing investments in systems for patch management, trouble ticketing, network management, configuration management, etc.  Again, we came out with this years ago as an enterprise integration framework.  Today, most good VM solutions have published API's and integration into systems such as those above. 

Another key evolutionary step was correlation.  Actually, the folks at Tenable jumped on this one early on. Much of the correlation has to do with correlating vulnerability data with IDS/IPS data or syslog files.  This sort of crossed the line into SEM or SIM territory, but the key for me is what action is taken as a result of the correlation.  Correlation for correlations sake alone is not enough, it must be actionable.  We took a slightly different tack, in that we import vulnerability data directly into our IPS so it can take action accordingly.  Again, today several of the leading VM solutions perform some correlation with IDS/IPS and other systems.

So what is next?  This is why I asked Ron to sit in on his webinar.  I think to a certain extent the VM vendors themselves are asking themselves the same question. A couple of things are apparent.  First of all the reporting function has grown tremendously.  Today reporting is really about risk management. Like our own Security POV module for VAM, reporting-risk managment has to be able to show with historical context how the enterprise is faring with managing the risk of vulnerabilities.  Reporting has to be tailored for compliance issues such as SOX, PCI, FISMA, etc.  Different reports need to be generated for different levels of the organization (CIO, auditors, sys admin, etc.).  Reports have to be generated on the fly and delivered automatically to the relevant parties.  What else is needed?  NAC has certainly influenced VM.  In fact NAC in some ways is real time actionability with VM.  Instead of testing on a pre-determined or random schedule, now devices can be tested whenever they log on (though a NAC policy test is an should be very different than a vulnerability scan).  I think correlation and interoperability  of NAC and VM systems will be become more prevelant.  Expect something from StillSecure soon on this.  Configuration Management is another one.  The scanning and patching game is to some extent like chasing your tail.  You never quite win.  Better to be proactive with configuration management.  Is patching the right way?  With so many vulnerabilities and patches constantly flooding us, is their another way?

We could go on for longer on this and I welcome your comments and thoughts. I do know that we have not seen the final chapter in the evolution of vulnerability management and I am looking forward to what else will come down the road. BTW, Ron is doing a few more webinars on VM.  You can find out about them at the Tenable site.

IBM/ISS, what fits and what doesn't according to Gartner

As I wrote about when I first heard about the IBM/ISS deal, the ISS MSSP and services piece make a lot of sense for IBM. I was less sure about what IBM's intentions were regarding the network security software that ISS develops.  This weekend I saw an usual Google Alert on a first take on the deal from no less than Gartner.  They usually don't give advice out for free to non-customers. Anyway, their take on this is similar to mine. They think the service elements of the acquisition are a nice fit. But that the network security product offerings are "less well-suited to IBM's market approach". They distinguish between host-based offerings like Proventia desktop, which they see combining with Tivoli versus network based stuff like Proventia IPS and Internet Scanner.

So what does this mean?  Depends who you are I guess. If you are a network security vendor like StillSecure who competes with ISS, I would be going after every deal where ISS is involved and mailing this link out. I think the FUD arising out of this Gartner warning will make it very difficult for the ISS sales team over the coming months, at least until the dust settles.  If you are an ISS customer or contemplating buying an ISS network security product, I guess you have to factor in what does the future hold for this product on a go forward basis. If you are an ISS salesperson, I would have the answer to this down pat and hit it head on.  Even so, it will be something they will have to deal with. So it looks like ISS's good news in this acquisition, might translate into good news for competing security vendors as well.  As I said earlier, time will tell.

People in glass houses, ....

Filed under the people in glass houses, shouldn't throw stones banner, comes this tidbit from Brian Krebs at the Washington Post.  It seems a Russian Security blog by Valery Marchuk, http://www.securitylab.ru, has posted a list of sites that have vulnerabilities around cross-site scripting flaws.  These vulnerabilities make it easy for phishers and other hackers to use these URLs in scams to get people to give up their legitimate personal and financial data.  Low and behold among the sites listed is none other than eEye Digital Security.  For those who may not know, eEye is a company that has made their bones by exposing vulnerabilities in other security companies products.  You can read more about it (if you read Russian) here.  I wonder what their Chief Hacking Officer is going to say about this. 

By the way, eEye was not alone, other sites and companies including Verisign, Cisco, Snort.org and even the NSA were listed as being guilty of the above.  Scary stuff!

Who's afraid of the big bad worm (or the death of security as we know it)

Last week saw the "security pundits" ringing the alarms about a major worm attack on its way exploiting MS06-040.  I envisioned the next blaster/slammer wreaking havoc with our networks and computers.  Frankly as evil as it sounds, it's good for business (hey, I'm a vendor), and generally serves to refocus our attention and companies budgets on getting real about security.

After reading stuff like, Mike Murray, director of vulnerability management over at nCircle in an article in Information Week, say, "And no, this isn't an overreaction. We've always said that some day there would be another big, serious vulnerability. "Well, this is the one."  Then having DHS (someone should tell the guys at Information Week that it does not stand for Department of Homeland Defense) issue a US-CERT warning encouraging everyone to patch this.  Microsoft told us to give this one a top priority.  HD Moore made his exploit public showing it could result in a DDOS attack.  Murray over at nCircle further said, "It's only a matter of time or luck before this turns into the scale of MSBlast. Essentially, every Windows system is vulnerable. This is one
of those worst-case 'pull the plug on the Ethernet cable' events."  I was pretty confident that we were going to have some trouble. So here we are on Tuesday, the sun still came up, the Internet is still working and I have not seen any reports of a major worm outbreak.  Is it too soon?  They said we should see something in 2 to 4 days.  There have been reports of a botworm out that does exploit this, but it has not become a slammer/blaster type of event.  Why?  Is everyone already patched against it?  Are we ever really going to see another major outbreak of a mass market attack like we did in the past.  In my opinion the answer is no.  I think the reasons for this are several.  Here are the top ones in my mind:

1. Who wants to create a mass exploit? People hack for profit, not for fun - In the past the kiddie scripters or people who wrote these worms for kicks were the main enemy.  After a few people getting arrested for this, maybe the air has gone out of that balloon. The real reason though, is where is the money in it. In the immortal words of Cuba Gooding, Jr. in Jerry Maguire, SHOW ME THE MONEY! Putting out a mass market worm like this does not make the worm writer any money (unless he does the talk show circuit after he gets out of jail). We have moved beyond people hacking for fun and kicks to people hacking for profit. Today's attacks are targeted at specific targets which yield financial gain.  Whether you subscribe to the cyber-mafia theory or not, there is too much money in play and hackers now will use a valuable exploit like this to maximize their profit, not waste it on a mass market attack. 
2. We have gotten better at finding, patching and warning on this stuff.  There is no doubt that with the regular Patch Tuesday's from Microsoft and the proliferation of vulnerability management and patch management programs, as well as SP2's automatic updates, on the whole computer users are much more protected against known vulnerabilities like this, then they were a few years ago.

So what does this mean for you as a computer user and me as a security vendor.  Well, it does not mean that we let our guard down for one.  We have to continue to do the right things.  Stay on top of patching, vulnerability management done in a systematic way, prudence in opening unknown files and attachments.  Basically doing the types of things we have grown accustomed to.  However, for the security industry, I think we need to move beyond defending and planning to contain the next mass market worm outbreak.  We have to zero in on targeted cyber-criminals stealing and hacking for money.  That is the next battle ground.  We cannot rest on our laurels on fighting the kiddie scripters, that frankly was child's play compared to what we have to combat now.