The Ashimmy Blog

A Butterfly Flapping Its Wings Can Cause a Storm Somewhere

It always amazes me to see the inter-relationships in the security blogging world.  I was on a phone call earlier this week with Rich Mogull and Rich mentioned that no one is blogging anymore it seems.  I guess I am guilty if you are speaking about blogging here at ashimmy.com.

That is not to say I am not blogging.  I blog 3 to 4 times a week in my Network World Open Source Fact or Fiction blog. I also blog regularly on Secure Cloud Review along with some other great security bloggers. On top of this every once in a while I throw up a post on The CISO Group’s Security.exe blog as well.

But where and when you blog is not the point. The influence you have on the public discussion and on your peers is what matters most to me.  I was reminded of this twice in the last few hours.

Jennifer Leggio who in the years I have known her has grown so much from being a PR/marketing person, to a bona fide social media celebrity has a column in her ZDNet Social Business blog called 100 Brains. Yesterday she ran an interview she did with Christofer Hoff (@beaker).  Being as how I know them both, I read the article. About 3/4 down the first page I read this quote from Chris:

I was further inspired in terms of community outreach and expanding my use of social media by Alan Shimel.  He urged me to step up my blogging as a way of inspiring discussion, debate and dialogue in the security community.

I will be honest with you, I was moved to tears. What a nice thing for Hoff to say. More than that, to think that somehow I played a small part in helping Chris reach the lofty heights he has reached was immensely gratifying. You write what you feel, sometimes you can’t find stuff to write about. You meet people, you interact with them, drawing out a dialogue.  To know that from all of that someone like Chris was inspired makes a lot of the drudge worthwhile.

But lets be real. Chris is a brilliant guy.  Whether I encouraged him to keep blogging or not, his talent would have been recognized anyway. He has inspired me much more than I could have inspired him I am sure. But I am humbled and grateful that he mentioned me in the interview.

The other thing I read today was what is apparently the last blog (at least for a while) from my friend Robert “RSnake” Hansen. I met RSnake also through the Security Bloggers Network.  A few years back when my blog was hacked it was RSnake who came in and was so helpful in figuring out who the jerks were who did it. He helped me put things back together much quicker than I could have ever done myself.

On top of this though, as most of you know, he is another brilliant security guy. He and Jeremiah Grossman practically created the webappsec space. I think the podcast I did years ago with Mitchell Ashley with Jeremiah and RSnake is still our biggest download. 

Robert says he is closing down his blog after 1,000 posts and almost 5 years because he is just not into security anymore.  It happens to the best of us. My gut tells me we have not seen the last of Robert in security. Maybe he just needs some time away to recharge the batteries. He still has much to give the security industry. He just needs to find something that will get him excited.

But until he does, there is nothing wrong with following your pursuit of happiness. Over the last year while building The CISO Group I have come to cherish the time home with the family and not running around from one airport to the next. I don’t think Marriott and Delta miss me too much. 

I wish Robert nothing but the best and hope he finds his happiness to as he says “make his life a comedy”.  Interestingly in the comments, Jeremiah thanked Robert for getting him started with blogging.  Another case of the six degrees of separation in security blogging.

So are you blogging? Are you inspiring someone, even though you may not know it right now?  You never know. But you probably have something to say, so say it. Keep blogging, the world really is listening.

Related articles

• 100 Brains: Security's Christofer Hoff speaks out about social media and online safety (zdnet.com)
• Security Blogger Meet-up at RSA (ashimmy.com)
• PR Pros: Stop Cramming Everything Into the News Release Headline - ZDNet (blog) (news.google.com)

The Security Groggers Network

No that is not a typo in the title. We are experimenting with some new solutions that can let each one of you contribute to the security blogosphere.  We are building a security bloggers grogger site. It will have all of the feeds that security bloggers network does now. You can read the posts right on the site, comment, like, retweet, like in Facebook and more. Whats best you can become a blogger yourself. If you want to post something either on a topic of your choosing or in response to what someone wrote you can. Right there on the site!

So now the excuse that you don’t have a blog will not cut it. You can post on the SBN Grogger site. 

This is just an experiment. Grogger is still in Beta. But we have some ideas of using topic hashmarks similar to twitter to organize all of the great content coming out of the SBN. We think there are some other cool things we can do with this technology as well.

I need you to check it out though. Leave comments or email me at info@securitybloggersnetwork.com with your thoughts.

This is just one of the things we are thinking about for future SBN enhancements so stay tuned.

Does Google care about Feedburner? Then get it working right

After all these years of blogging, I don’t pay as much attention to my Feedburner stats as I used to.  There was a time when how many subscribers Feedburner said I had was really important to me. Then again so was my Technorati ranking.

Nowadays,  I log into my feedburner page once a week. Mostly I like to see what readers people are using, as I am never satisfied with Google Reader which I use now.

Over the last few months, I have seen big swings in my subscriber account. In the past the feedburner folks would have a post on their own blog that counts were off. However, them seem to have stopped doing that or just don’t realize it. But I am pretty sure that my subscriber counts are not going down by half and then coming back up the next week.

I suspect the great infrastructure that original feedburner team, led by Dick Costolo (now with Twitter), built is not being kept up.

Is anyone else having this problem?

Are Press Releases Worse Than Useless?

Well it looks like Rich’s article and mine have reinvigorated some of the security bloggers out there. At least for the time being anyway. One of my favorites (and by his own admission one of the oldest, I mean longest blogging) Martin McKeay has been blogging up a storm.

Martin blogged today about press releases. Like Martin I receive a decent amount of press releases every day too. I assume it has to do with writing in Network World. Also like Martin I usually take a quick look and hit the delete button on most press releases. 

Today Martin posted what he considered a press release that may be of interest to the security community, but not interesting enough for him to blog. His rational is some of the “professional blogs” he reads write a line or two and then post the press release as post. 

First of all Martin, what makes you think your not writing a professional blog? I think yours is probably better than many of the so called pros (what is a professional blog anyway?) Secondly, are press releases even relevant? With today’s social media  at their disposal, it just seems like such a 1995 way of getting the word out. Maybe if I was looking for a newspaper or something to publish it, I would send out my press release. Lastly, there are already enough places that republish (or regurgitate) these releases without giving them valuable real estate on your own blog, especially if they are not worthy of you blogging on it.

I don’t know but when I see these press releases being distributed to the press list, I feel like some PR company is just going through the motions. I would rather get a power point or something else to sink my teeth into.

Let me be clear, I am not advocating to stop putting out press releases. But the blind distribution list just screams old school to me. There has to be a better way to influence the influencers and get your story out. 

So Martin I would use the space on your blog to blog, not regurgitate someone else’s press release. Otherwise you are no better than some of those “professional blogs” you read.

Related articles by Zemanta

• Five Ways to Advertise Your Blog for Free (webupon.com)
• From the Vault: What Makes a Good Press Release? How to get the word out in 5 steps (lulublog.com)

Calling all security bloggers, come out, come out where ever you are

I saw Rich Mogull last at RSA. Rich and I were bemoaning the lack of content coming out of the once vibrant security blogosphere.  Rich said when he had time he was going to blog on it.  Well he did and you can read it here.

I agree with Rich, by no matter how you measure it, the sheer quantity of blog posts on security are down. The interaction between blogs is down. I am not sure the quality of security blogging is down though.  Those that blog, do a great job of it.

As the manager of the Security Bloggers Network, I take a special interest in the state of the security blogosphere. I know that I still receive 2 to 3 requests a week to join the SBN.  The blogs requesting to join run the gamut from large security companies, security teams at companies to individual security geeks.

Maybe that is what it is, the old names we are familiar with are busy, moved on or as Rich suggests, Twittering. Like the NBA, the new crop of bloggers have not caught our eye perhaps. 

Whatever the case, what a shame. The security industry for a relatively small industry made a lot of noise blogging.  There are a lot of very smart people, who had some great things to say.  They still do.

I know that many of you security bloggers read this blog. I am asking you to get re-energized and rejoin the conversation. Lets get some good blog discussions happening!

The Security Bloggers Network will do their share.  We are in the final stages hopefully of arranging some sponsors that will allow us the ability to expand what we do (if you want to sponsor SBN there is still room for you, contact me). We want to facilitate the communication among the security bloggers, we want to bring topics to the front that we should be blogging about. Lets collectively use our content to be heard, read and published. 

I know many of you have asked how can you help. You can help by blogging. That is the single most important thing you can do. If you blog and reference what someone else wrote, ping, trackback, let the world know.

Collectively the security industry has many voices with many opinions. That diversity is our strength, but not if our voices are silent.  So lets hear from you.

Related articles by Zemanta

• Big Changes for the Security Bloggers Network (ashimmy.com)
• Get your securitybloggers.net email and other SBN news (ashimmy.com)
• A new blogger for the SBN and Security.exe (ashimmy.com)
• 5 Easy Ways to Link for Trackbacks (internetmarketingformommies.com)

For Forescout its about the profits, not the product Bryan

A few weeks ago I took exception to the usual pre-RSA press releases touting “another record breaking year” by several NAC vendors. First I called out one of my favorite whipping boys (there I admit it), Forescout and then I did the same with Bradford Networks.

My reasons for this were several. First of all private companies touting record revenues without actually giving numbers is meaningless hyperbole or even worse BS. Secondly, in today’s economic conditions, its the bottom line that counts baby. If you are not profitable, people are going to question your viability. That isn’t my rule, that is the way of the world. No where in either of the two releases I called out was a hint of the word profitability. Therefore, I have to assume neither are profitable. That is an important yardstick when even on orders for a few thousand dollars customers are asking for vendors financials.

Further in a market that the analysts are unanimous in saying shrunk this past year, the fact that both of these companies grew by roughly the same large amount of customers is just a little stinky, don’t ya think?

But let me be clear. It has nothing to do with whether or not the products are any good or not. In fact I think Forescout has made a ton of progress over the last two years in improving the product. I also like the direction that Bradford is taking, away from a pure NAC message. I was strictly speaking about stupid marketing tricks and how it makes the company look foolish.

However, it seems to have set off a bit of a comment war. Eric Irvin who is a regular reader of my blog made a few comments and now Bryan Marlatt, Director of Engineering at Forescout has responded. Rather than leave these excellent comments to the side show of comments on old posts, I thought I would give them both the bright lights of center stage along with my response. So here are the comments in question:

Eric Irvin· 2 weeks ago

I think the big problem with Forescout, is a lack of market identity and swagger. When I was shopping NAC for a very large health organization, we met with Forescout, Symantec, and a few others. There was nothing that really sold us on their SEs and Sales guys really being passionate about their product, or feeling they were the market leader that could do x, y, and z better than anyone else. In the end, you want a product that works and isn't that expensive. We never found out if it worked or not, because we were unsure if they would still be in business in a year or two. The NAC providers change so much from year, to year, when you see depressed sales people, either the company is tanking, or a merger is being worked out, from my experience. :)

3 replies · active 2 weeks ago

alan shimel 2 weeks ago

Eric, you are right passion on the part of sales people and other employees is a good indicator of what is going (on) usually. Forescout is not the only company guilty of this. I do know they have had some changes at sales and other personnel. The NAC market remains very liquid. Thanks for commenting!

Bryan Marlatt· 3 hours ago

While I enjoy reading Alan's blog, I find it always to be a bashing towards ForeScout. I find it interesting that you feel the need to beat up ForeScout just because your past employer's product is failing in the NAC market. I have enjoyed speaking with you at in ATL airport and past conferences. I think we've had some good conversations. I think it would be more beneficial for you to have discussions about competing products and not just try to crush them.
In regards to Eric's message above. I'll have you and your readers know that I was the engineer that presented to Eric and his team. I found it odd to read Eric's message above when he quickly invited me to connect with him on LinkedIn after the conversation we had. I'm one of the biggest proponents of the ForeScout CounterACT NAC solution. While I feel it important to explain the major differences between CounterACT and the competition in the NAC market, I don't feel the importance of 'bashing' the competition. I think the CounterACT stands on it's own merits.
I think it says something that every other vendor out there is working to push customers away from ForeScout. ForeScout has a product to be reckoned with and I think our competitors feel the pain when losing so often to ForeScout. I welcome any conversation you wish to have with me or ForeScout to "DISCUSS" the CounterACT NAC solution.
Bryan Marlatt
Director of Engineering
bmarlatt@forescout.com
404-242-0144

Eric Irvin· 3 hours ago

Bryan, you are right, I was excited to meet with you, and think you are an excellent resource for ForeScout. I still stand by my words, I never felt the swagger and general excitement about how ForeScout approached NAC. In comparison to some of the other vendors we observed, Symantec, and Cisco specifically, ForeScout brought more to the table in terms of the technology working without requiring a huge investment in software deployment, or hardware repurchasing. The hardsell for us was, our senior leadership was nervous about NAC. NAC has a bad reputation for causing more problems than is solves. If you recall our conversation, Bryan, you will remember I told you this. NAC also has a blackeye because each year, the Gartner report on NAC loses a handful of companies, and gains a few more.
Also, to be fair, one of the biggest reasons I felt this way, was because we also got the impression that Bryan was an army of one. I hope you take that as a compliment more than anything. When you see the Director of Engineering selling you the product, and you hear most of your engineering-related problems would be solved by the DoE, you are excited about the attention, but you also wonder if the Director is the team.
That said, I think Bryan may have a point... Alan should consider interviewing Bryan on the blog, and give him his chance to address the direction of ForeScout, and their future plans.

So Bryan you raise some points and let me respond. I can’t talk for Eric though and will let his comments stand on their own.

Bryan I don’t beat up Forescout because my former employers product is failing in the NAC market. I don’t know if it is failing first of all. But I have been beating up Forescout for a long time :-)  But as I said earlier, it is not the product (or the director of engineering) I have a problem with. It is sleazy marketing schtick that I have called out again and again over the years that I bash.

I don’t want to crush a competitors product. First of all I am not a competitor. Second of all as I have written, I am not a big fan of stand alone NAC companies at this point. I think like Gartner has been saying for years, it is increasingly difficult for a stand alone NAC vendor like Forescout or StillSecure for that matter, to compete with Cisco, Juniper, Symantec, McAfee, Microsoft and the rest who are bundling NAC with their product line. That is why most of the NAC companies have been changing the message to say they are more than NAC.

Bryan I admire your pride and passion for your company. So let me break this to you gently. There are tons of deals that are going to Cisco and Symantec that you are never even in the game on. Eric is referring to this when he talks about the execs in his company being nervous. Forescout not being profitable is a reason for nervousness today. Nothing against the product itself, its the financials.

As to bashing competitors, Bryan not blaming you, but you know as well as I do that certain sales team members at Forescout used to dedicate major portions of their powerpoint slides bashing the competition. I have seen the slides, so lets not go there.

I would be happy to have you on a podcast in the future if you like to talk about NAC. Make sure it is OK with Gord and the crew and let me know.

Eric as usual you make some excellent points. I can understand the attitude towards choosing a NAC and if you do, going with a bigger company. Thanks for reading the blog and being a fan!

A new blogger for the SBN and Security.exe

The final member of The CISO Group who up till now has not blogged, has joined the blogosphere.  My partner and friend, Bobby Dominguez has posted the first post on his own personal blog, DrekkinVorn. It is an Icelandic word having something to do with dragons, but you will have to google it to find out more.

Bobby is the CISO at The CISO Group. He has been a CISO at a few different companies that you have probably heard of. Bobby has also been a finalist for SC Magazine’s CSO of the year award for two years running. He has a lot to say and I think the blogosphere will be enriched with his voice added.

His first post is also cross-posted to the security.exe blog. In the future, he will be posting to both.

Welcome Bobby and be sure to follow his writings, I guarantee you will learn something.

Envelope please, and the winners are . . .

OK for the first time in public, here are the finalists for the 2010 Social Security Blogger Awards! The finalists were chosen by our blue ribbon panel of judges (Mike Fratton, Bill Brenner, Kelly Jackson-Higgins and Larry Walsh). The members of the Security Bloggers Network will be recieving ballots shortly with the names of the finalists and they will cast the deciding votes for who this years lucky winners are. So without further delay, the finalists are:

 

Best Technical Security Blog

SANS Internet Storm Center

Evil Bytes by John Sawyer

Praetorian Prefect

Darknet.org

Frequency X ISS blog

Best Non-Technical Security Blog

Security Uncorked

Schneier on Security

Krebs on Security

ThreatPost

TaoSecurity

Best Security Podcast

PaulDotCom

SANS ISC Stormcast

An Information Security Place

CSO Security Insights

Security Catalyst

Best Corporate Security Blog

JEREMIAH GROSSMAN (White Hat Security)

SOPHOS GRAHAM CLULEY BLOG

MICROSOFT SECURITY RESPONSE CENTER

FORTIGUARD BLOG

CISCO SECURITY BLOG

Most Entertaining Security Blog

Rational Survivability by Chris Hoff

Security Incite by Mike Rothman

Uncommon Sense Security by Jack Daniel

SecBarbie by Erin Jacobs

Emergent Chaos by Adam Shostack and ensemble

What an all star list of finalists. Each and every blog and podcast on this list are deserving of winning. It is a testament to the quality and quantity of blogs that the security industry has spawned. Congratulations to each and every one of them. May the best blogs win!

I also want to point out some honorable mention blogs and podcasts that did not make the finalists because they were not eligible, though they were nominated:

Securosis Blog

Network Security Blog and Podcast

and my own Ashimmy, after all these years.

Of course the winners will be announced at the Security Bloggers Meet-up at RSA in just over a month! Good luck to the finalists and hope to see you at the meet up.

Open Source Fact and Fiction

Well I have been blogging here since October 2005. That is probably longer than most of you have been reading this. Over the years this blog has been the place where I put my voice and opinion out to the world. In retrospect it has been a great bully pulpit for me to add my 2 cents to many a discussion.

But over the years and months I have wanted to expand both my brand and online presence. Twitter and Facebook are nice (you can follow or friend me on either. @ashimmy on Twitter and ashimmy on Facebook) but they are not the same as blogging. For sports I have discovered the Bleacher Report. It is an open source sports blog. I blog on the Steelers and Yankees there and it spares most of you from reading my sports stories. With the start of The CISO Group, I have the new security.exe bog and podcast too (by the way my partners Josh Karp and Parker Yates have been blogging a storm up over there, you should check it out too!)

But I have been looking for another outlet for my technology ramblings. I am proud to tell you that as of today I have another home! I am the newest blogger at NetworkWorld.com!  My blog is on open source and is called “Open Source Fact and Fiction”.  I have already put three articles on open source there:

1. Ladies and Gentlemen, Your Top 10 Rookies of the Year in Open Source

2. Are open source business models successful?

3. Nothing in life is free (so why do governments love open source?)

I think all three are great articles on open source. I will be adding to the content there over the days and weeks to come. I need your help to make my NetworkWorld blog successful. The blogs there are judged by page views, not be subscribers. They want to see twitters and diggs on the articles. So if you like what you read, please pass it along. Give me a Digg or a Tweet. I appreciate it.

Of course I will still be blogging here, as this is my primary home. I probably won’t cross-post very often. Most of the open source stuff will be on the NetworkWorld site. So please keep reading here and there!

Wish me luck and let me know what you think. So many of you have been so supportive of me over the years. I hope I can count on you to support me at NetworkWorld too!

New advertiser on ashimmy.com

Hey readers, if you are reading this on the blog site itself and not the feed, have a look at the top of the page. You should see ads from a new advertiser that I am trying out. It is from talent seeker. They should be advertising tech industry jobs from Google, Dell and others.  I figured since it is not like I make a lot of money on the blog, at least I might actually help some folks find a job.

Anyway, check out the jobs and let me know if you think these are worthwhile.  Good Luck!