I was never a big fan of the Rolling Stones. Heard them on the radio all the time growing up but never bought any of their stuff. It was good but not good enough to spend my hard-earned money. Recently a friend, a hardcore Stones addict, convinced me I needed some in my music collection. A couple clicks on Amazon, and three days later I had a big box of music waiting for me when I got back from the Splunk conference. In need of a little rest after a hectic few weeks, I cracked open the package and gave it a listen. And WTF? This is not what I heard on the radio. This song is hardcore blues. The next song is honky-tonk. Then rock and roll, followed by some delta blues. Singer, guitarist, and drummer all changing styles with each song like each one was a style they had played all their lives. This is amazing. Different, but (ahem) I liked it! The band as I heard it on the radio growing up is not the band on CDs and records. There is depth here. Versatility. Ingenuity. What I thought is not what they are. Their popularity suddenly makes sense. The songs played on radio and streaming services do a disservice to the band, and fail to capture special aspects of what they are (and were) about.
So this morning I realized the answer to a simple question, which I have been hearing for years without a good answer. The question is most often asked as “We are evaluating SIEM solutions but this vendor Splunk came up. Who are they and what do they do?” The security community primarily knows them as an almost-SIEM platform. They do more than log management, but less than SIEM. And that is accurate – most of the security press talks about Splunk in that grey area between SIEM and LM, but fails to explain what’s going on or why the platform is popular. What you have read in the press and seen in… let’s call them “Supernatural Quadrangles” for the sake of argument… does not capture what is going on or how this platform fits into the enterprise. Yes, I said enterprise.
This came up because Splunk was kind enough to invite me to their conference in Las Vegas this week to catch up on recent platform enhancements and speak with some of their customers. I don’t get paid to go, in case you’re wondering, but it is worth spending a couple days speaking with customers and hearing what they are really doing. The customer conversations were the optimistic variety I expected, but the keynote was something else entirely. Their CEO talked about mining the data feeds from aircraft and trains to help optimize safety and efficiency. About getting telemetry from mobile endpoints to gauge app reliability. I heard user stories about using the platform as a basis for consumer buying trend analysis and fraud analytics. This is not security – this s generalized analytics, applied to all different facets of the business. Even weirder was the enthusiastic fanboi audience – security customers normally range from mildly disgruntled to angry protagonist. These people were happy to be there and happy with the product – and the open bar was not yet open. Wendy Nather and I did a quick survey of the crowd and discovered that we were not among a security audience – it was IT Operations.
Splunk’s core is a big data platform. That means it stores lots of data, with analytics capabilities to mine that data. And like most big data platforms, you can apply those capabilities to all sorts of different business – and security – problems. It is a Swiss Army Knife for all sorts of stuff, with security as the core use case. To understand Splunk you need to know that in addition to security it also does IT analytics, and is applicable to general business analytics problems. Another similarity to “Big Data” platforms is that many commercial and open source projects extend its core functionality. The only security platform I know of with a similar level of contributions is Metasploit.
Again, it’s not SIEM. It is not the ideal choice for most enterprise security buyers who want everything nicely packaged together and want fully automated analytics. Correlation and enrichment are not built into Splunk. Enterprises need reports and to ensure that their controls are running, so anything different is often unacceptable. They don’t want to rummage around in the data, or tweak queries – they need results. Well, that’s not Splunk. Not out of the box. Splunk is more flexible because it is more hands-on. It offers more use cases, with a cost in required customization. Those are the tradeoffs. There is no free lunch.
A few years ago I mocked Splunk’s “Enterprise Security Module”. I said that it did not contain what enterprise security centers want, they did not understand enterprise security buyers, and they didn’t offer what those buyers demand in a security platform. Yeah, in case you were wondering, I failed charm school. Splunk has gotten much closer in features and functions over three years, but it is still not a SIEM. In some ways that is a good thing – if you are just looking to plug in a SIEM, you are missing their value proposition. Splunk pivoted vertically to leverage their capabilities across a broader set of analysis problems, rather wage trench warfare with the rest of the event management market. The majority of people I spoke with from larger enterprise belonged to operations teams. At those firms, if security uses the product, they piggy-back off the Ops installation, leveraging additional security features. The other half of customers I spoke with were security team members at mid-sized firms, applying the platform to highly diverse security use cases and requirements.
To understand why Splunk has so many vocal advocates and protagonists you need to broaden your definition of a security platform. It’s different – probably not what you were expecting – but you might like it.
On to the Summary:
Webcasts, Podcasts, Outside Writing, and Conferences
- Someone on (ISC)2 board says security industry immature..
- Rich at Dark Reading on security job skills for 2023.
Favorite Securosis Posts
- Adrian Lane: A Practical Example of Software Defined Security. Amazing what a few lines of code can do in the cloud. So simple, yet ahead of the curve.
- Rich: Mike’s Security Awareness Training Evolution: Why Bother Training Users? I keep going hot and cold on awareness training. Sometimes I think it’s awesome, other times a total waste. Mike is slowly swaying me back towards ‘valuable’.
- Mike Rothman: The Gartner Tax and Magic Quadrants. “You can’t handle the truth.” Not if you’re a vendor thinking your competition scored better in the MQ because they buy a ton of services. This has been my experience as well.
Other Securosis Posts
- Feds take down Silk Road.
- Exploit Disclosure.
- Details for the Matasano Crypto Class.
- Incite 10/2/2013: Shutdown.
- IE Zero Day Getting Serious.
- The Goof Excuse.
- Not the Rut You Think.
Favorite Outside Posts
- Adrian Lane: Learning From a Recent Security Vulnerability in Persona. Good post-mortem on a software flaw.
- Rich: Patent troll Lodsys chickens out, folds case rather than face Kaspersky Lab. I’m not sure there is another large(ish) security company lead by such a personality anymore. I have met Eugene, and there is no question he would rather lose the money than be extorted like this. The man’s son was kidnapped – Lodsys doesn’t scare him as much as they are used to.
- Mike Rothman: Pen Testing Using Live Malware Becoming a Must. You nee to test with live ammo. I have been saying this for years. Most folks still don’t like it and won’t do it. And they get pwned. Go figure.
- Gunnar Peterson: MasterCard, Visa and American Express to use tokens. It is not entirely clear what this means yet, or what an implementation will look like. But any way you slice it, we won’t be passing around credit card numbers to buy stuff online.
Research Reports and Presentations
- A Practical Example of Software Defined Security.
- Continuous Security Monitoring.
- API Gateways: Where Security Enables Innovation.
- Identity and Access Management for Cloud Services.
- Dealing with Database Denial of Service.
- The 2014 Endpoint Security Buyer’s Guide.
- The CISO’s Guide to Advanced Attackers.
- Defending Cloud Data with Infrastructure Encryption.
- Network-based Malware Detection 2.0: Assessing Scale, Accuracy and Deployment.
- Quick Wins with Website Protection Services.
Top News and Posts
- Malicious compliance from Lavabit
- Grand jury indicts 13 members of Anonymous
- Silk Road Shut Down
- Important Customer Security Announcement. Translation: we [Adobe] were breached. On the bright side it’s not too bad, as breach disclosures go.
- Browser Pivoting
- Gmail Scanning for Ads Under Question
- Chaos Computer Club breaks Apple Touch ID. Updated.
- A Survey of the State of Secure Application Development Processes. Just downloaded it. Review forthcoming.
- Microsoft issues “Fix it” for zero-day exploit attack against IE
- Good description of F5’s acquisition of Versafe
Blog Comment of the Week
This week’s best comment goes to Gunnar, in response to Cybercrime at the Speed of Light.
I would argue its the reverse – traders and HFT are at risk to each other, but there is minimal risk to investors. They make millions of trades with very small returns.
So yes HFT is an annoyance for investors, because it clips a fraction of a percent off of trades, but on a 5-10 year time horizon its not even a rounding error.
Otoh, there’s mucho risk for the traders themselves, Knight Capital was one of the biggest and they bankrupted themselves with their own algorithms