Research

As mentioned last week, I’ve been mired in the twins’ baseball/softball playoffs the past 2 weeks. That ended Saturday, with the Rothman clan going 1-1 in championship games. XX2’s team lost a close game and took the runner-up trophy. The Boy’s team eked out a win after dominating the league most of the year to take home the victory. It’s funny, you’d think there would be angst and disappointment coming from the girl, and happiness emanating from the boy. But that wasn’t exactly the case. Both reacted pretty similarly: they loved their trophies and were a little disappointed the season was over, so they won’t be playing any more. I get that they are only 7, and the very American need to win hasn’t yet taken root. And I hope it never does. Both teams made it to the championship game, so they got extra trophies. The Boy’s championship trophy had maybe 3 inches on the runner-up trophy. But they were both very proud to get the extra hardware, and so were we. It’s funny – both games went down to the wire. Both were somewhat impacted by poor officiating. And both games had parents or coaches (or both) in an uproar about mistakes made by 14-15 year-old kids making about $15 per game to umpire. The kids couldn’t care less. Sure they had a little trouble understanding why they were called out or why a run was allowed to score when it didn’t make sense. But they got over it within seconds. Some parents were still stewing two innings later. Part of me feels like I’m getting soft, and that focusing on just doing well, as opposed to winning and beating the competition, will hurt my kids later on. Plenty of kids are being trained by their folks to step on the throat. Maybe those kids will win the game of life, whatever that means. I just know how unsatisfied my quest for victory left me. And it wasn’t like my parents pushed me to win at all costs. I was born with that drive and have had to spend years slowly retraining myself to focus less on winning and more on doing what I love, which will likely always be a work in progress. So far it seems my kids are happy to focus on the trophy and not the win. Maybe that will change and then I’ll have a decision to make. Do I discourage that behavior? I’m not sure, but I doubt I would actively interfere with their desire to win. I had to learn the lesson myself the hard way, and I suspect my kids will likewise need to figure it out themselves. I am not bashful about sharing my experiences, so when they ask I’ll provide my opinion. But ultimately they’ve got to figure out whether the trophy will be enough. Photo credits: “Trophies” originally uploaded by TexKap Incite 4 U Are devices or (lack of) performance killing AV? I’ll preface this entire discussion with the disclaimer that the rumors of AV’s demise are wildly premature. But we in the know all understand that AV isn’t the way to deal with today’s threats. Which is why I chuckled when I read about how Google’s Chromebook may finally kill AV. Ha! Unless some smart Google engineer has figured out how to stop corporate inertia in their 20% unstructured time, or to remove AV from all the compliance mandates, I don’t see Chromebooks killing off AV. To be clear the Chromebook is more a mobile device than a conventional computer. And if they allow plug-ins or other persistent software to run (and I don’t know how they could avoid it), malicious code will still threaten to them. But like iOS devices and even Android (to a point), it’s tough to do this in a weaponized, self-propagating fashion. So it gets back to a point we have been making for quite a while. The issues arising from the increasing mobility and consumerization of the workforce are more system and device management issues than security issues. – MR Lasso the SaaSo: Many organizations want to move various operations to SaaS providers, but balk both at the complexity of managing users and at giving up control of their data. We see two types of solutions appear. Some help manage user credentials and integrate accounts with internal directories, and others are inline proxies to encrypt/tokenize data or limit functionality. Hoff talks a bit about VMware’s move into this area. I suspect the money is on the user management side, and have very mixed feelings on the data protection/encryption products. Sure, you can encrypt customer info and store the token or encrypted value in Salesforce.com, but the more data you block Salesforce.com from processing the less useful it is. And these things are inline proxies which reduce mobility. Back to the VPN, everyone! Seems like the sort of thing people will buy and discard. – RM Compliance Rolling: I got a kick out of Dejan Kosutic’s Management’s view of information security – he captures the essence of the issue. It’s just that his clean prose presents a politically correct version that misses the semi-hostile management displeasure for anything security. Kinda like your defeated resolve when finding you have an incurable disease. In management discussions, I find “Is it really necessary?” really means something more like “Are you sure legal said there was no loophole?” I translate “Does it fit into our company strategy?” to “If we can’t get rid of it, then let’s market it as an advantage.” And I hear “How can we decrease costs?” as “Where can we cut corners and still be compliant?” He’s right that management does not want to invest in security, and Dejan has the right discussion points, but the language is never this civil. It’s more like wrestling with a hostile adversary. – AL There is no answer (singular): I sat in on my friend Ron Woerner’s leadership presentation at Secure360 last week, and

BeyondTrust announced today that it has acquired the assets of Database Activity Monitoring vendor Lumigent. Some of you are saying “Who?” Others, who have been around the DAM space a few years, shake your heads in dismay at what might have been. There was a time – way back in the 2004-2005 timeframe – that Lumigent had a clear leadership position in the Database Activity Monitoring space. They won many head-to-head sales engagements. They had a good sales and marketing team, the best Sarbanes-Oxley reports in the industry, the only viable auditing tool for Sybase, and the only platform that provided “before and after” query values. The latter was the hot feature for forensic audits and regulatory compliance, and every customer wanted it. Greylock, North Bridge, and NetIQ invested. Lumigent was a shining star in the nascent DAM market and they were making a name for themselves. Fast forward 6 years and we have an asset sale. That’s a politically correct term for fire sale. The kind where they’re selling the fixtures off the sinks. So how did it all go so very wrong? There was actually a long series of missteps, so we’ll discuss several major types of FAIL. It’s a classic example of how to plunge into the chasm, land in a fiery mess at the bottom, and get sold for scrap metal: Strike One: Technology. Lumigent never capitalized on their technology lead. Their engineering team must have known that the triggers and stored procedures they used in the early days would not scale, even though early customers preferred them to native audit and tracing – which Lumigent then added to their mix! It seemed like Dumb and Dumber were managing their product roadmap. Sure, they improved data collection over time, but not enough; nor did they ever find a consistent strategy to collect events across all databases. Additionally, they focused on Sybase and MS SQL Server – to the exclusion of Oracle and IBM, who sell a few databases. Competitors quickly provided more – and better – collection options across all the major platforms. Competitors were easier to deploy and did not kill performance. Don’t get me started on the missed Vulnerability Assessment opportunity. Lest you forget, Lumigent acquired nTier, which was a bad assessment product. Nothing was structurally wrong with it, but it needed a lot of work on policies and reporting to be competitive. During the several years assessment was key to winning deals, Lumigent made no visible investments into the nTier technology. It only covered a couple databases, with only some of the needed policies for security or compliance, when it was acquired. They were not the only vendor stuck in the mud for a while, but the upshot is that they failed to upgrade their product to keep pace. Startups have to innovate, you know? Strike Two: Partnerships. Lumigent heavily courted Microsoft and Sybase. They geared their product strategy to work with these two database vendors to a fault. This helped early on, but both partners wanted far better auditing capabilities – specific to their respective database platforms – before they were willing to really get behind Lumigent. Behind the scenes Lumigent thought acquisition was a sure thing. Not so much – Lumigent neither delivered, nor did they hedge their bets with a heterogenous solution. When Lumigent failed to provide better auditing, the rumored Microsoft and Sybase acquisitions halted, and both partners had conversations with just about every other DAM vendor. The recent partnership with Deltek was solid, but simply not enough to carry the company. They didn’t just count their chickens before they hatched, they counted them the first time the rooster made eye contact. Strike Three: Misunderstanding the market. Lumigent’s story shifted from Database Security; to Compliance; to Database Auditing Solutions for Compliance and Security; to Information Centric Security; to Application Governance, Risk & Compliance; and then back to DAM – each step worse than the one before. The App GRC strategy was the most surprising and saddest, as it looked like a desperate attempt to save the firm by re-inventing their market. I appreciated their ingenuity in repackaging DAM into something totally new, and admired the cojones management displayed with their willingness to walk away from their primary market, but I thought they were nuts. And I told them. Rich and I stopped short of begging Lumigent to reconsider their App GRC path, with at least a half dozen reasons it was a bad idea, along with practical experience about how Information Risk Management and GRC messaging missed DAM buying centers. A couple years later that horse died, and Lumigent was back to square one. Very few start-up firms get three strikes. What does this mean for BeyondTrust? The good news is that DAM extends the PowerBroker functionality, providing a means to detect misuse and compromised credentials. The PowerBroker product family is focused on credential and authorization management, but its value is the ability to delegate capabilities without distributing credentials, and fine-grained task-oriented authorization maps. Before the acquisition the PowerBroker platform was geared for preventative security. DAM provides detective capabilities along with a number of compliance reports deeply focused on the database layer. This gives BeyondTrust users some new toys to play with that improve security and broaden the product line. BeyondTrust surely acquired the assets for a song, so they really can’t lose here. And I like the vision. I hope they take a long look at how their customers will use the technology – a few strategic improvements would go a long way to improve customer satisfaction. But there is some bad news. First, the Lumigent technology is way behind the curve. For Database Activity Monitoring or Vulnerability Assessment, Lumigent cannot compete head-to-head against other established vendors. The technology lacks consistency and capabilities across the board, including data collection, database platform support, policies, and platform management. For most acquirers that wouldn’t matter – BeyondTrust can at least sell ‘new’ Lumigent functions to their existing accounts to enhance security

The M&A train gathers steam in the security space. With Lumigent’s assets off the table, the TripWire buy, Sophos/Astaro, and RSA/NetWitness, it seems the busiest guys in town are the investment bankers. VMware has joined the parade by buying configuration management player Shavlik, ostensibly to facilitate the adoption of virtualization in the SMB market segment, though we believe that oversimplifies VMware’s ambition to be a one-stop shop for all things virtual infrastructure. This is actually an interesting deal, particularly considering GigaOm’s excellent VMware is the New Microsoft, Just Without an OS. Think about that for a second. As Microsoft started attacking the enterprise with LAN Manager and then more specifically Windows 2K, their success was accelerated by offering seamless management of the server(s). Enterprise customers scoffed at Microsoft System Manager because it wasn’t OpenView or UniCenter, but it provided small customers with what they needed to lay down a foundation of Microsoft servers. In the small business segment, seamless management is critical thanks to the limited IT resources. And that will be a gating factor to adoption of virtualization in small companies as well. So decisively taking that issue off the table is a smart move for VMware. The ability to claim some security goodness is a bonus. You have to tip your hat to Mark and the rest of the team at Shavlik. They built the company without outside investment by focusing on a core market and not straying from it, even as Shavlik’s more enterprise-focused competitors, such as BigFix (IBM) and ConfigureSoft (EMC), were taken out by big IT players. Shavlik stayed focused on Windows environments, adding anti-virus and power management to the mix within the same management construct. They also invested heavily in spinning a SaaS management service to appeal to small companies (under 100 employees). If you look at Shavlik from an enterprise standpoint, as many of us are guilty of, they don’t measure up. But as VMware looks to go downmarket with virtualization Shavlik is a great fit. But we still need to assess the technology within the context of the entire virtual infrastructure. On one side they might be planning on adding it to VShield Endpoint to enhance VM configuration and tracking – little things like making sure the instance you spin up was patched while in storage, and updates weren’t just applied to VMs running at the time. Or maybe they will skew this more towards managing virtual desktops. Or both. To assume they will only use Shavlik as a lever to get into SMB would be to downplay VMware’s grand ambition. With some R&D investment Shavlik’s technology could be extended to other platforms. And probably needs to be, because a technology like configuration management is core to managing this next wave of hybrid virtual/cloud data centers. VMware has plenty of options for integrating Shavlik, and most inevitably lead to impinging on the territory of its partners. Initially they won’t risk alienating HP, IBM, or EMC, who are significant partners for VMware. But at the end of the day all the Big IT players are competing to control the virtualization/cloud platform and infrastructure. VMware is clearly building itself out as a one-stop virtual infrastructure shop. It’s too early to see how it will fully play out, and a lot of organizations are using multiple virtualization and cloud providers to tackle different parts of the problem (servers, desktops, big iron, etc.). But ultimately, in most market segments, the player that provides the most effective platform will gain the largest market share. And that means they all need to field complete product lines. Which they will, keeping the investment bankers busy. Share:

Given the hard time we have defining success in the security field, you’d think we must have at least a firm handle on failure. But that isn’t entirely the case. As both an entrepreneur and a security guy, I may have a different perspective on failure, which influences how I look at pretty much all our business activities. I read a lot of VC and entrepreneur blogs, not because I want to raise money – in fact I’d rather hook my soft targets to a car battery than take outside investment. But I need to learn about how folks are screwing things up and try not to do that. Don Dodge’s short post, Failure is just experience on the way to success resonated with me. He talks about failing fast and the idiocy of the failure is not an option mantra. Of course, if lives hang in the balance, I’m good with doing whatever is humanly possible to avoid failure. But for a business? Give me a break. It creates a culture of risk avoidance, always a recipe for failure over the long term. Look at pretty much all big companies – they have this in spades. Their size and inertia may offset their lack of innovation for years, but ultimately these companies hit the wall because they get too big to remain nimble. So what? How does this help you do security better? Well, there is one crystal-clear failure in security: the breach. That means something failed and data was compromised – simple. You try hard to respond effectively and move on. But let’s talk about another type of failure. That’s the failure of a tactic, control, or product. You do all sorts of things that aren’t working – in many cases you know it’s not working. Let’s just pick on SIEM for a few minutes. Some organizations get tremendous value from SIEM, but I’ve met with countless other companies which do not. Not many stand up, own the project failure, and move on to something else that might work better. Failure needs to be an option These folks believe failure is not an option. They see tremendous political capital locked up in the tactic they decided on, and won’t risk looking bad by admitting failure. They’d rather keep throwing good money after bad, and wasting major resources that could be better used elsewhere to save face in the political meat grinder. Most of the time they also fail agonizingly slowly. Many of these science projects require a significant amount of integration and professional services, further driving up the price and pushing out the timeline. I get that sometimes an initiative can have a happy ending even if things look pretty bleak during part of the process. But realistically, more often than not, it doesn’t get better. At least until you find your next gig. But this isn’t the real driver for this dysfunction. There is very little incentive for small cogs in big wheels to stick their necks out and declare failure before they are forced to. Best case, you draw down your credibility. Worst case, you cost yourself a job before you needed to. Do you really wonder why most folks just sit on failure until the rotten fish stench becomes un-ignorable? Or why it usually takes a regime change to address all the hidden turds that were studiously being ignored, at significant cost to the organization? Failing Gracefully What can you do about it? If you work in an organization where failure is frowned upon, keep making deposits in the credibility bank and hope you have enough credit, then make a careful decision exactly when to admit the failure. Hoping the project will recover is not a strategy for success. These ongoing train wrecks represent sunk costs, so focus on cleaning these messes up as quickly as possible while keeping your job. Looking forward, you can change things, and that’s what you need to focus on. You need to manage your projects a bit differently. See how you can break larger initiatives down into smaller ones, with defined exit points. Reduce financial and resource risk, and allow yourself some leeway to determine whether you are on the right path. Have a Plan B, if your best-laid plans end up being wrong. If you are interviewing for a new gig, understand how the organization handles failure. Ask for anecdotes and stories about projects that went south. Did anyone live to tell the tale? Or are they all urban legends because all the bodies are buried throughout the organization? Ask how success is defined, and whether a similar amount of effort is spent on defining failure. Go in with your eyes open, and don’t have what sales folks call happy ears when you don’t get answers you like. I do believe failure is your friend. Maybe that’s my own confirmation bias talking, because I have failed more than most. But regardless of your job role, you can embrace failure and do your job better for it. Really. Share:

With some fanfare, the US executive branch (the White House) unveiled a proposal for cybersecurity legislation “focused on improving cybersecurity for the American people, our Nation’s critical infrastructure, and the Federal Government’s own networks and computers.” At first glance, it’s more of the same. Which is not much. A lot of it is voluntary, which means it won’t happen. Like government assistance to industry, states, and local governments when a breach happens. Sounds a lot like the scariest statement you can hear: “We’re from the Government, and we’re here to help.” I guess there is some value to understanding the process to engage the feds, especially if you plan to use APT in your PR spin. There are also some ideas on voluntary information sharing, which would be great. Again, if it happens, but there are many pesky details to figure out before you can actually share information safely, as I discussed in the Benchmarking series. The section on Protecting Federal Government Computers and Networks is also more of the same. Update FISMA. Yawn. Give DHS more flexibility to hire security folks in a competitive market. Good luck with that. They also want to give DHS purview over all the federal IPS devices protecting civilian computers. That’s great news for investors in IPS companies, as it means the feds will continue buying IPS forever. You thought it was hard to kill a technology in your shop? Imagine if you needed an act of Congress to change your architecture. (Note: I am aware there is some flexibility in what is called an ‘IPS’.) Guess the IPS lobbyists are better than the AV lobby, as they didn’t get mentioned specifically. The feds are also embracing the cloud and want to put some language in there to prevent specific states from mandating where a data center is built. Good luck getting that through Congress. The Fact Sheet also talks about privacy issues and consulting “privacy and civil liberties experts,” while requiring approval of the Attorney General to implement the cybersecurity program. This will ensure folks are doing the right thing, right? That makes me feel comfy, since the AG always has our best interests in mind (PATRIOT Act, anyone?). What could possibly go wrong? Not sure this is change we can believe in. With one exception. We all like the new National Data Breach Reporting requirement (it’s about time!), and the ability to use RICO to prosecute computer criminals. Accepting that a lot of computer crime is driven by organized crime factions, which are typically prosecuted through RICO, is progress. Treble damages are no fun, nor are 20+ year jail terms. If you believe in penalties as a deterrent for crime this is good news. And something I think they will have very little trouble getting passed. But let’s be clear about the reality. This is just a legislative proposal. Now the fun begins, where lobbyists, special interests, and all the other wackiness kicks in to water this down before it becomes a law, and to bolt about $10 billion worth of pork onto it. You’ve got to keep the locals happy, no? I know, I’m a little cynical. I’m glad Howard Schmidt is keeping busy with press releases, but this new proposal will have no short term and limited mid-term (2-3 year) impact. Like the changes resulting from the 2009 Cyberspace Policy Review. Right – there were none. In the computer security world, being two days behind the times is a killer. Legislation is 5 years behind on a good day. And that’s being kind. Unless you sell IPS – then you are probably pretty happy. Share:

If you follow me on Twitter (@rmogull) you might suspect that last week I took a short vacation. And that said vacation started somewhat auspiciously. And said event really pissed me off to a degree I normally don’t let myself hit. And, just perhaps, American Airlines was responsible. Like many of you I spend a heck of a lot of time in airports. Enough that I tend to shun personal travel since it isn’t really worth the hassles. Starting a vacation at the airport is, for me, like trying to start a vacation by heading to work in a traffic jam, hunting for a parking spot, getting groped by the security guard at the door, and having my ass duct taped to a chair for 5 hours while being force-fed flavored cardboard. Well, I suppose there’s beer and wine. If by “beer” you mean some piss-yellow watered down crap with a german name, and by “wine” you mean a small bottle of grape juice likely fermented in a cattle stall. Back to the story. This trip was special. It was the first time my wife and I would get away without the kids since our second little nugget showed up. Plus it was for my 40th birthday and our 5th anniversary. The idea of sleeping more than 3-4 hours at a stretch was drool-inspiring. Our first plane took off on time. It even landed early. WAY early. At the airport we started from. With a mechanical. As soon as we hit the runway I was calling AA and holding a space on a backup for our connecting flight. Then we were told it would be a 2 hour wait (at least) so I was back on the phone getting our next flight, and then an even later connecting flight to our eventual destination. Our new flight was then delayed. With a mechanical. We landed with mere seconds to spare for us to get to our connecting flight, so we literally sprinted through the airport and arrived maybe 60 seconds after the 10 minute cutoff. Most airlines will hold a connecting flight for a minute or two, or at least leave the gate door open a little longer, if they know there are connecting passengers and it’s the airline’s fault they’re late. But not AA. That door slammed closed leaving about 5 of us (from different delayed flights) waiting another 4 hours for the next one. For the first time ever I asked to speak with a supervisor. He told me that because they were #16 of 17 for on-time rate, they never hold flights. Nice. So they get to maybe improve their numbers and piss off their passengers in the process. While I was speaking with him about a half-dozen other passengers from different flights and connections all made the same complaint. This is a classic example of focusing on a metric to the detriment of the business. As for us? We finally got to our destination over 7 hours late. On the upside it was the Margaritaville Beach Resort and the bar was still open. I wasn’t quite as angry after my first top-shelf marg. By the time we saw Jimmy Buffett at the New Orleans Jazz Fest? Well, heck, I would have kissed one of those crappy AA planes. On the nose, not the tail. It isn’t like I’m some sort of weirdo. On to the Summary: Webcasts, Podcasts, Outside Writing, and Conferences Adrian’s Dark Reading Post on Secure Access to Relational Data. Rich’s Cloud Encryption Use Cases. (registration required) Favorite Securosis Posts Adrian Lane: Thoma Bravo Trips the Wire Fantastic. Money trumps security strategy. Mike Rothman: SIEM: Out with the Old. SIEM is not the only technology companies are looking to swap out in the near term. Adrian does a good job of dealing with how to select that new SIEM. Rich: Sophos Wishes upon A-star-o. First we like RSA/NetWitness, now this. I swear we must be going soft or something. Other Securosis Posts Incite 5/11/2011: Generalists and Specialists. Incomplete Thought: Existential Identities (or: Who the F*** are You?). Favorite Outside Posts Gunnar: Process kills developer passion. Best practices sound good in isolation, but they can suck the life out of developers. Adrian Lane: Process kills developer passion. When you de-Agile Agile, it’s no longer Agile, and no freakin’ fun! Mike Rothman: A Veteran of SEAL Team Six Describes His Training. Not security related, but a great read. These guys are bad ass. Pepper: Apps to stop data breaches are too complicated to use. Sounds like folks need guidance, eh? 😉 Rich OpenStack Beginner’s Guide for Ubuntu 11.04. I’ve been banging my head against OpenStack and this is the best how-to guide I’ve hit. Research Reports and Presentations React Faster and Better: New Approaches for Advanced Incident Response. Measuring and Optimizing Database Security Operations (DBQuant). Network Security in the Age of Any Computing. The Securosis 2010 Data Security Survey. Monitoring up the Stack: Adding Value to SIEM. Network Security Operations Quant Metrics Model. Network Security Operations Quant Report. Understanding and Selecting a DLP Solution. Top News and Posts Google Fixes Two Chrome Bugs, Adds Flash 10.3 to Browser. Microsoft Security Intelligence Report (SIRv10) released. Zeus Source Code Leaked. VUPEN Whitehats Claim To Have Broken Chrome Sandbox. FCC Chairman becomes FCC Lobbyist. For a firm she just ruled in favor of. Meredith Attwell Baker rates an 8.5 on the scumbag scale. Microsoft Patch Remote Code Execution Vulnerability in WINS. Anonymous Splinter Group Implicated in Sony Hack. FBI Spyware and Electronic Surveillance. Blog Comment of the Week Remember, for every comment selected, Securosis makes a $25 donation to Hackers for Charity. This week’s best comment goes to Zac, in response to Earth to Symantec: AV doesn’t stop the APT. I’d like to point out one of the massive flaws in our security systems – one that all the vendors out there exploit: those that make the purchasing/planning decisions at most of the businesses / institutions / governments / etc.

With the global economy apparently warming and lots of IPOs hitting the Street, it was a bit surprising to see TripWire opt for a buyout by Thoma Bravo, as opposed to continuing with their IPO plans. But I found an article by the local Portland OR Business Journal which explained things a bit. Basically, TripWire is growing at 20%/year, but that does not create a lot of buzz on the Street compared to monster growth stories like Groupon. They also mismanaged expectations a bit last year when they issued the S-1, by talking about hitting $100MM in 2010 revenues, then missing their target (hitting $86MM on the top line). It’s ancient history, but ask SourceFire about not hitting investor expectations when going public. So the stock was likely to languish and that’s not good for anyone. Clearly their investors were tired (having been with the company since 1997), so something had to give. The private equity buyout by Thoma Bravo provided liquidity for the investors (and some founders/early employees) and the runway to continue building the company. Thoma Who? You probably haven’t heard of Thoma Bravo before. They are a buyout firm, specializing in tech companies. You may know a couple of the companies in their security/IT management portfolio: Attachmate (which just acquired Novell after swallowing NetIQ a few years ago), SonicWall, Entrust, LANDesk, and now TripWire. It’s a pretty broad portfolio of mature companies that aren’t really leaders in their respective spaces. That’s why they got bought out in the first place, but these mature companies generate significant revenue, which can be milked and perhaps used to buy other assets. You all know the game in private equity, right? They acquire assets (usually using a mix of equity and debt), clean things up either by fixing operations or merging with other companies to gain scale, and then take the asset public again or sell it to a strategic buyer. If it works out, they generate tremendous returns using the leverage of the equity/debt mix. If you buy an asset like Chrysler (as Cerberus did), that might not work out. But if you look at the Forbes 400 of really rich folks, quite a few specialize in buyouts. So evidently it can be a pretty good model. Thoma’s security portfolio is pretty comprehensive and they have the pieces to compete against some of the bigger players in the space. But only if the various companies are integrated to some degree. Thoma has not talked about any larger strategy in the security market but don’t assume they have one. Maybe they just see a couple companies that can operate more efficiently and at some point provide a decent return on the investment – we will see. Market Impact The fact that the deal was announced as a standalone may mean they plan to leave TripWire alone, especially since the Business Journal story reports that Thoma tends not to mess with its companies. If so there will be little to no impact on existing TripWire customers. Given the market opportunity in security this seems like a mistake to me. Moving forward, security is all about reducing the complexity of protecting a very complicated environment. Having 5 standalone security companies does not reduce complexity for customers, wasting any leverage TripWire could provide with Thoma. If you believed in TripWire as a long-term, sustainable standalone company, this approach is fine. Personally, I think there are only a handful of sustainable, standalone security companies, and TripWire isn’t one of them. So over time I hope they fold into a more comprehensive offering. For the time being, TripWire keeps doing their thing, looking for smaller tuck-in acquisitions and trying to grow to the next level. That just seems like a horrible waste of assets. Folks like McAfee and Symantec have spent years assembling large portfolios of products to package into solutions for customers. Thoma Bravo now controls a significant security portfolio, and with a few more strategic acquisitions (such as monitoring, endpoint protection, and professional services/integration) they could have enough to legitimately compete with Big Security. That assumes competing with Big Security is the end goal, and I’ve been around way too long to think I understand the strategy of any financial buyer. I know the motivation (generate return on investment), but there are plenty of ways to skin that cat. Share:

Looking back over 30+ years, I realize my athletic career peaked at 10. I played First Base on the Monsey Orioles (“Minor League”). Our team was stacked, and we won the championship. I kept playing baseball for a few more years but my teams never made it to the championship, and when the bases moved out to 90 feet my lead feet became the beginning of the end. But it’s okay – I was pretty good with computers and in chess club too. Yep, I was fitted for my tool belt pretty early. When I grew up, you played baseball in the spring. Maybe soccer or football in the fall (and yes, I know they are the same thing outside the US). Some kids also played basketball or hockey over the winter. But now the choices are endless. The new new thing is lacrosse. It seems very cool and is clearly competing with baseball for today’s kids. But the variety is endless. I live in the South, where you can play tennis 10 months a year, and many kids do. My girls dance. There are martial arts and gymnastics. Some kids pick up golf early too. The Boss and I have tough decisions to make every year, because the kids literally don’t have time to do even a fraction of what is available. But this begs the question: generalist or specialist. Some kids play travel baseball. They don’t have time to do much else, so they (or their parents) decide to specialize on one sport. The twins are 7, so we don’t have to push them one way or the other quite yet, but our 10-year-old seems to love dance. She had better, because two days a week and showcases cost a fortune, and don’t leave much time for her to do anything else (while still doing well in school). At some point the kids have to choose, don’t they? Maybe yes, maybe no. The genetic reality is that none of my offspring are likely to play professional sports. I can’t categorically rule it out, nor will I do anything to discourage their dreams. It’s cute to see the boy talk about being a football player when he’s big. But the realist in me says the odds are long. Aren’t they better off becoming well-rounded athletes, able to compete in multiple endeavors, rather than just focusing on one skill? To me it all comes down to passion. If the kids are so passionate about one activity that they have no interest in anything else, I’m good with that. On the other hand, if they can’t make up their minds, they can dabble. They are young. It’s fine. They’ll need to understand that dabbling won’t make them exceptional in any one activity – at least according to Malcolm ‘Outliers’ Gladwell – but that’s okay. As long as they learn the game(s), understand how to contribute to a team, be good sports, and grok the importance of practice, it’s all good. We don’t choose their paths. We just expose them to lots of different options, and see which appeal to them. Do you see where I’m going with this? Many folks feel they need to choose between being a generalist or a specialist in their careers. For us security folks, it means being a jack of all trades, or a master of one. Odds are, given the complexity of today’s IT environment, you can’t be both. There is no right or wrong answer. Sure it’s a generalization, but specialists tend to work in big companies or consulting firms. Generalists are more common in smaller companies, where everyone needs to wear many hats. The worst thing you can do (for your career and your happiness) is not choose. Don’t hate the job you just fell into, with no idea why you’re there or what’s wrong. If some of your tasks make you nuts, you should at least a) know why and b) have chosen that role and those tasks. But the only way to find the role for you is to try both ways. Like we’re doing with the kids – they can try lots of things and eventually they may choose one. Or not. Either way, they’ll each choose their own path, which is the point. Photo credits: “Blocway Paving Specialist Van” originally uploaded by Ruddington Photos Incite 4 U How many SkypeOut minutes can you buy for $8.5 billion? That’s right, sports fans, Microsoft is buying Skype for $8.5B (yes, billion). For a long time we security folks didn’t quite get Skype, so we tried to block it. Then it showed up on mobile devices, and that basically went out the window. The simple fact is that many companies harness cheap telecom to communicate more effectively throughout their far-flung empires. Given Skype’s inevitable integration into all things Microsoft, for those of you that haven’t figured out this VoIP thing the time is now. Like anything else, it’s about doing the work. You know: model the threats of letting certain folks use Skype. Understand the risk, and then make a decision. With a couple hundred million users, you’d think Skype was already mass market. But I suspect you ain’t seen nothing yet. So dust off that policy manual and figure out whether you want/need/can afford to enforce constrain Skype, and how. – MR Ask me nice: George Hulme’s recent post on Making An Application Security Program Succeed raised a couple good points, but reminded me of another angle as well. Rafael Los points out that secure code development is not part of the everyday development job, and developers trail IT management in preparedness and understanding. Gunnar reminds us that we need to keep expectations in check – SDLC is new to development organizations, and your best bet is to pick one or two simple goals to get things started. My point is that if you’re not a developer, you’re an outsider. An outsider telling developers how to do their job is doomed

About 4 years ago we saw the first big wave of replacements of older email security tools with a second generation we now call ‘content security’. Early email security products were deployed in-house and focused on anti-virus, anti-spam, and mail server integration. The current generation of products offered new SaaS and hybrid deployment models, technology advancements in web and content filtering, more elastic service sets, and centralized web management consoles. And let’s not forget the larger security firms with products lagging far behind the state of the art, milking their cash cows while smaller firms innovated. We see the same wave of succession right now in the SIEM market. First generation products – despite being entrenched – make customers uncomfortable enough to start asking what else is available. They are looking for better, easier, and faster. We hear numerous complaints about existing solutions: “We collect every event in the data center, but we can’t answer security questions, only run basic security reports.” “We can barely manage our SIEM today, and we plan on rolling event collection out across the rest of the organization in the coming months.” “I don’t want to manage these appliances – can this be outsourced?” “Do I really need a SIEM, or is log management and ad hoc reporting enough?” “Can we please have a tool that does what it says?” “Why is this this product so effing hard to manage?” We see new products designed to both improve scalability and come closer to real-time analysis. They can collect events from just about every type of network device and application, normalize, and provide better drill-down capabilities. And there are many new analysis features – including enrichment, attack signature patterns, and application-layer monitoring. The first generation of products are looking old and I hear more and more unhappiness with today’s entrenched solutions. I ran across Anton Chuvakin’s How to Replace a SIEM? this week. But his tips apply to a wider audience than just Cisco MARS customers kicking other vendor tires. He offers two excellent vendor migration suggestions that bear repeating. First, leave the existing system running for some time – at least through the migration. This way you are still covered during the migration, and in the event previously collected data is not compatible across systems, you can still run reports and access forensic data. I have seen cases of “rip and replace” where the old system is removed while – or even before – the new system is up and running. That means no coverage for a (potentially extended) period. I sometimes call that ‘optimism’, but you may prefer another term. The sales process is a good time to ensure your (new, hungry) vendor can run in parallel with your existing tool – don’t buy it and then let them tell you that’s an unsupported scenario. Second, have the new vendor help with setup. Deployment issues are some of the most serious problems we hear of. Hiring the vendor not only helps avoid many pitfalls, but also makes it easier and quicker to replicate the rules and reports you currently use. And during the sales process you can negotiate attractive pricing on getting the work done as a condition of the sale. But before you replace a SIEM there are a couple other things you need to consider: Post Mortem: What exactly are the problems with the existing system and what do you hope to accomplish? It’s not hard to come up with a list of problems and areas for improvement – it’s much harder to vet a new technology to confirm addresses your demands without adding its own slew of new pitfalls. The problem here is that vendors will tell you they can do whatever you ask for. Realistically, you need to check with other customers who already own and operate new products before you buy – see what their experiences have been. What you have: The SIEM you have was installed for a reason. Actually, they are normally installed for several reasons, to address a list of business and security problems which grows over time. It’s easy to forget everything your system does when its failings are so easy to see. Make sure you have a complete understanding of what issues are currently being addressed and must be replicated on the new system. This includes compliance and security functions across management, operations, and security organizations. Worse, the existing SIEM likely feeds data to other systems you forgot about. The list you build is almost always much longer than expected. The good news is this process saves time and avoids trouble down the road, and helps form RFP questions and guide proof of concept testing. You want a new product that handles your new wish list, but don’t give up on any core reasons you are already running SIEM. SIEM replacement can be easier than a first installation, but you need to leverage the knowledge you have to make it so. That may sound easy, but it takes work to gather the organizational memory you need and clearly document your goals moving forward. Share:

Do you ever think about how you could just disappear? Or become someone else? Maybe only I do that after reading one too many Jason Bourne novels. Given anyone’s ability, with a keyboard and an Internet connection, to become anyone (even Abraham Lincoln is spewing quotes on Twitter now), what does ‘identity’ mean now? In the future? And is your ‘identity’ singular, or will it become identities moving forward? This interview on NetworkWorld with a guy who specializes in making folks disappear was fascinating. Mostly because the approach is totally counter-intuitive. You’d probably guess it’s about hiding your identity or taking someone else’s. But it’s not – at least according to this guy who helps folks hide for a living. It’s about making it hard (if not impossible) to find you through disinformation, using tactics like manufacturing online identities with the same name and sending anyone trying to find you on a wild goose chase. Unless you have someone very motivated to find you personally, this should work like a charm. Think about that for a second. Maybe even think about it from my perspective. There are already a bunch of Mike Rothmans out there. I went to college with one. Yes, a guy with my name – even down to our common middle initial – ended up in the same class at the same college. And that’s without even trying. What if a bunch of new Mike Rothmans showed up? How would you know which one(s) was really me? Maybe I’m not a great example due to my attention whoring disorder – I want you to find me, at least online. But less public folks could likely disappear with little fanfare, leaving a myriad of false trails. So as The Who sang years ago, “Who the F*** are you?” False identities are created every day, with severe ramifications. Think about all those crazy parents creating Facebook identities to spy on their kids or make their kids’ rivals look bad. In this age of social networking, citizen journalism, and Twitter, identity matters but is increasingly hard to define – and even harder to verify. Some folks have been able to get verified Twitter accounts, which could then be hacked. We talked about identity verification and non-repudiation as this ecommerce thing caught fire a few years ago, and we basically forget about it and forced the credit card companies to take on most of the liability from it. Then they forced the merchants to eat it. Risk transference for the win. And now the media seems to fall hook, line, and sinker every time a “citizen journalist” creates a meme, which turns out to be just a front for some big nameless company driving its own agenda. Folks take seriously what they read on all these myriad communication vehicles, regardless of source. And everyone engaging in social networking contributes. As long as they don’t exhibit trollish behavior, it looks like most of us have no issue linking to them and including them as part of the conversation, even though we don’t know who they are. I know I do, fairly frequently. I’ve been struggling with my position on anonymous folks for years. I get that some folks cannot divulge their real names because it could cost them their jobs. But do I continue giving these unverified folks any airtime? And what do I tell my kids? I constantly harp on honesty and honorable behavior. But I’m trying to show them that not everyone holds themselves to the same ethical standards. It’s important they do not believe everything they read or hear. They need to do the work, and figure out what is real and what is not. What they want to believe and what they want to reject. Given this lack of identity, the problem is going to get worse. Where is identity going? How will we verify who is who? Do we even need to? What’s the significance for how we do security? At this point I don’t have any answers. I’m not even sure I know the questions. I know Gunnar and Adrian have been thinking quite a bit about how identity evolves from here. I plan to pick Gunnar’s brain at Secure360 this week, and plenty of other big brains. If you have given some thought to this, please let me know what you think in the comments. Share: