Research

Earlier this year I participated in the 2014 Open Source Development and Application Security Survey, something I have participated in the last couple years. As a developer and former development manager – and let’s face it, an overtly opinionated one – I am always interested in adding my viewpoint to these inquiries, even if I’m just one developer voice among thousands. But I have also benefitted from these surveys – looking at the stuff my peers are using, and even selecting open source distributions based on these shared data points. Crazy, I know, but it’s another way to leverage the community. But I am equally interested in the survey questions asked, as they hint at what the sponsors are most interested in learning about their community. The organization that conducts this survey is Sonatype, and the 2014 survey was their 4th annual review of open source usage. This year’s survey was co-sponsored by Contrast Security, Rugged Software, NEA, and the Trusted Software Alliance. What piqued my interest is that this year is that I noticed more questions regarding security and vulnerabilities than in previous years. Even the name of the survey changed. But another interesting facet is that the survey was conducted right when OpenSSL’s Heartbleed vulnerability was discovered. It takes a lot for a security vulnerability to make mainstream news, but Heartbleed managed it. For any of you reading this who were not aware of it, OpenSSL is an open source implementation of the SSL protocol. The disclosure simultaneously illustrated that open source components are in use just about everywhere – across industries and organizations of all sizes – and disrupted IT practitioners’ blind faith in this ubiquitous cryptographic module. But Heartbleed is not the story here – the more interesting thing is how it affected people’s understanding of open source software and security. My question was “Did the vulnerability change the survey results?” In past years Sonatype provided us with a pre-briefing before they announced the survey results, and this year was no different. And after going through the survey myself I was extremely interested in the results. As we went through the data and discussed what it all meant, Sonatype said they were interested in getting someone to perform an independent analysis of the data. You don’t have to ask me twice – I jumped at the chance! As a security practitioner who has built software and managed development teams for a couple decades, I could offer some perspective. And we are beginning to see changes in developer attitudes and participation with security, not to mention a disruption of development approaches with DevOps, so I am eager to go through the data to better understand what developers are doing and what issues they face – in both security and product development. So over the next couple days I will discuss the results, with a focus on two key areas: Security Trends Analysis: The survey poses several questions about security and open source policies as they relate to security, vulnerability tracking, and responsibilities. We will examine tools usage, with trending data from prior years where applicable. Because the survey was conducted during the Heartbleed and Struts vulnerability disclosures, we can examine the data for important differences between responses, before and after disclosure. Development Trends and Operations Management: The survey data contains several important questions on development policies around open source management and use. These trends may not have specific security implications, but they impact how teams manage open source and the general quality of their releases. I will discuss trends in open source policy management, licensing, and security testing approaches; as well as where security testing occurs within the development process. I will highlight key takeaways and make recommendations. Finally, for those of you in security who are not familiar with Sonatype, think Apache Maven and Nexus. Their founder built Maven, which is probably the most widely used build automation tool out there. The company also builds the Nexus repository manager, used by over 40,000 organizations for storing and organizing binary software components, including management of policies for their use and automated health checks for security vulnerabilities. As the steward of the Central Repository, which handled over 13 billion requests for open source components last year, they are in a unique position to monitor use of open source development components – including version management, license characteristics, update frequencies, and known security vulnerabilities. This perspective helped them formulate the survey and reach the 3,300+ development professionals who participated. Next week I will cover the report’s security trend analysis. And if you’re interested I will also do a webcast with Brian Fox of Sonatype to discuss the highlights, comparing and contrasting our views on the results. Check it out! Share:

Rich here, When I grew up in New Jersey, summer didn’t really start until June 25th, the day we got out of school. It was weird to me when I moved to Colorado and school ended in May and started in August, but people also used the word “pop” to describe soda, so I figured it was a wacky cultural thing. These days I live in Arizona. Today is June 5 and the temperature should hit 110F. Yesterday it was over 90F by the time I finished breakfast. This. Is. Wrong. I think summer for us started somewhere around the end of January. We have since moved on to a fifth season I fondly call “Ohforfu**’ssakeum”. It isn’t in the books but I am working up a Wikipedia entry. Summer for my children will be very different than I what I grew up with. There’s no simple wandering around the neighborhood looking for your friends, because within a block their shoes will melt and adhere them to the middle of the street, only to be run over by an Amazon delivery truck or one of the 950 landscapers patrolling the area. They’ll get plenty of time at the pool but we need to keep a close eye on them and make sure they jump out every now and then to cool off in the air-conditioned bathroom. Arizona isn’t all bad. For most of the year the weather is about as perfect as you could want. Plus you save a lot on winter clothes. On the downside I miss sweatshirts, and the nearly 20 years I spent cultivating a fleece-based fashion identity is totally wasted. We will be spending a lot of time outside the state this summer. A trip to the Irish festival in Lawler, Iowa (no, I’m not kidding). Then the month of July in Boulder. Then Black Hat and DEF CON for me, and kindergarten for my oldest a week after I get back. But I’m sad for my kids. Summers growing up in Jersey could get pretty hot and muggy, but you could still wander around the neighborhood looking for other kids without having to refill your Camelback 8 times. Then again, rumor is no one lets their kids wander around and experience life any more, so I suppose it won’t make much difference that mine will do the same overly-structured activities as everyone else, but with better air conditioning. But if you make it up to the Irish fest, let me know, and vote for my kids in the Little Lass and Laddie contest. On to the Summary: A quick note: Our posting volume is down to balance some pretty insane demand for our services against family summer time. Don’t worry, we have cool things in store for you coming up. Besides, we still write more than pretty much anyone else who doesn’t get paid by page views. Webcasts, Podcasts, Outside Writing, and Conferences I wrote an article for Macworld on what I learned about upcoming Apple security from WWDC. Favorite Securosis Posts Adrian Lane: Firestarter: Sputnik or Sputput. Sputnik? Nyet! Mike Rothman: Firestarter – Even though I wasn’t there, the show must go on. And it did – admirably. Rich: Cloudera acquires Gazzang. Because it’s good analysis. And the only other thing we posted. Favorite Outside Posts Adrian Lane: Peek Inside a Professional Carding Shop. It’s a good read and I can’t help laugh at the clever use of the McDonalds meme. Mike Rothman: A Hacker Looks at 40. Really good post by Shack. Great to see gratitude, not whining. And there is no question Shack knows exactly who he is. Rich: Rob Graham asks Can I drop a pacemaker 0day? Very well thought out as usual, and hard questions society probably isn’t ready to deal with. Dave Lewis: John Oliver’s net neutrality rant may have caused FCC site crash. You really need to watch it – pure genius. David Mortman: Lego to produce female scientist minifig set. Finally. Gunnar Peterson: Adam Carolla versus patent trolls going after podcasters. Bonus outside link: it takes a minute, but pure awesome once you figure it out. Behold, this is the greatest GitHub software repository of all time. Research Reports and Presentations Defending Against Network-based Distributed Denial of Service Attacks. Reducing Attack Surface with Application Control. Leveraging Threat Intelligence in Security Monitoring. The Future of Security: The Trends and Technologies Transforming Security. Security Analytics with Big Data. Security Management 2.5: Replacing Your SIEM Yet? Defending Data on iOS 7. Eliminate Surprises with Security Assurance and Testing. What CISOs Need to Know about Cloud Computing. Defending Against Application Denial of Service Attacks. Top News and Posts Another big OpenSSL bug. Violet Blue has good details. GameOver Zeus botnet disrupted by FBI. Network Security, Build To Fail. Mounties join crack down on Russian cyber crime. Pirate Bay Founder’s Computer Was “Hacked”, Investigation Reveals. US cybercrime laws being used to target security researchers. DARPA Cyber Grand Challenge Finale Set For DEF CON 2016. Share:

Today Cloudera announced that they have acquired Austin-based data encryption vendor Gazzang. From the press release: While Cloudera customers will continue to have a choice of a broad range of cross-platform data protection methods available from Cloudera partners, Cloudera now offers encryption for all data-at-rest stored inside the Hadoop cluster – using an approach that is transparent to applications using the data, thereby minimizing the costs associated with enabling encryption. Cloudera plans to focus the efforts of the Gazzang team on additional security challenges in Hadoop. The team will become the heart of the Cloudera Center for Security Excellence focusing exclusively on Hadoop security. The “Big Data” market is growing rapidly, and for good reason. The ability of leverage inexpensive NoSQL databases like Hadoop, running atop cheap commodity/cloud hardware, means companies can do all sorts of analysis that was previously economically unfeasible. From large enterprise to small startups, companies are adopting NoSQL platforms for just about every use case imaginable. And while these companies won’t necessarily admit to the presence of sensitive data on these clusters, it’s there. This creates a genuine need for security with NoSQL platforms, something which the open source community has not really delivered. If you remember our series on securing Hadoop and NoSQL clusters in 2012, one of our principal recommendations was to use transparent encryption for NoSQL. That’s because you get data security while still allowing big data to maintain scalability and input velocity. Those may seem like obvious requirements, but they are not givens for most security products. Gazzang is, at its core, is a transparent data encryption tool with key management. Enterprises are adopting big data solutions, despite what some mainstream publications have stated, but only when they can satisfy data security and compliance requirements. Cloudera’s ability to address the enterprise’s most critical security requirement – data encryption – directly on the platform is a big win for security sensitive customers. Even better, Gazzang’s transparent encryption scales right along with NoSQL clusters so Cloudera customers get data security at big data scale. Cloudera is one of a growing group that includes MapR, Hortonworks, Datastax and Zettaset, positioning security as a differentiator to enterprise customers. Bundling encryption and key management capabilities into platforms will make them faster and easier to deploy – a win for customers. I usually have a handful of risks and downsides for every acquisition, but it is hard to criticize this deal because there are not that many possible downsides. This is an astute acquisition by Cloudera. Share:

Mike is off giving a giant mouse all his money, so Rich and Adrian ran the Firestarter as a duo this week. The question of the day is: Are we in a Sputnik moment? Did the Target breach shake things up so much that security is moving up the chain? Or are these short-term reactions, which will fade with our memories of what happened? We keep these notes short, but here is a link to the Reuters article we mention. The audio-only version is up too Share:

I am a pretty upbeat person, and despite my tendency towards snark I am optimistic by nature. You might find that surprising, given my profession of computer and software security, but it’s not. I have gotten a daily barrage of negative news about hacks, breaches, and broken software for well over a decade now. Like rainwater off a duck’s back, I let the bad news wash over me, and continue to educate those interested in security. Sure, I have had days where I say “Crap, security on everything is broken – and worse, nobody seems to get it.” Which is pretty much what Quinn Norton said last week with Everything is Broken. But her article was so well-written that it got to me. It is a testament to the elegance and effectiveness of her arguments that someone as calloused as I could be dragged along with her storyline, right into mild depression. It didn’t help that my morning reading consisted of that and this presentation on how the Internet and always-on connectivity may be making our lives worse. Both offer a sober look at the state of security and privacy; both were well done, with provocative imagery and text. And I admit, for the first time in a long time, I allowed them to get to me. Powerful posts. I think most people in security get to this same point of frustration at some point in their career. Like Quinn, I try to un-frack my little corner of the world whenever possible. Perhaps unlike Quinn, I accept that this is a never-ending game. Culture is not broken – it is in its natural state between civilization and chaos. It just pisses us off that it’s our own government spending our tax money to create so much of the chaos. Computers and electronic systems are probably a bit more secure from Joe Hacker than they were in 2001 – about when I came to this realization – but government hackers and criminals are much better too. For most folks the daily grind is a balancing act, where things are only unbroken enough to work most of the time. Those of us in security think that if you don’t control your systems, they are essentially non-functional and broken. But for the people people who own the systems, software, and devices there are many competing priorities to worry about; so they put just enough time, effort, and money in to patch things up to achieve their acceptable level of dysfunction. In the balancing act I can apply some affect momentum, but not define the balance point. At least that’s what I tell myself as I swing in my hammock, shaking off the blues. On the totally opposite end of the spectrum is Shack. And thank $DEITY for that! His post this week – A Hacker Looks at 40 – is a classic. Reading it is like surfing the banzai pipeline. “First, the industry we’re in. WOW. What a shit show … Yeah, it is volatile, and messy, and changes all the time. Thank goodness.” It’s all that an more. Loved Shack’s #1 takeaway: Learn Constantly. That is one of Rich Mogull’s too. You may be tired of hearing about cloud, mobile, and big data as disruptive tech; and the term DevOps makes many wince, but once you jump in it’s awesome and exciting. What a great time to be in security! They say there is no such thing as bad press, but Ubisoft’s promotion of Watch Dogs got pretty close. Apparently they anonymously mailed a black safe to several media outlets, including Ninemsn. Locked, of course. Then they mailed an anonymous letter telling the recipients to check their voicemail. And left anonymous voicemail with the PIN to open the safe, but not before it started beeping. Cool, right? But Homer Simpson was not there to open the safe for them, so Ninemsn called the bomb squad. After the initial panic and clearing of the building, a copy of the new Watch Dogs game was found. Ah, good times! The presence of booth schwag is unconfirmed. I am just disappointed that the bomb squad wouldn’t say whether they liked the new video game or not. I mean, getting the word out was the whole point, right? On to the Summary: Webcasts, Podcasts, Outside Writing, and Conferences Mike quoted in Do you really think the CEOs resignation from Target was due to security?. Favorite Securosis Posts David Mortman: What You Need to Know About Amazon’s New Volume Storage Encryption. Adrian Lane: What You Need to Know About Amazon’s New Volume Storage Encryption. I say “Cheap, Fast, and Easy” wins, and AWS made volume encryption just that. Mike Rothman: What You Need to Know About Amazon’s New Volume Storage Encryption. Amazon is pushing things forward pretty quickly. Pay attention to their new stuff. And what Rich didn’t mention is that every time Amazon changes stuff, he has to update our CCSK training screenshots. So I think he’s secretly hoping for slower innovation… Other Securosis Posts Incite 5/28/2014: Auditory Dissonance. Translation Machine: Responding to (Uninformed) Bloggers. Summary: A Thousand Miles. Favorite Outside Posts Dave Lewis: ISS’s View on Target Directors Is a Signal on Cybersecurity. If you are keeping score at home we have a number of firsts: CIO dismissal, credit rating downgrade, CEO dismissal, boardroom shakeup. That is a lot of firsts – this is a Sputnik moment for security. David Mortman: Postmortem for outage of us-east-1. <– Joyent accidentally reboots an entire data center. Not a pure security issue, but input validation (or the lack thereof) strikes again James Arlen: TrueCrypt’s demise. Kees Leune nails the TrueCrypt thing in this post. Adrian Lane: A Hacker Looks at 40.. Mike Rothman: Tribal organizing (right and wrong, slow and fast). It has been a while since I linked to Godin. This is a good one about building a community – the right way. I love how he calls out folks for using invented urgency. We see that every day in security. Every. Single. Day. Rich: Why NSA Critics Are Wrong About Internet Vulnerabilities Like ‘Heartbleed’. I don’t agree completely with Aitel,

I didn’t want to become that Dad. The one who says, “Turn that crap down.” Or “What is this music?” Or “Get off my lawn!” I didn’t want that to be me. I wanted to be the cool Dad, who would listen to the new music with my kids and appreciate it. Maybe even like it. For a while, I was able to do that. Let’s backtrack a bit. I control the iTunes account in the house. That allows me to centralize apps for all the kids and their devices, and more importantly make sure we keep spending within reason. Even better, it gives me the ability to give the kids a hard time about buying an app or song. They love being scrutinized over a $1.99 app. Don’t tell them I spend more than that on coffee every day. To be clear, it’s not worth my time to even think for a minute about an app, but I still get enjoyment out of making them present a case for why they need the latest version of Clash of Clans or Subway Surfer. That also means that when XX1 wants to buy new music, she has to come through me. So about 3 or 4 times a year I get a list of 40-50 songs she wants to buy. She has her own money, so it’s not a money thing. But I won’t give her access to the account (since that would end very badly), so I have to buy the songs myself. Which means I have to listen to some of them. For quite a while, I was fine with that. I like some of the stuff XX1 listens to – statistically about half the pop music she listens to is tolerable with a decent groove and melody. But over the weekend I hit my limit. I was checking her song list before camp, and 90% of the music was just awful. And at that moment, I became that guy. The guy who just doesn’t understand the noise kids are listening to today. Of course I couldn’t let it go. I had to ask, “What the hell is this stuff?” She just shrugged. It’s her money, so I couldn’t tell her not to waste it on crap music. And I think I saw her chuckle the “you just don’t understand, old dude” chuckle. You know that chuckle because it’s how you reacted when your folks wondered about Elvis or the Beatles or Pink Floyd or Springsteen when you were growing up. I guess I am that old dude. And I just don’t understand. Though that doesn’t make it any easier to explain to my friends why I have Bieber songs in my iTunes library. Those songs are for XX1, really! That’s my story and I’m sticking to it. –Mike Photo credit: “Noise” originally uploaded by richardoyork The fine folks at the RSA Conference posted the talk Jennifer Minella and I did on mindfulness at the conference this year. You can check it out on YouTube. Take an hour and check it out. Your emails, alerts and Twitter timeline will be there when you get back. Securosis Firestarter Have you checked out our new video podcast? Rich, Adrian, and Mike get into a Google Hangout and.. hang out. We talk a bit about security as well. We try to keep these to 15 minutes or less, and usually fail. May 19 – Wanted Posters and SleepyCon May 12 – Another 3 for 5: McAfee/OSVDB, XP Not Dead, CEO head rolling May 5 – There Is No SecDevOps April 28 – The Verizon DBIR April 14 – Three for Five March 24 – The End of Full Disclosure March 19 – An Irish Wake March 11 – RSA Postmortem Feb 21 – Happy Hour – RSA 2014 Feb 17 – Payment Madness 2014 RSA Conference Guide In case any of you missed it, we published our fifth RSA Conference Guide back in February. Yes, we do mention the conference a bit, but it’s really our ideas about how security will shake out in 2014. You can get the full guide with all the memes you can eat. Heavy Research We are back at work on a variety of blog series, so here is a list of the research currently underway. Remember you can get our Heavy Feed via RSS, with our content in all its unabridged glory. And you can get all our research papers too. Understanding Role-based Access Control Advanced Concepts Introduction NoSQL Security 2.0 Understanding NoSQL Platforms Introduction Newly Published Papers Advanced Endpoint and Server Protection Defending Against Network-based DDoS Attacks Reducing Attack Surface with Application Control Leveraging Threat Intelligence in Security Monitoring The Future of Security Security Management 2.5: Replacing Your SIEM Yet? Defending Data on iOS 7 Eliminating Surprises with Security Assurance and Testing Incite 4 U At least there is consistency: Love those survey-based media campaigns, where a company sponsors a survey to determine that a certain industry is vulnerable. Just like every other industry. It’s awesome. So I enjoyed the FUD-tastic writeup of a survey paid for by ThreatTrack, which showed (through a whopping 200 person survey) that energy companies are vulnerable to attack. 61% said the biggest threat comes from email. Shocker. Web is next at 25% and mobile at 3%. Yup, that sounds about right. Even better, 40% thought they’d be targeted by advanced attacks. The other 60% have an appointment on Thursday to see their therapist to deal with the self-esteem issues. – MR That’s WEAK: eBay users are noticing for the first time – post breach of password hashes – that eBay does not allow long passwords. eBay sent email instructing users to reset passwords this week; one week after we heard about the data loss. But those are pesky details, right? Those who took it seriously enough to create strong passphrases to resist brute-force password cracking noticed their long passwords were not allowed. Worse, passwords longer than 20 characters were labelled ‘weak’. Not cool, but remember that eBay – like many firms – only uses passwords as one hurdle; they rely on fraud analytics and monitoring

Amazon Web Services dropped a security bomb this week when they announced the immediate availability of volume storage encryption. With one click, for free, you can encrypt any EBS (Elastic Block Storage) volume in AWS. For those who aren’t familiar with AWS, they are effectively virtual hard drives you attach to a running instance (virtual machine). I missed this one, but Contributing Analyst Gal Shpantzer picked it up and mailed it to us internally. I’m on a plane so I’ll keep this short and to the point: Encrypting a volume is a simple as checking a box when you create it, or making an API call. You cannot encrypt a boot volume. You can only encrypt additional volumes (extra “hard drives”, not the one you boot your operating system from). Amazon manages the keys for you. There are currently no provisions to manage your own key. Encrypting the volume protects it in snapshots, and as you make copies and move them around. This is similar to AWS encryption for S3, which has been out for a while. Here’s the context: Werner Vogels, Amazon’s CTO, has pretty much said the cloud is moving to encryption by default. This is another step in that direction. This is awesome for compliance. Technically it means Amazon (and thus a government) can see your data. However, Amazon has extremely strict segregation of duties internally and I strongly suspect it is nearly impossible, or even effectively impossible, for an employee to gain access to your key. But we cannot know this for sure until Amazon releases more details, and this does not protect you in case AWS receives a legal court order to access your data. The only real assurance you can have about complete control (privacy) for your data is control of your own keys (I consider CloudHSM a solid option, even though it is hosted in AWS). Before going too crazy with this… experiment with performance and file system requirements. My previous research showed there are always tradeoffs. They are pretty much always manageable, but only once you learn your way around the land mines. This will hurt some of the existing cloud encryption market, but not a lot. Many organizations encrypt to maintain high assurance, and this does not provide that. It does, however, knock out some compliance concerns; it also provides excellent basic data security if you don’t mind that Amazon could technically get your data in an extreme situation (such as legal discovery). It also doesn’t help with boot volumes. From now on I suggest you check this box by default once you complete performance testing. Where is this headed? Hard to tell. AWS allows customers to manage their own keys (using CloudHSM) for some services including RedShift and RDS. But they have yet to enable it for S3, even though that has been around for a while. In the long run I suspect AWS to enable CloudHSM management of S3 and EBS keys, but I have no idea of timing. Boot volume encryption is likely much further down the road, beyond the event horizon for analyst predictions. The cloud encryption market won’t take too much of a hit for a while. At the low end no one pays for encryption anyway. Above that, customer needs are beyond this. If you use AWS this is your easiest encryption option, but make sure you know what it provides: compliance, snapshot protection, and protection from single-point-of-failure access to your storage volumes. You will need to look at commercial alternatives if you want to encrypt boot volumes, manage keys consistently in hybrid or multiple-cloud deployments, assure Amazon can never see your data, or keep governments out. As always, hit me up with questions in the comments. Share:

One of the things I don’t miss about running a marketing team is worrying about responding to negative press. It’s a lot worse today, now that you not only have to spin less informed beat reporters who frequently troll for page views by misrepresenting competitive nonsense. But also bloggers and Tweeters who make things up say things about the product. So I thought I’d do everyone a service and translate this response from Palo Alto Networks’ Scott Gainey to Stiennon’s public supposition that PANW and FireEye violate Microsoft’s license agreement by running instances of Windows in their sandbox environment. I’ll excerpt from Scott’s blog post and provide my translation. Let’s be clear – Scott may or may not have been thinking these things as he was cobbling together his politically correct response. This is what I would be thinking if I were in his shoes. “Richard Stiennon recently wrote an informative article in Forbes…” Translation: Oh crap, what is he pronouncing dead this time? Informative? What I meant to say is “…wrote a speculative, click baiting, ambulance chasing pile of nonsense.” But I’m not Nir, so I can’t say stuff like that in public. Instead, I’ll just anonymously send him this eye chart. “Our solution was simple. Palo Alto Networks licenses every instance of Microsoft software on each WildFire WF-500. There were no shortcuts taken.” Translation: But clearly he took some shortcuts in his research. Boy, if that guy had done any work, he would have figured out that we have to charge a crapton of money for the on-prem version of the sandbox for this very reason. Those friggin’ pirates at Microsoft. They get paid coming and going. But I understand – how is he supposed to generate page views without poking high-flying public companies? “Recently, Microsoft notified us of a new licensing model designed for embedded security devices that use virtual instances of Windows. From our perspective, this decision will not impact our existing customers. We are actively engaged with Microsoft to take advantage of this new licensing model that we’ll transition to as soon as agreements are set.” Translation: I’m not sure if this guy is short our stock or something, but if anything the new licenses will make things more efficient for us from a cost of goods sold standpoint. Win! I’ll tip my hat to Scott. He presented a well-reasoned case, and didn’t get defensive or emotional about it. I probably would have had to write 10 versions of this thing before I could wring all the venom out. On the other hand, he could have just ignored Stiennon… like FireEye did. Photo credit: “Tablica do badania wzroku z reklamy Vision Express” originally uploaded by trochim Share:

The past week has been a bit of a whirlwind. Last Friday I flew out to Denver for a family thing, then transferred over to Boulder for a DevOps.com advisory board meeting, Camp DevOps (where I presented), and Gluecon. In between I spent a day with the friends who are loaning us their house for the month of July (while they caravan around the US with their kids), snuck in a 30 mile bike ride and 5 mile run, and hit some of my favorite Boulder restaurants (SouthSide cafe, Southern Sun, & Mountain Sun). I also learned I have a bad habit of telling people I’m “from Boulder but I live in Phoenix” when they ask. Camp DevOps was a really great event on multiple levels. First it was pretty great to be back on the University of Colorado campus. I spent 8 years there as an undergrad, and worked everything from low-level student jobs to full-time staff. It is where my IT career started, and I loved getting back and having the opportunity to share some of what I’ve learned in the decades since. Alan Shimel put on a solid first-time event. The very first track talk resolved an issue I have been researching (sending backups and logs to Amazon S3), and I picked up plenty of tidbits through the day. The Boulder tech community has a great vibe. It is very supportive in a way that is hard to replicate in larger cities which don’t shut down on powder days. Gluecon in Denver was also a solid show, although I wish I didn’t have to bail out early in an attempt to avoid some bad weather (more on that in a moment). Camp DevOps was also slightly intimidating for me personally. I was giving a technical security talk to a bunch of developers. The challenge was to keep their interest, provide relevance, and meet their deep content expectations. According to the feedback, I was right on target. And based on other sessions I attended, I have rebuilt a lot of skills I lost when I moved more into the analyst world. We in the security community often talk about developers like we do about Mac users. We assume they don’t care about security or prioritize it. In both cases, as I have become part of these communities I realized that they do care about security, but within a different context. It has to meld with their primary priorities, and we can’t harangue or insult them for their naivete. Participate, don’t preach, and you get a very positive reaction. Everyone wants to stay safe. And speaking of staying safe, Adrian left the event right in time to dodge a tornado at the Denver airport. We were in different terminals when the tornado warning hit, and Adrian texted that he was evacuated to the shelter as I started to wonder if my terminal… was less important. About 10 minutes later we got the order, and as a well-trained emergency responder I found a big window right next to one of the shelter areas. I joined the crowd gawking as the storm clouds started rotating overhead and the hail moved in, followed by blue skies. The tornado touched down 8 miles away, and my flight took off only an hour late. Oh well – I was really hoping to knock that one off the bucket list. On to the Summary: Webcasts, Podcasts, Outside Writing, and Conferences Mike quoted in Do you really think the CEOs resignation from Target was due to security? Favorite Securosis Posts Adrian Lane: Recitals. “The FUD is strong in this one” Mike Rothman: Firestarter: The Wife-Beater (t-shirt) edition. No spouses were harmed in the production of this week’s Firestarter. But we were able to give Adrian a hard time about his attire before we started recording. Which was full of win. The actual video cast was pretty good too, even though Rich was mostly pixelated. Rich: CEO on Line 2. Other Securosis Posts When Security Services Attack. Favorite Outside Posts Adrian Lane: Chip and Skim: cloning EMV cards with the pre-play attack. I am not certain how viable this attack is, but if it’s true you can use an arbitrary nonce value as part of a replay attack, this is a serious flaw. Mike Rothman: Buffett: Teach kids financial literacy to spark entrepreneurship. Adrian and Gunnar’s idol (and I’m a fan myself) has some great perspective on teaching kids about money. This sums it up: “Financial literacy is a base requirement like spelling or reading or something of the sort that everybody should acquire at any early age.” Yup. Rich: U.S. Companies Hacked by Chinese Didn’t Tell Investors (via The Verge). I still believe many, if not most, breaches aren’t reported – even when there is a legal requirement. I have been told in multiple cases that the companies determine it is in their interest not to disclose. Often they use the law enforcement investigation loophole. Gal: Lifelock deletes user data over safety concerns. Then Goldman downgrades them over concerns that their app wasn’t PCI compliant. Security and compliance has impact on the larger business… duh. Research Reports and Presentations Defending Against Network-based Distributed Denial of Service Attacks. Reducing Attack Surface with Application Control. Leveraging Threat Intelligence in Security Monitoring. The Future of Security: The Trends and Technologies Transforming Security. Security Analytics with Big Data. Security Management 2.5: Replacing Your SIEM Yet? Defending Data on iOS 7. Eliminate Surprises with Security Assurance and Testing. What CISOs Need to Know about Cloud Computing. Defending Against Application Denial of Service Attacks. Top News and Posts eBay Urges Password Changes After Breach ICS-CERT Confirms Public Utility Compromised Recently. NSA Reform Bill Passes the House–With a Gaping Loophole. Buzzkill: FBI director says he was joking about hiring weed-smoking hackers. There go the Washington and Colorado FBI offices… New IE8 0-day by ZDI. Share:

As we get into late May it is getting to be summer in the ATL. The kids finish up school this week, the pools open, and my standard work attire consists of shorts, a T-shirt, and flip flops. The Boss is frantically getting the kids ready for camp, and we have a few family trips planned before they leave. But first things first – this is the one week a year I won’t travel. It’s dance recital week. I used to be very diligent about not missing well check-ups with the pediatrician. But as the kids get older, especially the girls, it has become a bit awkward for me to be in the room. That’s a bit of a bummer, but I understand. Recitals are something else. I’m sure I have mentioned it before, but the girls don’t dance in the most competitive studio. There is no Black Swan action here. No anorexic high schoolers trying to audition for the Bolshoi. It’s a bunch of girls (and a few brave boys) with a passion for dance, which shows during recitals. So I gladly reserve a week at home, regardless of how loudly duty calls, and I’ll be watching recitals on Monday, Tuesday, and Wednesday nights. This has been an annual ritual for at least 8 years, and they all blur together. Lots of sparkles, sequins, and hair buns. Some ballet, modern, contemporary, tap, and even hip-hop. Each night they do maybe 25 routines. Seeing the 4 and 5 years olds go on stage brings back great memories. Seeing the seniors do their solos is a glimpse into the future. The studio just started a program with special needs kids, and it’s uplifting to see them get up on stage and dance as well. Limitations only exist in our minds, so it’s great to see kids up there held back by nothing but their own courage. Monday night’s show featured XX2 in 6 routines. She’s in a very large group, so sometimes it’s hard to see her. But she shines up on the stage like a supernova. With a featured spot in one of the routines, you could see the performer in her. The artist. I have no idea what her future holds but she’ll be in front of people in some way, shape, or form. She’s just too comfortable on stage to not pursue that path. Having gone for so many years, I have gained perspective into how the dancers grow – both physically and skills. The munchies (little girls) have no idea what’s going on. They wave to the crowd and muddle through the routine, and they just have a lot of fun. At some point when they are no longer little girls, we watch the routines and go holy crap, these kids can dance. That moment happened for me this year when I got to the studio a little early a few weeks back and saw XX1 practicing her modern dance routine. The last third of the routine I saw was beautiful. Their movements were graceful and fluid. They were in their element. It was all I could do not to tear up right there, seeing my girl and her friends blossom into dancers right in front of my eyes. I won’t see that routine live until Tuesday night (I write the Incite during the day Tuesday). I can’t wait. They say parents enjoy the accomplishments of their kids a lot more than their own. I’m working on recognizing my achievements, but there is nothing like seeing your kids having fun, doing something they are passionate about. So I’ll keep going to the recitals (and tennis matches and lax games) as long as they play and perform. And for those couple hours time will stop. As it should. –Mike Photo credit: “Melbourne Recital Centre” originally uploaded by Wojtek Gurak The fine folks at the RSA Conference posted the talk Jennifer Minella and I did on mindfulness at the conference this year. You can check it out on YouTube. Take an hour and check it out. Your emails, alerts, and Twitter timeline will all be there when you get back. Securosis Firestarter Have you checked out our new video podcast? Rich, Adrian, and Mike get into a Google Hangout and.. hang out. We talk a bit about security as well. We try to keep these to 15 minutes or less, and usually fail. May 19 – Wanted Posters and SleepyCon May 12 – Another 3 for 5: McAfee/OSVDB, XP Not Dead, CEO head rolling May 5 – There Is No SecDevOps April 28 – The Verizon DBIR April 14 – Three for Five March 24 – The End of Full Disclosure March 19 – An Irish Wake March 11 – RSA Postmortem Feb 21 – Happy Hour – RSA 2014 Feb 17 – Payment Madness 2014 RSA Conference Guide In case any of you missed it, we published our fifth RSA Conference Guide back in February. Yes, we do mention the conference a bit, but it’s really our ideas about how security will shake out in 2014. You can get the full guide with all the memes you can eat. Heavy Research We are back at work on a variety of blog series, so here is a list of the research currently underway. Remember you can get our Heavy Feed via RSS, with our content in all its unabridged glory. And you can get all our research papers too. Understanding Role-based Access Control Advanced Concepts Introduction NoSQL Security 2.0 Understanding NoSQL Platforms Introduction Newly Published Papers Advanced Endpoint and Server Protection Defending Against Network-based DDoS Attacks Reducing Attack Surface with Application Control Leveraging Threat Intelligence in Security Monitoring The Future of Security Security Management 2.5: Replacing Your SIEM Yet? Defending Data on iOS 7 Eliminating Surprises with Security Assurance and Testing Incite 4 U It didn’t take long to commoditize threat intelligence: We have been writing for a while about threat intelligence – most recently about how TI fits into the security monitoring process. Next up on our research plans is a look at how TI can be leveraged in incident response