A couple weeks ago we decided to change up the Friday Summary and update the format to something new and spiffy.
That… umm… failed.
All the feedback we received asked us to keep it the way it is, so since we’re only half-stupid we’ll learn our lesson and do what you tell us to.
However, this will be the last Summary of the year. We have lives, ya know?
And what a crazy year it’s been (at least for me). Securosis is doing very well – we’ve got a great customer base and can’t keep up with the research we are trying to pump out. Aside from getting to work with some great clients (seriously… some major breakthroughs this year), we also pumped out the CCSK training program for the Cloud Security Alliance and finished most of the development of version 1 of our Nexus platform.
On the downside, as I have written before, I took some body blows through this process, and my health bitch slapped me upside the head. Nothing serious, but enough to show me that no matter how insane things get I need to focus on keeping a good balance. I also have to lament to demise of blogging. I love Twitter as much as the next guy, but I really miss the reasoned, more detailed community debates we used to (and on occasion still do) have on the blogs.
Don’t get me wrong – I’m friggen ecstatic about where we are. The last (hopefully) set of updates are going into the Nexus over the next 2 weeks and we have a ton of content to load up. We also realized the platform can do a lot more than we originally planned, and if we can pull off the version 2 updates I think we’ll have something really special. Not that v1 isn’t special, but damn… the new stuff could turn it up to 11.
We are also working on some new training things for the CSA and updating the CCSK class with the latest material. Again, some big opportunities and the chance to do some very cool research. I love being able to get hands on with things, then take that into the field and learn all the cool lessons from people who are spending their time working with these tools day in and out. And heck, I was even on the BBC last night.
2012 is going to rock. I think the industry is in a great place (yes, you read that right) with a kind of visibility and influence we’ve never had before. The company is cranking along and while we haven’t hit every beat I wanted, we’re damn close. I work with great partners and contributors, and my kids are walking and talking up a storm.
With that said, it’s time for me to turn off the lights, finish my last minute shopping, enjoy my Sierra Nevada Holiday Ale, and say goodnight.
On to the Summary:
Webcasts, Podcasts, Outside Writing, and Conferences
- Mort quoted at CSO Online.
- Take Off The Data Security Blinders. Rich’s latest Dark Reading article.
- Rich on the first (and perhaps only) Southern Fried Network Security Podcast.
- Adrian quoted on Oracle database patching.
Favorite Securosis Posts
Other Securosis Posts
- Network-Based Malware Detection: Introduction [new blog series].
- Incite 12/21/2011: Regret. Nothing.
- Introducing the Malware Analysis Quant Project.
Favorite Outside Posts
- Rich: A man, a ball, a hoop, a bench (and an alleged thread)… TELLER! – Las Vegas Weekly. This is my favorite item in a long time. It really shows what it takes to become a true master of your art – whatever it might be.
- Mike Rothman: Cranking. A big thank you to Jamie, who pointed me toward this unbelievable essay from Merlin Mann. So raw, so poignant, and for someone who’s always struggled with how to balance my sense of personal/family responsibility with my career aspirations, very relevant. Read. This. Now.
- Adrian Lane: The Siemens SIMATIC Remote, Authentication Bypass (that doesn’t exist). 3 digit hard-coded default passwords – that’s so mind-bogglingly stupid there needs be be a new word to describe it. And after all these years of breach disclosures – and all of the lessons learned – people still treat researchers and the bugs they report like garbage.
Project Quant Posts
Research Reports and Presentations
- Applied Network Security Analysis: Moving from Data to Information.
- Tokenization Guidance.
- Security Management 2.0: Time to Replace Your SIEM?
- Fact-Based Network Security: Metrics and the Pursuit of Prioritization.
- Tokenization vs. Encryption: Options for Compliance.
- Security Benchmarking: Going Beyond Metrics.
- Understanding and Selecting a File Activity Monitoring Solution.
- Database Activity Monitoring: Software vs. Appliance.
Top News and Posts
- U.S. Chamber Of Commerce Hit By Chinese Cyberspies.
- The Thought Leader… One Year Later. Chris Eng nails it. For the record, although some people like to think all analysts are also like this… read my favorite external link for the week to understand how I view my profession. Big difference.
- An MIT Magic Trick: Computing On Encrypted Databases Without Ever Decrypting Them.
- The Cryptographic Doom Principle Moxie talks, you listen. Nuff said.
- Uncommon Sense Security: The Pandering Pentagram of Prognostication. I won’t lie – I used to make these stupid predictions… but I stopped years ago. And for the record, I never tried to predict attacks.
- Security researcher blows whistle on gaping Siemens’ security flaw ‘coverup’ No, this time we’ve got it handled. Trust us. Please?
- University accuses Oracle of extortion, lies, ‘rigged’ demo in lawsuit
- Preventing Credit Card Theft + Inside Visa’s Top Secret Data Facility. Top secret, eh? I love the smell of PR in the morning.
- Forensic security analysis of Google Wallet. I’m sure this won’t get hacked. Right?
- Microsoft’s plans for Hadoop. Not security related – yet.
Blog Comment of the Week
Remember, for every comment selected, Securosis makes a $25 donation to a security-oriented charity. This week’s best comment goes to Chris Hoff, in response to Security has always been a BigData problem.
I disagree with your disagreement 😉
The part you missed/ignored (especially in not reading the blog post to which Mike refers) is that Big Data will ultimately help the “…security intelligence” problem.
See his second-to-last paragraph: “Security is a BigData problem, and it’s not a stretch to think that some enterprising souls will apply BigData technologies to the security intelligence problem. Which is a great thing – we certainly have not solved the problem.”
^^^ Check again that blog of mine you didn’t read 😉
I think the point that got missed in your retort is that Mike is suggesting -rightly – that Big Data is an enabler toward then leveraging an analytics/intelligence layer ATOP capabilities like MapReduce.
Big Data isn’t a silver bullet. What you do with that data matters. A lot. Visualization matters. A lot.
…but don’t throw the baby out with the big data brown water.
If you don’t have the data, you have nothing to visualize.