Research

Given the hard time we have defining success in the security field, you’d think we must have at least a firm handle on failure. But that isn’t entirely the case. As both an entrepreneur and a security guy, I may have a different perspective on failure, which influences how I look at pretty much all our business activities. I read a lot of VC and entrepreneur blogs, not because I want to raise money – in fact I’d rather hook my soft targets to a car battery than take outside investment. But I need to learn about how folks are screwing things up and try not to do that. Don Dodge’s short post, Failure is just experience on the way to success resonated with me. He talks about failing fast and the idiocy of the failure is not an option mantra. Of course, if lives hang in the balance, I’m good with doing whatever is humanly possible to avoid failure. But for a business? Give me a break. It creates a culture of risk avoidance, always a recipe for failure over the long term. Look at pretty much all big companies – they have this in spades. Their size and inertia may offset their lack of innovation for years, but ultimately these companies hit the wall because they get too big to remain nimble. So what? How does this help you do security better? Well, there is one crystal-clear failure in security: the breach. That means something failed and data was compromised – simple. You try hard to respond effectively and move on. But let’s talk about another type of failure. That’s the failure of a tactic, control, or product. You do all sorts of things that aren’t working – in many cases you know it’s not working. Let’s just pick on SIEM for a few minutes. Some organizations get tremendous value from SIEM, but I’ve met with countless other companies which do not. Not many stand up, own the project failure, and move on to something else that might work better. Failure needs to be an option These folks believe failure is not an option. They see tremendous political capital locked up in the tactic they decided on, and won’t risk looking bad by admitting failure. They’d rather keep throwing good money after bad, and wasting major resources that could be better used elsewhere to save face in the political meat grinder. Most of the time they also fail agonizingly slowly. Many of these science projects require a significant amount of integration and professional services, further driving up the price and pushing out the timeline. I get that sometimes an initiative can have a happy ending even if things look pretty bleak during part of the process. But realistically, more often than not, it doesn’t get better. At least until you find your next gig. But this isn’t the real driver for this dysfunction. There is very little incentive for small cogs in big wheels to stick their necks out and declare failure before they are forced to. Best case, you draw down your credibility. Worst case, you cost yourself a job before you needed to. Do you really wonder why most folks just sit on failure until the rotten fish stench becomes un-ignorable? Or why it usually takes a regime change to address all the hidden turds that were studiously being ignored, at significant cost to the organization? Failing Gracefully What can you do about it? If you work in an organization where failure is frowned upon, keep making deposits in the credibility bank and hope you have enough credit, then make a careful decision exactly when to admit the failure. Hoping the project will recover is not a strategy for success. These ongoing train wrecks represent sunk costs, so focus on cleaning these messes up as quickly as possible while keeping your job. Looking forward, you can change things, and that’s what you need to focus on. You need to manage your projects a bit differently. See how you can break larger initiatives down into smaller ones, with defined exit points. Reduce financial and resource risk, and allow yourself some leeway to determine whether you are on the right path. Have a Plan B, if your best-laid plans end up being wrong. If you are interviewing for a new gig, understand how the organization handles failure. Ask for anecdotes and stories about projects that went south. Did anyone live to tell the tale? Or are they all urban legends because all the bodies are buried throughout the organization? Ask how success is defined, and whether a similar amount of effort is spent on defining failure. Go in with your eyes open, and don’t have what sales folks call happy ears when you don’t get answers you like. I do believe failure is your friend. Maybe that’s my own confirmation bias talking, because I have failed more than most. But regardless of your job role, you can embrace failure and do your job better for it. Really. Share:

With some fanfare, the US executive branch (the White House) unveiled a proposal for cybersecurity legislation “focused on improving cybersecurity for the American people, our Nation’s critical infrastructure, and the Federal Government’s own networks and computers.” At first glance, it’s more of the same. Which is not much. A lot of it is voluntary, which means it won’t happen. Like government assistance to industry, states, and local governments when a breach happens. Sounds a lot like the scariest statement you can hear: “We’re from the Government, and we’re here to help.” I guess there is some value to understanding the process to engage the feds, especially if you plan to use APT in your PR spin. There are also some ideas on voluntary information sharing, which would be great. Again, if it happens, but there are many pesky details to figure out before you can actually share information safely, as I discussed in the Benchmarking series. The section on Protecting Federal Government Computers and Networks is also more of the same. Update FISMA. Yawn. Give DHS more flexibility to hire security folks in a competitive market. Good luck with that. They also want to give DHS purview over all the federal IPS devices protecting civilian computers. That’s great news for investors in IPS companies, as it means the feds will continue buying IPS forever. You thought it was hard to kill a technology in your shop? Imagine if you needed an act of Congress to change your architecture. (Note: I am aware there is some flexibility in what is called an ‘IPS’.) Guess the IPS lobbyists are better than the AV lobby, as they didn’t get mentioned specifically. The feds are also embracing the cloud and want to put some language in there to prevent specific states from mandating where a data center is built. Good luck getting that through Congress. The Fact Sheet also talks about privacy issues and consulting “privacy and civil liberties experts,” while requiring approval of the Attorney General to implement the cybersecurity program. This will ensure folks are doing the right thing, right? That makes me feel comfy, since the AG always has our best interests in mind (PATRIOT Act, anyone?). What could possibly go wrong? Not sure this is change we can believe in. With one exception. We all like the new National Data Breach Reporting requirement (it’s about time!), and the ability to use RICO to prosecute computer criminals. Accepting that a lot of computer crime is driven by organized crime factions, which are typically prosecuted through RICO, is progress. Treble damages are no fun, nor are 20+ year jail terms. If you believe in penalties as a deterrent for crime this is good news. And something I think they will have very little trouble getting passed. But let’s be clear about the reality. This is just a legislative proposal. Now the fun begins, where lobbyists, special interests, and all the other wackiness kicks in to water this down before it becomes a law, and to bolt about $10 billion worth of pork onto it. You’ve got to keep the locals happy, no? I know, I’m a little cynical. I’m glad Howard Schmidt is keeping busy with press releases, but this new proposal will have no short term and limited mid-term (2-3 year) impact. Like the changes resulting from the 2009 Cyberspace Policy Review. Right – there were none. In the computer security world, being two days behind the times is a killer. Legislation is 5 years behind on a good day. And that’s being kind. Unless you sell IPS – then you are probably pretty happy. Share:

If you follow me on Twitter (@rmogull) you might suspect that last week I took a short vacation. And that said vacation started somewhat auspiciously. And said event really pissed me off to a degree I normally don’t let myself hit. And, just perhaps, American Airlines was responsible. Like many of you I spend a heck of a lot of time in airports. Enough that I tend to shun personal travel since it isn’t really worth the hassles. Starting a vacation at the airport is, for me, like trying to start a vacation by heading to work in a traffic jam, hunting for a parking spot, getting groped by the security guard at the door, and having my ass duct taped to a chair for 5 hours while being force-fed flavored cardboard. Well, I suppose there’s beer and wine. If by “beer” you mean some piss-yellow watered down crap with a german name, and by “wine” you mean a small bottle of grape juice likely fermented in a cattle stall. Back to the story. This trip was special. It was the first time my wife and I would get away without the kids since our second little nugget showed up. Plus it was for my 40th birthday and our 5th anniversary. The idea of sleeping more than 3-4 hours at a stretch was drool-inspiring. Our first plane took off on time. It even landed early. WAY early. At the airport we started from. With a mechanical. As soon as we hit the runway I was calling AA and holding a space on a backup for our connecting flight. Then we were told it would be a 2 hour wait (at least) so I was back on the phone getting our next flight, and then an even later connecting flight to our eventual destination. Our new flight was then delayed. With a mechanical. We landed with mere seconds to spare for us to get to our connecting flight, so we literally sprinted through the airport and arrived maybe 60 seconds after the 10 minute cutoff. Most airlines will hold a connecting flight for a minute or two, or at least leave the gate door open a little longer, if they know there are connecting passengers and it’s the airline’s fault they’re late. But not AA. That door slammed closed leaving about 5 of us (from different delayed flights) waiting another 4 hours for the next one. For the first time ever I asked to speak with a supervisor. He told me that because they were #16 of 17 for on-time rate, they never hold flights. Nice. So they get to maybe improve their numbers and piss off their passengers in the process. While I was speaking with him about a half-dozen other passengers from different flights and connections all made the same complaint. This is a classic example of focusing on a metric to the detriment of the business. As for us? We finally got to our destination over 7 hours late. On the upside it was the Margaritaville Beach Resort and the bar was still open. I wasn’t quite as angry after my first top-shelf marg. By the time we saw Jimmy Buffett at the New Orleans Jazz Fest? Well, heck, I would have kissed one of those crappy AA planes. On the nose, not the tail. It isn’t like I’m some sort of weirdo. On to the Summary: Webcasts, Podcasts, Outside Writing, and Conferences Adrian’s Dark Reading Post on Secure Access to Relational Data. Rich’s Cloud Encryption Use Cases. (registration required) Favorite Securosis Posts Adrian Lane: Thoma Bravo Trips the Wire Fantastic. Money trumps security strategy. Mike Rothman: SIEM: Out with the Old. SIEM is not the only technology companies are looking to swap out in the near term. Adrian does a good job of dealing with how to select that new SIEM. Rich: Sophos Wishes upon A-star-o. First we like RSA/NetWitness, now this. I swear we must be going soft or something. Other Securosis Posts Incite 5/11/2011: Generalists and Specialists. Incomplete Thought: Existential Identities (or: Who the F*** are You?). Favorite Outside Posts Gunnar: Process kills developer passion. Best practices sound good in isolation, but they can suck the life out of developers. Adrian Lane: Process kills developer passion. When you de-Agile Agile, it’s no longer Agile, and no freakin’ fun! Mike Rothman: A Veteran of SEAL Team Six Describes His Training. Not security related, but a great read. These guys are bad ass. Pepper: Apps to stop data breaches are too complicated to use. Sounds like folks need guidance, eh? 😉 Rich OpenStack Beginner’s Guide for Ubuntu 11.04. I’ve been banging my head against OpenStack and this is the best how-to guide I’ve hit. Research Reports and Presentations React Faster and Better: New Approaches for Advanced Incident Response. Measuring and Optimizing Database Security Operations (DBQuant). Network Security in the Age of Any Computing. The Securosis 2010 Data Security Survey. Monitoring up the Stack: Adding Value to SIEM. Network Security Operations Quant Metrics Model. Network Security Operations Quant Report. Understanding and Selecting a DLP Solution. Top News and Posts Google Fixes Two Chrome Bugs, Adds Flash 10.3 to Browser. Microsoft Security Intelligence Report (SIRv10) released. Zeus Source Code Leaked. VUPEN Whitehats Claim To Have Broken Chrome Sandbox. FCC Chairman becomes FCC Lobbyist. For a firm she just ruled in favor of. Meredith Attwell Baker rates an 8.5 on the scumbag scale. Microsoft Patch Remote Code Execution Vulnerability in WINS. Anonymous Splinter Group Implicated in Sony Hack. FBI Spyware and Electronic Surveillance. Blog Comment of the Week Remember, for every comment selected, Securosis makes a $25 donation to Hackers for Charity. This week’s best comment goes to Zac, in response to Earth to Symantec: AV doesn’t stop the APT. I’d like to point out one of the massive flaws in our security systems – one that all the vendors out there exploit: those that make the purchasing/planning decisions at most of the businesses / institutions / governments / etc.

With the global economy apparently warming and lots of IPOs hitting the Street, it was a bit surprising to see TripWire opt for a buyout by Thoma Bravo, as opposed to continuing with their IPO plans. But I found an article by the local Portland OR Business Journal which explained things a bit. Basically, TripWire is growing at 20%/year, but that does not create a lot of buzz on the Street compared to monster growth stories like Groupon. They also mismanaged expectations a bit last year when they issued the S-1, by talking about hitting $100MM in 2010 revenues, then missing their target (hitting $86MM on the top line). It’s ancient history, but ask SourceFire about not hitting investor expectations when going public. So the stock was likely to languish and that’s not good for anyone. Clearly their investors were tired (having been with the company since 1997), so something had to give. The private equity buyout by Thoma Bravo provided liquidity for the investors (and some founders/early employees) and the runway to continue building the company. Thoma Who? You probably haven’t heard of Thoma Bravo before. They are a buyout firm, specializing in tech companies. You may know a couple of the companies in their security/IT management portfolio: Attachmate (which just acquired Novell after swallowing NetIQ a few years ago), SonicWall, Entrust, LANDesk, and now TripWire. It’s a pretty broad portfolio of mature companies that aren’t really leaders in their respective spaces. That’s why they got bought out in the first place, but these mature companies generate significant revenue, which can be milked and perhaps used to buy other assets. You all know the game in private equity, right? They acquire assets (usually using a mix of equity and debt), clean things up either by fixing operations or merging with other companies to gain scale, and then take the asset public again or sell it to a strategic buyer. If it works out, they generate tremendous returns using the leverage of the equity/debt mix. If you buy an asset like Chrysler (as Cerberus did), that might not work out. But if you look at the Forbes 400 of really rich folks, quite a few specialize in buyouts. So evidently it can be a pretty good model. Thoma’s security portfolio is pretty comprehensive and they have the pieces to compete against some of the bigger players in the space. But only if the various companies are integrated to some degree. Thoma has not talked about any larger strategy in the security market but don’t assume they have one. Maybe they just see a couple companies that can operate more efficiently and at some point provide a decent return on the investment – we will see. Market Impact The fact that the deal was announced as a standalone may mean they plan to leave TripWire alone, especially since the Business Journal story reports that Thoma tends not to mess with its companies. If so there will be little to no impact on existing TripWire customers. Given the market opportunity in security this seems like a mistake to me. Moving forward, security is all about reducing the complexity of protecting a very complicated environment. Having 5 standalone security companies does not reduce complexity for customers, wasting any leverage TripWire could provide with Thoma. If you believed in TripWire as a long-term, sustainable standalone company, this approach is fine. Personally, I think there are only a handful of sustainable, standalone security companies, and TripWire isn’t one of them. So over time I hope they fold into a more comprehensive offering. For the time being, TripWire keeps doing their thing, looking for smaller tuck-in acquisitions and trying to grow to the next level. That just seems like a horrible waste of assets. Folks like McAfee and Symantec have spent years assembling large portfolios of products to package into solutions for customers. Thoma Bravo now controls a significant security portfolio, and with a few more strategic acquisitions (such as monitoring, endpoint protection, and professional services/integration) they could have enough to legitimately compete with Big Security. That assumes competing with Big Security is the end goal, and I’ve been around way too long to think I understand the strategy of any financial buyer. I know the motivation (generate return on investment), but there are plenty of ways to skin that cat. Share:

Looking back over 30+ years, I realize my athletic career peaked at 10. I played First Base on the Monsey Orioles (“Minor League”). Our team was stacked, and we won the championship. I kept playing baseball for a few more years but my teams never made it to the championship, and when the bases moved out to 90 feet my lead feet became the beginning of the end. But it’s okay – I was pretty good with computers and in chess club too. Yep, I was fitted for my tool belt pretty early. When I grew up, you played baseball in the spring. Maybe soccer or football in the fall (and yes, I know they are the same thing outside the US). Some kids also played basketball or hockey over the winter. But now the choices are endless. The new new thing is lacrosse. It seems very cool and is clearly competing with baseball for today’s kids. But the variety is endless. I live in the South, where you can play tennis 10 months a year, and many kids do. My girls dance. There are martial arts and gymnastics. Some kids pick up golf early too. The Boss and I have tough decisions to make every year, because the kids literally don’t have time to do even a fraction of what is available. But this begs the question: generalist or specialist. Some kids play travel baseball. They don’t have time to do much else, so they (or their parents) decide to specialize on one sport. The twins are 7, so we don’t have to push them one way or the other quite yet, but our 10-year-old seems to love dance. She had better, because two days a week and showcases cost a fortune, and don’t leave much time for her to do anything else (while still doing well in school). At some point the kids have to choose, don’t they? Maybe yes, maybe no. The genetic reality is that none of my offspring are likely to play professional sports. I can’t categorically rule it out, nor will I do anything to discourage their dreams. It’s cute to see the boy talk about being a football player when he’s big. But the realist in me says the odds are long. Aren’t they better off becoming well-rounded athletes, able to compete in multiple endeavors, rather than just focusing on one skill? To me it all comes down to passion. If the kids are so passionate about one activity that they have no interest in anything else, I’m good with that. On the other hand, if they can’t make up their minds, they can dabble. They are young. It’s fine. They’ll need to understand that dabbling won’t make them exceptional in any one activity – at least according to Malcolm ‘Outliers’ Gladwell – but that’s okay. As long as they learn the game(s), understand how to contribute to a team, be good sports, and grok the importance of practice, it’s all good. We don’t choose their paths. We just expose them to lots of different options, and see which appeal to them. Do you see where I’m going with this? Many folks feel they need to choose between being a generalist or a specialist in their careers. For us security folks, it means being a jack of all trades, or a master of one. Odds are, given the complexity of today’s IT environment, you can’t be both. There is no right or wrong answer. Sure it’s a generalization, but specialists tend to work in big companies or consulting firms. Generalists are more common in smaller companies, where everyone needs to wear many hats. The worst thing you can do (for your career and your happiness) is not choose. Don’t hate the job you just fell into, with no idea why you’re there or what’s wrong. If some of your tasks make you nuts, you should at least a) know why and b) have chosen that role and those tasks. But the only way to find the role for you is to try both ways. Like we’re doing with the kids – they can try lots of things and eventually they may choose one. Or not. Either way, they’ll each choose their own path, which is the point. Photo credits: “Blocway Paving Specialist Van” originally uploaded by Ruddington Photos Incite 4 U How many SkypeOut minutes can you buy for $8.5 billion? That’s right, sports fans, Microsoft is buying Skype for $8.5B (yes, billion). For a long time we security folks didn’t quite get Skype, so we tried to block it. Then it showed up on mobile devices, and that basically went out the window. The simple fact is that many companies harness cheap telecom to communicate more effectively throughout their far-flung empires. Given Skype’s inevitable integration into all things Microsoft, for those of you that haven’t figured out this VoIP thing the time is now. Like anything else, it’s about doing the work. You know: model the threats of letting certain folks use Skype. Understand the risk, and then make a decision. With a couple hundred million users, you’d think Skype was already mass market. But I suspect you ain’t seen nothing yet. So dust off that policy manual and figure out whether you want/need/can afford to enforce constrain Skype, and how. – MR Ask me nice: George Hulme’s recent post on Making An Application Security Program Succeed raised a couple good points, but reminded me of another angle as well. Rafael Los points out that secure code development is not part of the everyday development job, and developers trail IT management in preparedness and understanding. Gunnar reminds us that we need to keep expectations in check – SDLC is new to development organizations, and your best bet is to pick one or two simple goals to get things started. My point is that if you’re not a developer, you’re an outsider. An outsider telling developers how to do their job is doomed

About 4 years ago we saw the first big wave of replacements of older email security tools with a second generation we now call ‘content security’. Early email security products were deployed in-house and focused on anti-virus, anti-spam, and mail server integration. The current generation of products offered new SaaS and hybrid deployment models, technology advancements in web and content filtering, more elastic service sets, and centralized web management consoles. And let’s not forget the larger security firms with products lagging far behind the state of the art, milking their cash cows while smaller firms innovated. We see the same wave of succession right now in the SIEM market. First generation products – despite being entrenched – make customers uncomfortable enough to start asking what else is available. They are looking for better, easier, and faster. We hear numerous complaints about existing solutions: “We collect every event in the data center, but we can’t answer security questions, only run basic security reports.” “We can barely manage our SIEM today, and we plan on rolling event collection out across the rest of the organization in the coming months.” “I don’t want to manage these appliances – can this be outsourced?” “Do I really need a SIEM, or is log management and ad hoc reporting enough?” “Can we please have a tool that does what it says?” “Why is this this product so effing hard to manage?” We see new products designed to both improve scalability and come closer to real-time analysis. They can collect events from just about every type of network device and application, normalize, and provide better drill-down capabilities. And there are many new analysis features – including enrichment, attack signature patterns, and application-layer monitoring. The first generation of products are looking old and I hear more and more unhappiness with today’s entrenched solutions. I ran across Anton Chuvakin’s How to Replace a SIEM? this week. But his tips apply to a wider audience than just Cisco MARS customers kicking other vendor tires. He offers two excellent vendor migration suggestions that bear repeating. First, leave the existing system running for some time – at least through the migration. This way you are still covered during the migration, and in the event previously collected data is not compatible across systems, you can still run reports and access forensic data. I have seen cases of “rip and replace” where the old system is removed while – or even before – the new system is up and running. That means no coverage for a (potentially extended) period. I sometimes call that ‘optimism’, but you may prefer another term. The sales process is a good time to ensure your (new, hungry) vendor can run in parallel with your existing tool – don’t buy it and then let them tell you that’s an unsupported scenario. Second, have the new vendor help with setup. Deployment issues are some of the most serious problems we hear of. Hiring the vendor not only helps avoid many pitfalls, but also makes it easier and quicker to replicate the rules and reports you currently use. And during the sales process you can negotiate attractive pricing on getting the work done as a condition of the sale. But before you replace a SIEM there are a couple other things you need to consider: Post Mortem: What exactly are the problems with the existing system and what do you hope to accomplish? It’s not hard to come up with a list of problems and areas for improvement – it’s much harder to vet a new technology to confirm addresses your demands without adding its own slew of new pitfalls. The problem here is that vendors will tell you they can do whatever you ask for. Realistically, you need to check with other customers who already own and operate new products before you buy – see what their experiences have been. What you have: The SIEM you have was installed for a reason. Actually, they are normally installed for several reasons, to address a list of business and security problems which grows over time. It’s easy to forget everything your system does when its failings are so easy to see. Make sure you have a complete understanding of what issues are currently being addressed and must be replicated on the new system. This includes compliance and security functions across management, operations, and security organizations. Worse, the existing SIEM likely feeds data to other systems you forgot about. The list you build is almost always much longer than expected. The good news is this process saves time and avoids trouble down the road, and helps form RFP questions and guide proof of concept testing. You want a new product that handles your new wish list, but don’t give up on any core reasons you are already running SIEM. SIEM replacement can be easier than a first installation, but you need to leverage the knowledge you have to make it so. That may sound easy, but it takes work to gather the organizational memory you need and clearly document your goals moving forward. Share:

Do you ever think about how you could just disappear? Or become someone else? Maybe only I do that after reading one too many Jason Bourne novels. Given anyone’s ability, with a keyboard and an Internet connection, to become anyone (even Abraham Lincoln is spewing quotes on Twitter now), what does ‘identity’ mean now? In the future? And is your ‘identity’ singular, or will it become identities moving forward? This interview on NetworkWorld with a guy who specializes in making folks disappear was fascinating. Mostly because the approach is totally counter-intuitive. You’d probably guess it’s about hiding your identity or taking someone else’s. But it’s not – at least according to this guy who helps folks hide for a living. It’s about making it hard (if not impossible) to find you through disinformation, using tactics like manufacturing online identities with the same name and sending anyone trying to find you on a wild goose chase. Unless you have someone very motivated to find you personally, this should work like a charm. Think about that for a second. Maybe even think about it from my perspective. There are already a bunch of Mike Rothmans out there. I went to college with one. Yes, a guy with my name – even down to our common middle initial – ended up in the same class at the same college. And that’s without even trying. What if a bunch of new Mike Rothmans showed up? How would you know which one(s) was really me? Maybe I’m not a great example due to my attention whoring disorder – I want you to find me, at least online. But less public folks could likely disappear with little fanfare, leaving a myriad of false trails. So as The Who sang years ago, “Who the F*** are you?” False identities are created every day, with severe ramifications. Think about all those crazy parents creating Facebook identities to spy on their kids or make their kids’ rivals look bad. In this age of social networking, citizen journalism, and Twitter, identity matters but is increasingly hard to define – and even harder to verify. Some folks have been able to get verified Twitter accounts, which could then be hacked. We talked about identity verification and non-repudiation as this ecommerce thing caught fire a few years ago, and we basically forget about it and forced the credit card companies to take on most of the liability from it. Then they forced the merchants to eat it. Risk transference for the win. And now the media seems to fall hook, line, and sinker every time a “citizen journalist” creates a meme, which turns out to be just a front for some big nameless company driving its own agenda. Folks take seriously what they read on all these myriad communication vehicles, regardless of source. And everyone engaging in social networking contributes. As long as they don’t exhibit trollish behavior, it looks like most of us have no issue linking to them and including them as part of the conversation, even though we don’t know who they are. I know I do, fairly frequently. I’ve been struggling with my position on anonymous folks for years. I get that some folks cannot divulge their real names because it could cost them their jobs. But do I continue giving these unverified folks any airtime? And what do I tell my kids? I constantly harp on honesty and honorable behavior. But I’m trying to show them that not everyone holds themselves to the same ethical standards. It’s important they do not believe everything they read or hear. They need to do the work, and figure out what is real and what is not. What they want to believe and what they want to reject. Given this lack of identity, the problem is going to get worse. Where is identity going? How will we verify who is who? Do we even need to? What’s the significance for how we do security? At this point I don’t have any answers. I’m not even sure I know the questions. I know Gunnar and Adrian have been thinking quite a bit about how identity evolves from here. I plan to pick Gunnar’s brain at Secure360 this week, and plenty of other big brains. If you have given some thought to this, please let me know what you think in the comments. Share:

A few months back one my dogs knocked over one my speakers. Sent it flying, actually. 3’ 50lb wood cabinet speaker – as if it wasn’t there. The culprit is still a puppy, but when she gets ripping, she can pretty much take out any piece of furniture I own. And she has a big butt. She seems to run into everything butt first, which is impressive as she does not walk backwards. Wife calls her ‘J-Lo’. She learned how to spin from playing with my boxer, and now she spins out of control when she is amped up. Big ass, right into a chair… BANG! I miss having music in the living room, so I thought I would solve the problem by bringing out a pair of tower speakers from the back room. They are six feet tall and weigh 180lb each. I thought that was the perfect solution, until she moved the piano a half of an inch with one of her spins. For the sake of the speakers, and my health, I removed all stereo components from the living room. But I still want music so I have been searching for small electronics to put on the shelf in the kitchen. My requirements were pretty simple: Decent quality music that won’t become a projectile of death. I began shopping and found, well, everything. I found hundreds of portable DAC’s, the size of a cigarette pack, for the iPhone & iPad. There are lots of boom boxes, desktop radios, and miniature receivers. I ordered the iHome IP1 because it got good reviews and – while the audiophile in me hates to admit it – it just looked good. I was really excited when it arrived last week and I cleared off a space for it, cleaned up the shelf, got everything plugged in, and updated my music library with some fresh tunes. Only problem – it sucked. Or maybe it was defective, I don’t really know. Won’t play music from an iPhone 4, iPad, or iPod touch – only the iPhone 3GS. And when it did play, it sounded underwater. Ugh. Really freakin’ bad. So I am still searching for a good desktop radio that I can stream music to from my iDevices. If you have reasonably priced recommendations let me know. For now I am just playing from the built in speakers, which is better than nothing. On to the Summary: Webcasts, Podcasts, Outside Writing, and Conferences Mike on the Importance of Application Intelligence. Adrian’s DR post on How To Respond To The Sony Attacks. Favorite Securosis Posts Adrian Lane: SDLC and Entropy. See Gunnar’s take. David Mortman: What’s Old Is New again. And we wonder why our lives (in security anyway) are described as the “hamster wheel of pain.” We repeat the same stuff over and over again. With maybe a twist or two (as Adrian astutely points out), but the plot is the same. So is the end result. Sigh. Mike Rothman: Why We Didn’t Pick the Cloud (Mostly) and That’s OK. Who else gives you such a look into the thought processes behind major decisions? Right, no one. You’re welcome. Other Securosis Posts Earth to Symantec: AV doesn’t stop the APT. Incite 5/4/2011: Free Agent Status Enabled. Standards: Should You Care? (Probably Not). Software vs. Appliance: Virtual Appliances. Software vs. Appliance: Data Collection. Favorite Outside Posts Adrian Lane: VMWare Building Clouds? An interesting look at virtual platform use by cloud providers. David Mortman: The Rise of Data-Driven Security. I love it when we get validated by a heavy hitter like Scott. Mike Rothman: Summary of the Amazon EC2 and Amazon RDS Service Disruption in the US East Region. Great explanation from Amazon about their EC2 FAIL a few weeks back. You can learn a lot about cloud architecture, as well as get a feel for how complicated it is to really scale. It’s like a tightrope walk every time they have to scale (which is probably constantly). This time they fell off and went splat. Let’s hope the net is positioned a bit more effectively next time. Project Quant Posts DB Quant: Index. NSO Quant: Index of Posts. NSO Quant: Health Metrics–Device Health. NSO Quant: Manage Metrics–Monitor Issues/Tune IDS/IPS. NSO Quant: Manage Metrics–Deploy and Audit/Validate. NSO Quant: Manage Metrics–Process Change Request and Test/Approve. Research Reports and Presentations React Faster and Better: New Approaches for Advanced Incident Response. Measuring and Optimizing Database Security Operations (DBQuant). Network Security in the Age of Any Computing. The Securosis 2010 Data Security Survey. Monitoring up the Stack: Adding Value to SIEM. Top News and Posts Fake Mac Security Software It’s drive-by malware… if you actually click all the buttons and install it. Anonymous claims no involvement in Sony hacks. How to disappear completely. Yeah, more Sony mayhem. Barracuda Breach Post Mortem Analysis. Test-Driving IBM’s SmartCloud. Interesting analysis of IBM’s ‘SmartCloud’ trial product. In fairness, it’s very early in the development process. Zero-Day Attack trends via Krebs. Second installment. Makes you think security companies are not eating their own dog food. LastPass Forces Users to Pick Another Password It’s bad when the salt is stolen with the hashed passwords… now it becomes a dictionary attack. If it was a foreign government (wink-wink), they have the resources to crack all the passwords. Nikon Image Authentication System Compromised. Interesting read. Blog Comment of the Week Remember, for every comment selected, Securosis makes a $25 donation to Hackers for Charity. This week’s best comment goes to ds, in response to Earth to Symantec: AV doesn’t stop the APT . The reality here is that SYMC is a very successful security vendor with a lot of customers and many solutions. They aren’t stupid and press announcements like this aren’t driven by ignorance. Sadly, they will sell product to customers based on this. It speaks volumes about the buyer and their ability to understand complex security issues and appropriate remedies. In short, most “security” professionals can’t, and many companies don’t even have “security” professionals on

In the security industry successful companies need have breadth and scale. Security is and will remain an overhead function, so end users must strive to balance broad coverage against efficiency to control, and hopefully reduce, overhead. Scoff as you may, but integration at all levels of the stack does happen, and that favors bigger companies with broader product portfolios. That trend drove Sophos’s rather aggressive move this morning to acquire Astaro, a UTM vendor. I won’t speculate on deal size, but Astaro did about $60MM on the top line last year and was profitable. They also were owned by the management team (after a recent buy-out of the investors), so there was no economic driver forcing the deal. So you have to figure Sophos made a generous offer to get it done. And congrats to Sophos for not mentioning APT in the deal announcement – not even once. At least the Europeans can show some restraint. Deal Rationale Get big or get out. It’s pretty simple, and given the deep private equity pockets (APAX Partners) that acquired Sophos last year, it’s not surprising for them to start making aggressive moves to broaden the portfolio. We believe Astaro is a good partner, given the lack of overlap in product lines, general synergies in the target market, and ability to leverage each other’s strengths. Let’s hit each of these topics. First of all, Sophos has no network security products. There are only two must-have mass market security technologies: AV and firewalls. If Sophos is going to be a long term player in the space they need both. The only overlap is in the content security space, where Sophos has email and web security gateways. But Sophos’ products are hardly competitive in that market so moving customers to Astaro’s integrated platform makes sense. We also like the value Sophos’ research team can bring to Astaro. Clearly reputation and malware analysis is valuable at all levels of the security stack, and Astaro can make their network security products better immediately by integrating the content into the gateway. Astaro brings a lot of customer intelligence to the table. By that I mean Astaro’s real time link to each gateway in the field and granular knowledge of what each box is doing, where it’s deployed, and what it’s running. That kind of intelligence can add value to endpoints as well. Both companies have also largely targeted the mid-market – although they each point to some enterprise accounts, the reality is that they excel with smaller companies. They’ll be strong in EMEA and Asia, but have their work cut out for them in the US. The ability to field a broad product line should help bring additional channel partners onboard, perhaps at the expense of less nimble AV incumbents. There are also some good cultural synergies between the companies. Both European. Both known for strong technology, and not such strong marketing. Given that both endpoint and network security are replacement markets, it’s usually about sucking less than the incumbent, and we think the bigger Sophos should be able to grow share on that basis. Achilles Heel Keep in mind that Sophos did one other deal of this magnitude, Utimaco, a couple years back, which turned into a train wreck. The real issue in the success of this deal isn’t markets or synergies – it’s integration. If they didn’t learn anything from the Utimaco situation this won’t end well. But current indications that they will leave Astaro as a stand-alone entity for the time being, while looking for good opportunities for integration, which would be a logical plan. The key will be to make both product lines stronger quickly, with limited integration. Check Point never did much with their endpoint offering because it didn’t leverage the capabilities of the perimeter platform and vice-versa. Sophos can’t afford to make that same mistake. We also hope Sophos locked in Astaro’s management for a couple years and would look to leverage some of that talent in bigger roles within Sophos. Competitive Impact Having offerings on both the endpoint and network gives Sophos a differentiated position, with only McAfee (of the big players) having products in both spaces. Given the need for mid-market companies to alleviate the complexity of securing their stuff, having everything under one roof is key. Will Symantec or Trend now go and buy a network security thingy? Probably not in the short term (especially given the lack of compelling choices to buy), but in the long run big security companies need products in both categories. Overall, we like this deal. The devil is in the integration details, but this is the kind of decisive move that can make Sophos one of the long term survivors in the security space. Share:

Wrapping up our Software vs. Appliance series, I want to remind the audience this series was prompted by my desire to spotlight the FUD in Database Activity Monitoring sales processes. I have mentioned data collection as one of the topics Data collection matters. As much as we would like to say the deployment architecture is paramount for performance and effectiveness, data collection is crucial too, and we need to cover a couple of the competitive topics that get lumped into bake-offs. One of the most common marketing statements for DAM is, “We do not require agents.” This statement is technically correct, but it’s (deliberately) completely misleading. Let’s delve into the data collection issues that impact the Appliance vs. Software debate: Yes, We Have No Agents: No database activity monitor solution requires an agent. You’ll hear this from all of the vendors because they have to say that to address the competitive ‘poison pill’ left by the previous vendor. All but one DAM product can collect SQL and events without an agent. But the statement “We don’t require an agent” is just marketing. In practice all DAM products – software, hardware, and virtual – use agents. It’s just a fact. They do this because agents, of one form or another, are the only reliable way to make sure you get all important events. It’s how you get the whole picture and capture the activity you need for security and compliance. Nobody serious about compliance and/or security skips installing an agent on the target database. No Database Impact: So every DAM vendor has an agent, and you will use yours. It may collect SQL from the network stack by embedding into the OS; or by scanning memory; or by collecting trace, audit, or transaction logs. No vendor can credibly claim they have no impact on the target database. If they say this, they’re referring to the inadequate agent-less data collection option you don’t use. Sure, the vendor can provide a pure network traffic collection option to monitor for most external threats, but that model fails to collect critical events on the database platform. Don’t get me wrong – network capture is great for detecting a subset of security specific events, and it’s even preferable for your less-critical databases, but network scanning fails to satisfy compliance requirements. Agent-less deployments are common, but for cases where the database is a lower priority. It’s for those times you want some security controls, but it’s not worth the effort to enforce every policy all the time. Complete SQL Activity: DAM is focused on collection of database events. Agents that collect from the network protocol stack outside the database, or directly from the network, focus on raw unprocessed SQL statements in transit, before they get to the database. For many customers just getting the SQL statement is enough, but for most the result of the SQL statement is just as important. The number of rows returned, or whether the query failed, is essential information. Many network collectors do a good job of query collection, but poor result collection. In some cases they capture only the result code, unreliably – I have seen capture rates as low as 30% in live customer environments. For operations management and forensic security audits this is unacceptable, so you’ll need to verify during vendor review. Database Audit vs. Activity Audit: This is a personal pet peeve, something that bothers most DAM customers once they are aware of it. If your agents collects data from outside the database, you are auditing activity. If you collect data from inside the database you are auditing the database. It’s that simple. And this is a very important distinction for compliance, where you may need to know database state. It is considerably more difficult to collect from database memory, traces, transaction logs, and audit logs. Using these data sources has more performance impact – anywhere from a bit to much more impact than activity auditing, depending upon the database and the agent configuration. Worse, database auditing doesn’t always pick up the raw SQL statements. But these data sources are used because they give provide insight to the state of the database and transactions – multiple statements logically grouped together – that activity monitoring handles less well. Every DAM platform must address the same fundamental data collection issues, and no one is immune. There is no single ‘best’ method – every different option imposes its own tradeoffs. In the best case, your vendor provides multiple data collection options for you to choose from, and you can select the best fit for each deployment. Share: