Rational Survivability

NAC is a Feature not a Market...

I'm picking on NAC in the title of this entry because it will drive Alan Shimel ape-shit and NAC has become the most over-hyped hooplah next to Britney's hair shaving/rehab incident...besides, the pundits come a-flockin' when the NAC blood is in the water...

Speaking of chumming for big fish, love 'em or hate 'em, Gartner's Hype Cycles do a good job of allowing one to visualize where and when a specific technology appears, lives and dies as a function of time, adoption rate and utility.

We've recently seen a lot of activity in the security space that I would personally describe as natural evolution along the continuum, but is often instead described by others as market "consolidation" due to saturation. 

I'm not sure they are the same thing, but really, I don't care to argue that point.  It's boring.  It think that anyone arguing either side is probably right.  That means that Lindstrom would disagree with both. 

What I do want to do is summarize a couple of points regarding some of this "evolution" because I use my blog as a virtual jot pad against which I can measure my own consistency of thought and opinion.  That and the chicks dig it.

Without my usual PhD Doctoral thesis brevity, here are just a few network security technologies I reckon are already doomed to succeed as features and not markets -- those technologies that will, within the next 24 months, be absorbed into other delivery mechanisms that incorporate multiple technologies into a platform for virtualized security service layers:

1. Network Admission Control
2. Network Access Control
3. XML Security Gateways
4. Web Application Firewalls
5. NBAD for the purpose of DoS/DDoS
6. Content Security Accelerators
7. Network-based Vulnerability Assessment Toolsets
8. Database Security Gateways
9. Patch Management (Virtual or otherwise)
10. Hypervisor-based virtual NIDS/NIPS tools
11. Single Sign-on
12. Intellectual Property Leakage/Extrusion Prevention
    

...there are lots more.  Components like gateway AV, FW, VPN, SSL accelerators, IDS/IPS, etc. are already settling to the bottom of UTM suites as table stakes.  Many other functions are moving to SaaS models.  These are just the ones that occurred to me without much thought.

Now, I'm not suggesting that Uncle Art is right and there will be no stand-alone security vendors in three years, but I do think some of this stuff is being absorbed into the bedrock that will form the next 5 years of evolutionary activity.

Of course, some folks will argue that all of the above will just all be absorbed into the "network" (which means routers and switches.)  Switch or multi-function device...doesn't matter.  The "smoosh" is what I'm after, not what color it is when it happens.

What'd I miss?

/Hoff

(Written from SFO Airport sitting @ Peet's Coffee.  Drinking a two-shot extra large iced coffee)

Off to Northern California this Week...

I'm traveling to Northern California on Sunday for a week of customer visits and speaking engagements in Walnut Creek, San Jose and San Francisco.  If anyone wants to get together for a bite or some brew, let me know!  Ping me at choff [at] crossbeamsys.com or leave a comment here and we'll connect.

Many of the people I'd expect to meet up with are actually attending a supah-sekreet security get-together with me, so it would be a great time to coordinate a mash-up because there's a fantastic group of people just waiting to exercise their expense accounts and bail money stash.

It worked out in reverse well enough for Mogull, so I figured I'd give it a shot. ;)

Thursday and Friday are better days.

/Hoff

What Do "Grassy Knees," a Gartner Analyst, Cuban Garlic Chicken and Poor Fashion Choices Have in Common?

It's not the sordid tale of lust, information security and circus midgets you might have been expecting from the title, but instead the highlights of a couple of evenings spent entertaining a wayward analyst soul from Phoenix.

Rich Mogull, Gartner analyst and data protection mercenary, was in town for a couple of evenings, and I played cruise ship entertainment director.  It's what I do.  If a fellow blogger or security wonk comes to my town, has a few minutes to spare, it's my self-appointed duty to make damned sure they have a good time.

I'm all about the full disclosure.  It's how we roll. 

As Rich so kindly nominated me for "Best Host for Security Geeks in Boston" I must suggest that he plays the role of visiting team quite well.  Damned good head on his shoulders, fun dude to talk with and listen to, and should you ever need saving on the side of a snow-covered mountain, it seems that he's all you'll ever need.

We had a great dinner at the Naked Fish (which incidentally has nothing to do with my tattoos,) and then ended up closing that down in favor of the hotel bar in Bedford in which we most certainly were the worst dressed amongst the crowd.  We executed on the wild tech. guy role very well using every free napkin in the house to scribble the solutions to every known security problem currently defined.

I called Shimmy because whilst late, I suggested I could do his podcast drunk with Rich adding beatbox sound effects in the background.  Alan listened to me ramble for 10 minutes before he asked "Who the hell is this!?"

The next night we hit BeanSec! and hooked up with Mike Murray, 78% of Veracode's employees (except for Wysopal who is now finally too l33t to hang with us) and 46% of Crossbeam's staff.

I tried for an analyst trifecta:

Jaquith was invited but he was in Utah gettin' all Mormon'd up.  Rothman was, well, not there because BeanSec! is not pragmatic enough.  Stiennon was busy securing the network fabric of the entire nation state of Haiti and nobody @ IDC would answer my calls.  Ah well.

Despite that, a good time was had by all.

Good seeing you, Rich.  Come back sometime...as soon as you add me to your BlogRoll, that is. ;)

/Hoff

(P.S. Just to be clear, a "Grassy Knee" is one of the specialty drinks at the Enormous Room in Cambridge where we hold BeanSec!  along with the "Bad Babysitter" and "God in Little Pieces."  Any other imaginative definition is your own fault, you perv.  That is all.)

Breaking News: SOA, Web services security hinge on XML gateways!

Bloody Hell!

The article below is dated today, but perhaps this was just the TechTarget AutoBlogCronPoster gone awry from 2004? 

Besides the fact that this revelation garners another vote for the RationalSecurity "Captain Obvious" (see right) award, the simple fact that XML gateways as a stand-alone market are being highlighted here is laughable -- especially since the article clearly shows the XML Security Gateways are being consolidated and bundled with application delivery controllers and WAF solutions by vendors such as IBM and Cisco.

XML is, and will be everywhere.  SOA/Web Services is only one element in a greater ecosystem impacted by XML.

Of course the functionality provided by XML security gateways are critical to the secure deployment of SOA environments; they should be considered table stakes, just like secure coding...but of course we know how consistently-applied compensating controls are painted onto network and application architectures. 

The dirty little secret is that while they are very useful and ultimately an excellent tool in the arsenal, these solutions are disruptive, difficult to configure and maintain, performance pigs and add complexity to an already complex model.  In many cases, asking a security team to manage this sort of problem introduces more operational risk than it mitigates. 

Can you imagine security, network and developers actually having to talk to one another?!  *gasp*

Here is the link to the entire story.  I've snipped pieces out for relevant mockery.

ORLANDO, Fla. -- Enterprises are moving forward with service oriented architecture (SOA) projects to reduce complexity and increase flexibility between systems and applications, but some security pros fear they're being left behind and must scramble to learn new ways to protect those systems from Web-based attacks.

<snip>

"Most network firewalls aren't designed to handle the latest Web services standards, resulting in new avenues of attack for digital miscreants, said Tim Bond, a senior security engineer at webMethods Inc. In his presentation at the Infosec World Conference and Expo, Bond said a growing number of vendors are selling XML security gateways, appliances that can be plugged into a network and act as an intermediary, decrypting and encrypting Web services data to determine the authenticity and lock out attackers.

"It's not just passing a message through, it's actually taking action," Bond said. "It needs to be customized for each deployment, but it can be very effective in protecting from many attacks."

Bond said that most SOA layouts further expose applications by placing them just behind an outer layer of defense, rather than placing them within the inner walls of a company's security defenses along with other critical applications and systems. Those applications are vulnerable, because they're being exposed to partners, customer relationship management and supply chain management systems. Attackers can scan Web services description language (WSDL) -- the XML language used in Web service calls -- to find out where vulnerabilities lie, Bond said.

<snip>

A whole market has grown around protecting WSDL, Bond said. Canada-based Layer 7 Technologies Inc. and UK-based Vordel are producing gateway appliances to protect XML and SOAP language in Web service calls. Reactivity, which was recently acquired by Cisco Systems Inc. and DataPower, now a division of IBM, also address Web services security.

Transaction values will be much higher and traditional SSL, security communications protocol for point-to-point communications, won't be enough to protect transactions, Bond said.

<snip>

In addition to SQL-injection attacks, XML is potentially vulnerable to schema poisoning -- a method of attack in which the XML schema can be manipulated to alter processing information. A sophisticated attacker can also conduct an XML routing detour, redirecting sensitive data within the XML path, Bond said.

Security becomes complicated with distributed systems in an SOA environment, said Dindo Roberts, an application security manager at New York City-based MetLife Inc. Web services with active interfaces allow the usage of applications that were previously restricted to using conventional custom authentication. Security pros need new methods, such as an XML security gateway to protect those applications, Roberts said.

<snip>

BeanSec! 7 - March 21st - 6PM to ?

Yo!  BeanSec! 7 is upon us.

BeanSec! is an informal meetup of information security professionals, researchers and academics in the Greater Boston area. Unlike other meetings, you will not be expected to pay dues, “join up”, present a zero-day exploit, or defend your dissertation to attend.

Map to the Enormous Room in Cambridge. 

Enormous Room: 567 Mass Ave, Cambridge 02139

 

Reduce Insider Threat in Data Centers -- No Oxygen for you today!

The CeBIT show produces yet another gem for Das Blog today.   It harkens  references to that  Seinfeld episode regarding the Soup, um, Dictator (don't want to offend my German friends.)  This time, it's not about Soup.  It's about good ol' atmosphere.

A German company has produced a fire prevention system called OxyReduct that functions by reducing the amount of oxygen in a data center.  When Oxygen content hits a certain level, things don't burn.  Sounds simple, eh.  It's a prevention system because it inhibits combustion, not contain/suppress it like Halon/FM-200/Inergen.

Wagner Alarm and Security Systems claims that they can reduce the percentage of oxygen from the normal 21% to 15% where even cables won't ignite.  You can read how via the link above.

Interestingly, they suggest that 13-17% oxygen corresponds to a human-tolerable working condition as approved by "unions."  Well, they are Germans...I suppose this is accurate if your definition of "safe" or "tolerable" does not include the need to breathe without gasping.

I just returned from climbing Mt. Meru (~15,000 feet) and Mt. Kilimanjaro (~20,000 feet) and may I suggest that the effects of even mild altitude sickness is unpleasant at the best case and includes projectile vomiting (from multiple orifices) and migraines at the worst.  Luckily, I didn't suffer from any of these symptoms, but many an Austrian tourist I witnessed was not particularly happy without their Diamox tablets.

There's not much in the way of "'acclimatization" that a data center employee can go through before a shift in the ol' NOC, so I'm very interested in hearing from anyone who's spent anytime in a low oxygen environment trying to administer critical infrastructure.

By the way, the supposed low-oxygen environment didn't work out too well in this blog entry I titled "Ode to a Suppressant."

/Hoff

Another Virtualized Solution for VM Security...

I got an email reminder from my buddy Grant Bourzikas today pointing me to another virtualized security solution for servers from Reflex Security called Reflex VSA.  VSA stands for Virtual Security Appliance and the premise appears to be that you deploy this software within each guest VM and it provides what looks a lot like host-based intrusion prevention functionality per VM.

The functionality is defined thusly:

Reflex VSA solves the problem that traditional network security such as IPS and firewall appliances currently can not solve: detecting and preventing attacks within a virtual server. Because Reflex VSA runs as virtualized application inside the virtualized environment, it can detect and mitigate         threats between virtual hosts and networks.

Reflex VSA Features:
        • Access firewall for permission enforcement for intra-host and external network
           communication
        • Intrusion Prevention with inline blocking and filtering for virtualized networks
        • Anomaly, signature, and rate-based threat detection capability        
        • Network Discovery to discover and map all virtual machines and applications
        • Reflex Command Center, providing a centralized configuration and management
           console, comprehensive reporting tools, and real-time event aggregation and
           correlation   

It does not appear to wrap around or plug-in to the HyperVisor natively, so I'm a little confused as to the difference between deploying VSA and whatever HIPS/NIPS agent a customer might already have deployed on "physical" server instantiations.

Blue Lane's product addresses this at the HyperVisor layer and it would be interesting to me to have the pundits/experts argue the pros/cons of each approach. {Ed. This is incorrect.  Blue Lane's product runs as a VM/virtual appliance also.  With the exposure via API of the hypervisor/virtual switches, products like Blue Lane and Reflex would take advantage to be more flexible, effective and higher performing.}

I'm surprised most of the other "security configuration management" folks haven't already re-branded their agents as being "Virtualization Compliant" to attack this nascent marketspace. < :rolleyes here: >

It's good to see that folks are at least owning up to the fact that intra-VM communications via virtual switches are going to drive a spin on risk models, detection and mitigation tools and techniques.  This is what I was getting at in this blog entry here.

I would enjoy speaking to someone from Reflex to understand their positioning and differentiation better, but isn't this just HIPS per VM?  How's that different than firewall, AV, etc. per VM?

/Hoff

John Thompson's (Symantec) Ironic warning of "Conflict of Interest"

Infoworld ran an interesting article on John Thompson's recent CeBIT keynote in which he took a shot at Microsoft by suggesting that there is an inherently "...huge conflict of interest for one company to provide both an operating platform and a security platform."

I suppose that opinion depends upon whether or not said company suggests that their security controls are all that are needed to secure said operating system or that defense in depth is not needed.

Here's why I find this statement interesting and I am going to twist it by agreeing with the statement within the context of the same argument pertaining to Cisco as an extension to the many, many articles I have already written on this topic.

Given just the last rash of vulnerabilities in Cisco's routing, switching and security products a few weeks ago, I believe it's also a mistake (you can read "conflict of interest" if you desire) for Cisco (le fox) to protect the network (le chicken.)  That's the same argument of the "operating system" and the "security platform."

I think it's simply not relevant or appropriate to simply shrug off issues like this just because of Cisco's size and the apparent manifest destiny associated with security "going into the switch" -- just because it does and more than likely will -- does not mean it should and does not mean that people will settle for "good enough" security when the network consistently fails to self-defend.

I don't disagree that more and more security *will* make it's way into the network switches, much like I don't disagree that the sun will rise in the east and set in the west, but much in the same way that folks don't just give up and go to sleep once the sun goes down, the lightbulb that goes on in my head suggests there is a better way.

/Hoff

Blue Lane VirtualShield for VMWare - Here we go...

Greg Ness from Blue Lane and I have known each other for a while now, and ever since I purchased Blue Lane's first release of products a few years ago (when I was on the "other" side as a *gasp* customer) I have admired and have taken some blog-derived punishment for my position on Blue Lane's technology.

I have zero interest in Blue Lane other than the fact that I dig their technology and products and think it solves some serious business problems elegantly and efficiently with a security efficacy that is worth its weight in gold.

Vulnerability shielding (or patch emulation...) is a provocative subject and I've gone 'round and 'round with many a fine folk online wherein the debate normally dissolves into the intricacies of IPS vs. vulnerability shielding versus the fact that the solutions solve a business problem in a unique way that works and is cost effective.

That's what a security product SHOULD do.  Yet I digress.

So, back to Greg @ Blue Lane...he let me know a few weeks ago about Blue Lane's VirtualShield offering for  VMWare environments.  VirtualShield is the first commercial product that I know of that specifically tackles problems that everyone knows exists in VM environments but have, until now, sat around twirling thumbs at.

In fact, I alluded to some of these issues in this blog entry regarding the perceived "dangers" of virtualization a few weeks ago.

In short, VirtualShield is designed to protect guest VM's running under a VMWare ESX environment in the following manner (and I quote):

• Protects virtualized servers regardless of physical location or patch-level;
• Provides up-to-date protection with no configuration changes and no agent installation on each virtual machine;
• Eliminates remote threats without blocking legitimate application requests or requiring server reboots; and
• Delivers appropriate protection for specific applications without requiring any manual tuning.

VS basically sits on top of the HyperVisor and performs a similar set of functionality as the PatchPoint solution does for non-VM systems.

Specifically, VirtualShield discovers the virtual servers running on a server and profiles the VM's, the application(s), ports and protocols utilized to build and provision the specific OS and application protections (vulnerability shielding) required to protect the VM.

I think the next section is really the key element of VirtualShield:

As traffic flows through VirtualShield inside the hypervisor, individual sessions are decoded and monitored for vulnerable conditions. When necessary, VirtualShield can replicate the function of a software security patch by applying a corrective action directly within the network stream, protecting the downstream virtual server.

As new security patches are released by software application vendors, VirtualShield automatically downloads the appropriate inline patches from Blue Lane. Updates may be applied dynamically without requiring any reboots or reconfigurations of the virtual servers, the hypervisor, or VirtualShield.

While one might suggest that vulnerability shielding is not new and in some cases certain functionality can be parlayed by firewalls, IPS, AV, etc., I maintain that the manner and model in which Blue Lane elegantly executes this compensating control is unique and effective.

If you're running a virtualized server environment under VMWare's ESX architecture, check out VirtualShield...right after you listen to the virtualization podcast with yours truly from RSA.

/Hoff

Just in case you think I DON'T like Richard Stiennon...

Just so you don't think that I personally dislike Richard Stiennon, allow me to clear that up. 

I like Richard very much.  In fact, I like him a lot more today as I was cleaning up my office and came across these little gems (picture below) which was part of a Christmas (?) gift Richard sent when he was bringing up IT-Harvest (his independent analyst and IT/Security compendium business) and we were a customer...

So not only is Richard useful, witty, smart and (*cough*) handsome, his choice of wine (a Bordeaux) works a lot better than the Scotch he referred to earlier.

Thanks, Richard!

/Hoff

RSA Conference Virtualization Panel - Audio Session Available

According to the folks at RSA, people really wanted the audio recording  of the DEPL-107 "Virtualization and Security" panel session I was on @ this year's RSA show. 

The room was filled to the brim and I think ultimately it's worth the listen.  Good balance of top-down and bottom-up taxonomy of the challenges virtualization brings to the security world.

The kind folks @ RSA decided that rather than charge for it, they would release it for free:

"Demand for these six sessions was so high at RSAR Conference 2007 that we're providing the audio recordings for all to enjoy for free. Please download the session audio files below, and enjoy!"

If you think I write a lot, I talk a hell of a lot more!  Yikes.

Here is the link to the .mp3 of the DEPL-107 Session.

Enjoy.  /Hoff

How to make a Security Sandwich out of Ron Gula and Stephen Toulouse? Just add Hoff...

Firstly, my apologies to both Ron and Stephen for the grotesque visual...especially when you consider that this ridiculous analog is all the more absurd when you consider that I'm suggesting I'm the bologna in the middle. 

Ew. 

As I write this, I regret it immediately.

I'm referring to being included -- along with the usual cast of characters; Rothman, Shimel, Williams, Stiennon, etc. -- in ITSecurity.com's Top 59 Influencers in IT Security listing.  I'm #24, right in between Gula and Toulouse!  This is how we roll, yo!

I'm sure Alan's going to complain that Amrit beat him out for #1, but I find it hysterical that John Thompson and Tom Noonan are below me!  Technically, I'm listed twice; once in the bloggers section and again under the Corporate Security Officers section. 

The only way this list is in actual order of anything is the possibility that the ranking represents the number of complaints regarding content from my rabid blog readership of 4 (and you know who you are.)  Nonetheless, thanks for voting 6 times each, ya'll!   

You can check out this interesting list of people here.

/Hoff

The semantics of UTM messaging: Snake Oil and Pissing Matches

Those of you who know me realize that no matter where I go, who I work for or who's buying me drinks, I am going to passionately say what I believe at the expense of sometimes being perceived as a bit of a pot-stirrer. 

I'm far from being impartial on many topics -- I don't believe that anyone is truly impartial about anything --  but at the same time, I have an open mind and will gladly listen to points raised in response to anything I say.  I may not agree with it, but I'll also tell you why. 

What I have zero patience for, however, is when I get twisted semantic marketing spin responses.  It makes me grumpy.  That's probably why Rothman, Shimmy and I get along so well.

Some of you might remember grudge match #1 between me and Alex Niehaus, the former VP of Marketing for Astaro (coincidence?)  This might become grudge match #2.  People will undoubtedly roll their eyes and dismiss this as vendors sniping at one another.  So be it.  Please see paragraphs #1 and 2 above. 

My recent interchange with Richard Stiennon is an extension of arguments we've been having for a year or so from when Richard was still an independent analyst.  He is now employed as the Chief Marketing Officer at Fortinet. 

Our disagreements have intensified for what can only be described as obvious reasons, but I'm starting to get as purturbed as I did with Alex Neihaus when the marketing sewerage obfuscates the real issues with hand-waving and hyperbole. 

I called Richard out recently for what I believed to be complete doubletalk on his stance on UTM and he responded here in a comment.  Comments get buried so I want to bring this back up to the top of the stack for all to see.  Don't mistake this as a personal attack against Richard, but a dissection of what Richard says.  I think it's just gobbledygook.

To be honest, I think it took a lot of guts to respond, but his answer makes my head spin as much as Anna Nicole Smith in a cheesecake factory.  Yes, I know she's dead, but she loved cheesecake and I'm pressed for an analogy.

The beauty of blogging is that the instant you say something, it becomes a record of "fact."  That can be good or bad depending upon what you say. 

I will begin to respond to Richard's retort wherein he first summarily states:

Here is where I stand. I hate the huge bucket that UTM has become.  Absolutely every form of gateway security can be lumped in to this category that IDC invented. We discussed this at RSA on the panel that Mr. Rothman so graciously hosted.

I also assume that this means Richard hates the bit buckets that Firewall, IPS, NAC, VA/VM, and Patch Management (as examples) have become, too?   This trend is the natural by-product of marketers and strategists scrambling to find a place to hang their hat in a very crowded space.  So what.

UTM is about solving applied sets of business problems.  You can call it what you like, but the only reason marketeers either love or hate UTM usually depends upon where they sit in the rankings.  This intrigues me, Richard, because (as you mention further on) Fortinet pays to be a part of IDC's UTM Tracker, and they rank Fortinet as #1 in at least one of the product price ranges, so someone at Fortinet seems to think UTM is a decent market to hang a shingle on.

Hate it or not, Fortinet is a UTM vendor, just like Crossbeam.  Both companies hang their shingles on this market because it's established and tracked.

When trying to classify a market you look for common traits and, even better, common buying patterns, to help lump vendors or products in to a category. But for Crossbeam, Fortinet, and Astaro to be lumped together has always struck me as a sign that the UTM "market" was not going to work.

You're right.  Lumping Crossbeam with Fortinet and Astaro is the wrong thing to do.  ;)

Arguing the viability of a market which has tremendous coverage and validated presence seems a little odd.  Crafting a true strategy of differentiation as to how you're different in that market is a good thing, however.

I much prefer the Gartner view (as I would) of Security Platforms. These are devices that are able to apply security policies using a bunch of different methods and they can loosely be thrown on to a grid...

So what you're saying is that you like the nebulous and ill-defined blob that is Gartner's view, don't like IDC, but you'll gladly pay for their services to declare you #1 in a market you don't respect?

Now, yes, I did join a company that IDC considers to be a major UTM player- leading in volume shipments in those parts of 2006 that they are reporting. But, I was an independent analyst and I NEVER classified Fortinet as a UTM play.

You mean besides when you said:

"By all accounts the so called UTM market is doing very well with players like Fortinet, Barracuda, Sonicwall, Astaro, and Watchguard, evidently seeing considerable success" 

Just in case you're interested, you can find that quote here.   There are many, many other examples of you saying this, by the way.  Podcasts, blog entries, etc.

Also, are you suggesting that Fortinet does not consider itself a UTM player?  Someone better tell the Marketing department.  Look at one of your news pages on your website.  Say, this one, for example -- 10 articles have UTM in the title and your own Mr. Akomoto (VP of Fortinet, Japan) says "The UTM market was pioneered by us," says Mr. Okamoto, the vice-president of Fortinet Japan. Mr. Okamoto explains how Fortinet created the UTM category, the initial popularity of UTM solutions with SMBs..." 

Heck, in the 24 categories for the security market that I maintained I did not even track UTMs. As I tracked Fortinet over the years I considered them a security platform vendor and one that just happened to be executing on my vision for the network security space.

Yes, I understand how much you dislike IDC.  Can you kindly show reference to where you previously commented on how Fortinet was executing on your vision for Secure Network Fabric?  I can show you where you did for Crossbeam -- it was at our Sales Meeting two years ago where you presented.  I can even upload the slide presentation if you like.

As you know Chris I have always been a big fan of Crossbeam and in the interest of full disclosure, Crossbeam was a client while I was a Gartner analyst and my second client when I launched my own firm. Great people and a great product.

Richard, I'm not really looking for the renewal of your Crossbeam Fan Club membership...really.

Crossbeam is the security platform of choice for running legacy security apps.

Oh, now it's on!  I'm fixin' to get "Old Testament" on you!

Just so we're clear, ISV applications that run on Crossbeam such as XML gateways, web-application firewalls, database firewalls and next generation network converged security services such as session border controllers are all UTM "legacy applications!?" 

So besides an ASIC for AV, what "new" non-legacy apps does Fortinet bring to the table?  I mean now.  From the Fortinet homepage, please demonstrate which novel new applications that Firewall, IPS, VPN, Web filtering and Antispam represent?

It must suck to have to craft a story around boat-anchor ASICs that can't extend past AV offload.  That means you have to rely on software and innovation in that space.  Cobbling together a bunch of "legacy" applications with a nice GUI doesn't necessarily represent innovation and "next generation." 

Now let's address the concept of running multiple security defenses on one security platform. Let's take three such functions, Firewalling, VPN, and IPS. Thanks to Checkpoint, firewalls and VPN are frequently bundled together. It has become the norm, although in the early days these were separate boxes. Now, you can either take a Snort implementation and bolt it on to your firewall in such a way that a signature can trigger a temporary block command ala Checkpoint and a bunch of other so called IPS devices or you can create a deep packet inspection capable firewall that can apply policies like: No Worm Traffic. To do the latter you have to start from scratch. You need new technology and several vendors do this pretty well.

It's clear you have a very deluded interesting perspective on security applications. The "innovation" that you're suggesting differentiates what has classically been described as the natrual evolution of converging marketspaces.  That over-played Snort analogy is crap.  The old "signature" vs. "anomaly detection" argument paired with "deep packet inspection" is tired.  Fortinet doesn't really do anything that anyone else can't/doesn't already do.  Except for violating GPL, that is.

I suppose now that Check Point has acquired NFR, their technology is crap, too?  Marcus would be proud.

So, given a new way to firewall (payload inspection instead of stateful inspection) what enterprise would choose *not* to use IPS capability in their firewall and use a separate device behind the firewall? See the trouble? A legacy firewall is NO LONGER BEST OF BREED! The best of breed firewall can do IPS.

Oh come on, Richard.  First of all, the answer to your question is that many, many large enterprises and service providers utilize a layered defense and place an IPS before or after their firewall.  Some have requirements for firewall/IDS/IPS pairs from different vendors.  Others require defense in depth and do not trust that the competence in a solutions provider that claims to "do it all."

Best of breed is what the customer defines as best of breed.  Just to be clear, would you consider Fortinet to be best of breed?

If you use a Crossbeam, by the way, it's not a separate device and you're not limited to just using the firewall or IPS in "front of" or "behind" one another.  You can virtualize placement wherever you desire.  Also, in many large enterprises, using IPS's and firewalls from separate vendors is not only good practice but also required.

How does Fortinet accomplish that?

Your "payload inspection" is leveraging a bunch of OSS-based functionality paired with an ASIC that is used for AV -- you know, signatures -- with heuristics and a nice GUI.  Whilst the Cosine IP Fortinet acquired represents some very interesting technology for provisioning and such, it ain't in your boxes.

You're really trying to pick a fight with me about Check Point when you choose to also ignore the fact that we run up to 15 other applications such as SourceFire and ISS on the same platform?  We all know you dislike Check Point.  Get over it.

I have spent eight of the last 12 weeks on the road meeting our large enterprise clients in the Americas, Asia, and EMEA. None of them shop comparatively for UTM appliances. Every single customer was shopping for firewall upgrades, SSL VPN, spam or virus filtering inline, etc.

Really?  So since you don't have separate products to address these (Fortinet sells UTM, afterall) that means you had nothing to offer them?  Convergence is driving UTM adoption.  You can call it what you want, but you're whitewashing to prove a flawed theorem.

During the sales process they realize the benefit of combined functionality that comes with the ability to process payloads and invariably sign up for more than just a single security function. Does that mean UTM is gaining traction in the enterprise? To me the answer is no. It means that the enterprise is looking for advanced security platforms that can deliver better security at lower capex and opex.

...and what the heck is the difference between that and UTM, exactly?  People don't buy IPS, they buy network level protection to defend against attack.  IPS is just the product catagory, as is UTM. 

I would lay off the Bourbon Chris. Try a snifter of my 16 yr old Lagavulin that I picked up in London this Friday. It will help to mellow you out.

I don't like Scotch, Richard.  It leaves a bad taste in my mouth...sort of like your response ;)

Risk Assessment Does Not Equal Risk Management

Symantec announced the acquisition of 4FrontSecurity today and will absorb their product/service offerings into Symantec's Security and Compliance Management group.  The press release sadly describes the deal within the context of a very myopic view of managing risk today:

[the acquisition will]...bring new tools to capture and track procedural controls and measure them against a variety of industry best practices and standards

Put another way, "we'll dress up compliance management by calling it Risk Management."  And just to be clear, risk assessment is not the same as risk management.

4FrontSecurity is a small company that is focused on an emerging market niche that allows companies to automate the collection, processing, articulation and compliance measurements of risk assessment data.  Again, that's not the same thing as managing risk.  Managing risk includes asset mapping, business impact, remediation and modeling, amongst other things.  Until we are also able to factor in the human element, risk management tools will never be truly complete. 

I posted last week about Skybox in particular.  RedSeal Systems also has a similar product.  Each of these products provides for the articulation of a company's risk posture from a slightly different perspective.  I have not had any hands-on experience with RedSeal, but I have with Skybox.  I had zero visibility into 4FrontSecurity's products, so I have no empirical way of comparing the three products. 

I am frustrated to see that the trend continues as these larger security Risk Management companies (a la Symantec, McAfee, etc.) start to encapsulate this compliance-driven measurement approach within their larger "risk management" messaging while continuing to expand upon their toolset portfolios one acquisition at a time.

Recently, PatchLink acquired STAT from Harris to "...allow PatchLink to improve its vulnerability management products to help enterprises address risk management and policy-based compliance."  Vulnerability and patch management does not equal risk management.

I'm glad to see companies using the term Risk Management, I just wish it was within the proper context and wasn't done to perfume a pig.

/Hoff

In the UK this Week...

Forgot to mention that I'm in the UK this week.  I'm sure you're all relieved to know that.  Not to worry, I shall continue to execute on my Blogsolidation strategy and bring you the best in Web2.5.

Just so as nobody feels sorry for me, we have a two day event at Turnberry in Scotland. Amazing place for golf, this.  I shoot in the 70's...any colder than that I won't play ;)

If you're in London, Edinburgh or Glasgow, ping me and I'll buy you a beverage of your choice.  If you happen to be going to the 6 Nations Ireland vs. Scotland match on Saturday, I'll be there!  Because our VP of Customer Support is Scottish, I am obligated to cheer for them.  I will be drinking Guiness, however.  Just to be fair, you see.

/Hoff

Massive Security Blog Consolidation Underway: RationalSecurity to Acquire "StillSecure After All These Years" Blog

BOSTON MA, March 3 /PRNewswire/ - Rational Security 
BlogoDomination Corp. (RSBC) announced its intention 
today to continue the expansion of its consolidation 
strategy in the overly saturated Security Blog Market 
with the unsolicited hostile takeover bid and acquisition
of Alan Shimel's "StillSecure After All These Years 
(SSAATY)" Blog.

Christofer Hoff, CEO and Dark Overlord of the Security
Blogsolidation Dominion, today announced that upon 
release of SSAATY's recent earnings report showing a 
marked uptake in revenues with income hovering at over 
$18 per month, that RSBC would offer an unheard of 20X 
revenue multiplier in a stock-for-stock exchange and
an "I (heart) NAC" bumper sticker.

Alan Shimel, SSAATY's CEO/CTO/CMO/CIO/CFO/CSO refused 
comment other than to crisply and vehemently reject
Hoff's bid citing unacceptable terms; balking at only a 
20X multiplier, he pointed to Ken Xie's $4B sale of 
NetScreen to Juniper and suggested that Hoff "...get real if he expects this bulls**t
takeover attempt to warrant any sort of attention other than a trackback and lower 
Technorati rating."  

Art Coviello, CEO of RSA, complemented his prognostications from his recent 2007 RSA 
Security Conference keynote wherein he stated that there would there not be any 
independent security companies in 3 years, and Hoff's RSBC would "...subsume all 
security blogs within the same timeframe."  Mike Rothman was quoted as "...not giving
a crap because neither of them purchased a copy of the P-CSO."  

Hoff's response was just as shrill, "If Shimel doesn't pony up like the little bitch
that he is, I'll buy his lap dog Mitchell's blog instead."

Contact:

Christofer Hoff				Alan Shimel
CEO and Dark Overlord of the Security	CEO/CTO/CMO/CIO/CFO/CSO
Blogsolidation Dominion			StillSecure After All These Years
[email protected]	[email protected]

When Blogging goes bad...

Hey, do you remember reading this little snippet as a quote from a certain industry personality we all know and love in regards to his lack of love for UTM?

"I have a problem with the idea of Universal Threat Management appliances.  Leaving aside the horrible terminology (Who wants to manage threats? Don’t you want to block them and forget about them?) the question that I always ask is: If best-of-breed is the standard for large enterprises why would it be good practice for a smaller entity to lump a lot of security functions such as firewall, email gateway, spam filter, anti-virus, anti-spyware, IDS, IPS, and vulnerability management all in one under-powered device?"

I'll give you a hint.  It was posted here by the original author and I responded to it, here.

That's right!  It was my buddy, Richard Stiennon -- lambasting Universal (sic) Threat Management appliances...like those of Fortinet, before they offered him a job.  Perhaps Fortinet doesn't count because they make Unified, not Universal, Threat Management devices?

Don't hate the player, baby, hate the game!  (i.e., be careful what you blog, it could come back to hire haunt you.)

Sorry, Rich.  3 Bourbons and a long week make Johnny a lit boy.  Couldn't help myself.  Fire Away!

/Hoff

Chuck Norris Can't Kill SOA

As a reprise to the cartoon published earlier today, here's all you ever need to know about SOA; well, a few things actually.  The entire list is here. 

• SOA is the only thing Chuck Norris can't kill.


• SOA invented the internet, and the internet was invented for SOA.


• SOA is not complex. You are just dumb.


• In the last year, SOA increased Turkey's GDP by a factor of 10.


• One person successfully described SOA completely, and immediately died.


• Another person successfully described SOA completely, and was immediately outsourced.


• Larry Ellison once died in a terrible accident, but was quickly given SOA. He came back to life, built a multibillion dollar software company, and now flies fighter jets.


• Guns don't kill people, the SOA WS-* stack kills people.


• SOA can write and compile itself.


• SOA is an anagram for OSA, which means female bear in spanish. It is a well-known fact in the spanish-speaking world that female bears are able to model business processes and optimize reusable IT assets better than any other hibernating animal.


• SOA is so great 10 facts aren't enough.


• SOA is the mistress to all CIOs.


• SOA is just one letter away from SOB. On purpose.


• If a tree falls in the forest, SOA knows about it.


• If you google 'SAP' and 'Chuck Norris', the top site is SOA Facts.


• SOA is being used in the developing world to solve hunger. Entire populations will be fed on future business value.

...now you know.

SecurityBullshit.com calls out boxes that go Whirr in the night...

Funny.  For more chuckles, see SecurityBullshit!

Hey, at least I've never said "military grade hardware." ;)

Web 2.0 can't be protected by Web 1.0 Security Models when Attackers are at Attacker 3.0...

Gunnar Peterson (1 Raindrop blog) continues to highlight the issues of implementing security models which are not keeping pace with the technology they are deployed to protect.  Notice I didn't say "designed" to protect.

Specifically, in his latest entry titled "Understand Web 2.0 Security Issues - As Easy as 2, 1, 3" he articulates (once again) the folly of the security problem that we cannot solve because we simply refuse to learn from our mistakes and proactively address security before it becomes a problem:

"So let's do the math, we have rich Web 2.0 and its rich UI and lots of disparate data and links, we are protecting these brand new 2007-built apps with a Web 1.0 security model that was invented in 1995. This would not be a bad thing at all if the attacker community had learned nothing in the last 12 years, alas they have already upgraded to attacker 3.0, and so can use Web 2.0 to both attack and distribute attacks.

2.0 functionality, 1.0 security, 3.0 attackers. this cannot stand."

A-Friggin'-Men.  Problem is, unless we reboot the entire human race (or at least developers and security folk) it's going to take a severe meltdown to initiate change.

Oh, and BTW, just because it bugged me when Thomas Ptacek bawked while asking what I meant in a presentation of mine where I said:

"What happens when we hit Web3.0 and we’re still only at Security 2.4beta11?"

...and he asked:

What does this even mean?

...the answer is simple: Please see Gunnar's post above.  It's written much better, but i trust this is all cleared up now?