Rational Survivability

Bejtlich's Guiness World Record @ Blackhat...Largest (Attempted) Ettercap MITM Attack

So after finally making it to Vegas ( after 3 flight cancellations out of Logan) I got into my hotel room @ Caesar's last night at around 2am in preparation for the week's festivities at Blackhat and DEFCON.

This morning started out with Day Zero of Richard Bejtlich's ("bate-lik" as he's kind to remind you) TCP/IP Weapons School: Black Hat Edition.

What's both sad and good about these classes is the reminder that the new attack vectors always seem to root back to old-school protocol tampering and the manipulation and application of attacks and exploits of vulnerabilities that still haven't been mitigated.

The first half of the day has focused on good ol' Layer-2 attacks; smashing the switch and the hosts attached for fun and...this works up the stack to more progressively evil layered attacks and abuse of all things holy.

Some folks might yawn at this approach, but Rich's philosophy of starting with at the bottom and working up the stack reminds us of just how delicate the networks we take for granted still are.  There are many folks in this class that know a hell of a lot about attack/defend that still take some time answering questions as we go through the Wireshark protocol decodes.  It's good mental gymnastics.  I'm way out of practice in some of this stuff.

To the topic of the blog entry at hand, we have about 60 guys and gals in this class and Rich organized a "lab" exercise that had 10 sets of "triplets" (sender, MITM attacker, recipient) participating in MITM attacks using Ettercap.

While I'm sure we've set no actual records (or perhaps we have!) it was fun to see how many people would disable the firewall rules on their laptops and subject themselves to intercept abuse ;)  The Hoff, however, remains entirely too paranoid to attach his machine to anything resembling a network here -- despite the fact that it's a bulletproof Mac ;)

It's sad that Rich won't be teaching this class anytime soon given his new job @ GE, because he's a great instructor and his courses give a good balance of refresher, practical application of toolsets and in-depth protocol analysis all in one concise tidy package.

Thanks, Mr. B.

/Hoff

Follow-Up to My Cisco/VMWare Commentary

 

Thanks very much to whomsoever at Cisco linked to my previous post(s) on Cisco/VMware and the Data Center 3.0 on the Cisco Networkers website! I can tell it was a person because they misnamed my blog as "Regional Security" instead of Rational Security... you can find it under the Blogs section here. ;)

The virtualization.info site had an interesting follow-up to the VMware/Cisco posts I blogged about previously.

DataCenter 3.0 is Actually Old?

Firstly, in a post titled "Cisco announces (old) datacenter automation solution" in which they discuss the legacy of the VFrame product in which they suggest that VFrame is actually a re-branded and updated version software from Cisco's acquisition of TopSpin back in 2005:

Cisco is well resoluted to make the most out of virtualization hype: it first declares Datacenter 3.0 initiative (more ambitiously than IDC, which claimed Virtualization 2.0), then it re-launches a technology obtained by TopSpin acquisition in April 2005 and offered since September 2005 under new brand: VFrame.

Obviously the press release doesn't even mention that VFrame just moved from 3.0 (which exist since May 2004, when TopSpin was developing it) to 3.1 in more than three years.

In the same posting, the ties between Cisco and VMWare are further highlighted:

A further confirmation is given by fact that VMware is involved in VFrame development program since May 2004, as reported in a Cisco confidential presentation of 2005 (page 35).

Cisco old presentation also adds a detail about what probably will be announced at VMworld, and an interesting claim:

...VFrame can provision ESX Servers over SAN.

...VMWare needs Cisco for scaling on blades...

This starts helping us understand even further as to why Mr. Chambers will be keynoting at VMWorld'07.

Meanwhile, Cisco Puts its Money where its Virtual Mouth Is

Secondly, VMware announced today that Cisco will invest $150 Million in VMware:

Cisco will purchase $150 million of VMware Class A common shares currently held by EMC Corporation, VMware's parent company, subject to customary regulatory and other closing conditions including Hart-Scott-Rodino (HSR) review. Upon closing of the investment, Cisco will own approximately 1.6 percent of VMware’s total outstanding common stock (less than one percent of the combined voting power of VMware’s outstanding common stock).  VMware has agreed to consider the appointment of a Cisco executive to VMware's board of directors at a future date.

Cisco’s purchase is intended to strengthen inter-company collaboration towards accelerating customer adoption of VMware virtualization products with Cisco networking infrastructure and the development of customer solutions that address the intersection of virtualization and networking technologies. 

In addition, VMware and Cisco have entered into a routine and customary collaboration agreement that expresses their intent to expand cooperative efforts around joint development, marketing, customer and industry initiatives.  Through improved coordination and integration of networking and virtualized infrastructure, the companies intend to foster solutions for enhanced datacenter optimization and extend the benefits of virtualization beyond the datacenter to remote offices and end-user desktops.

If should be crystal clear that Cisco and EMC are on a tear with regards to virtualization and that to Cisco, "bits is bits" and virtualizing those bits across the app. stack, network, security and storage departments coupled with a virtualized service management layer is integral to their datacenter strategy.

It's also no mystery as to why Mr. Chambers is keynoting @ VMWorld now, either.

/Hoff

Off to BlackHat and DEFCON...Sunday through Saturday

Off to Vegas for BlackHat and DEFCON for all of next week.

I'll be there from Sunday (7/29) to Saturday (8/4)

What happens in Vegas will unfortunately, undoubtedly and unnecessarily NOT stay in Vegas because the FOIA and celebrity mugshots always undermines by best intentions.  A blog plea for bail money doesn't help, either.

If you're going to be there (and if you're not, why not?) then hook up with The Hoff and his merry band of "InfoSec Professionals."  Give me a ping via email ( choff [@] packetfilter [dot] com ) or SMS/Call +1.978.349.8882

If you can't find us, look for the smoke, sirens and g00n squad.

/Hoff

Remotely Exploitable Dead Frog with Embedded Web Server - The "Anatomy" of a Zero-Day Threat Surface

You think I make this stuff up, don't you?

Listen, I'm a renaissance man and I look for analogs to the security space anywhere and everywhere I can find them.

I maintain that next to the iPhone, this is the biggest thing to hit the security world since David Maynor found Jesus (in a pool hall, no less.)

I believe InfoSec Sellout already has produced a zero-day for this using real worms.  No Apple products were harmed during the production of this webserver, but I am sad to announce that there is no potential for adding your own apps to the KermitOS...an SDK is available, however.

The frog's dead.  Suspended in a liquid.  In a Jar.  Connected to the network via an Ethernet cable.  You can connect to the embedded webserver wired into its body parts.  When you do this, you control which one of its legs twitch.  pwned!

You can find the pertinent information here.

A Snort signature will be available shortly.

/Hoff

(Image and text below thanks to Boing Boing)

The Experiments in Galvanism frog floats in mineral oil, a webserver installed it its guts, with wires into its muscle groups. You can access the frog over the network and send it galvanic signals that get it to kick its limbs.

Experiments in Galvanism is the culmination of studio and gallery experiments in which a miniature computer is implanted into the dead body of a frog specimen. Akin to Damien Hirst's bodies in formaldehyde, the frog is suspended in clear liquid contained in a glass cube, with a blue ethernet cable leading into its splayed abdomen. The computer stores a website that enables users to trigger physical movement in the corpse: the resulting movement can be seen in gallery, and through a live streaming webcamera.
    - Risa Horowitz

Garnet Hertz has implanted a miniature webserver in the body of a frog specimen, which is suspended in a clear glass container of mineral oil, an inert liquid that does not conduct electricity. The frog is viewable on the Internet, and on the computer monitor across the room, through a webcam placed on the wall of the gallery. Through an Ethernet cable connected to the embedded webserver, remote viewers can trigger movement in either the right or left leg of the frog, thereby updating Luigi Galvani's original 1786 experiment causing the legs of a dead frog to twitch simply by touching muscles and nerves with metal.

Experiments in Galvanism is both a reference to the origins of electricity, one of the earliest new media, and, through Galvani's discovery that bioelectric forces exist within living tissue, a nod to what many theorists and practitioners consider to be the new new media: bio(tech) art.
    - Sarah Cook and Steve Dietz

San Francisco is DOWN: The Fragility of Web 2.0 Ecosystem - Common Sense Must Not Have Made the Feature List

I was just leaving the office for a client dinner last night when I noticed I couldn't get to my TypePad blog, but I chalked it up to a "normal" Internet experience.   

When I fired up Firefox this morning (too much wine last night to care) I was surprised to say the least.

I am just awestruck by the fact that yesterday's PG&E  power outage in San Francisco took down some of the most popular social networking and blogging sites on the planet.  Typepad (and associated services,) Craigslist, Technorati, NetFlix etc...all DOWN. (see bottom of post for a most interesting potential cause.)

I'm sure there were some very puzzled, distraught and disconnected people yesterday.  No blogging, no secondlife, no on-line video rentals.  Oh, the humanity!

I am, however, very happy for all of the people who were able to commiserate with one another as they apparently share the same gene that renders them ill-prepared for what is one of the most common outage causalities on the planet: power outages.

Here's what the TypePad status update said this morning:

Update: commenting is again available on TypePad blogs; thank you for your patience.  We are continuing to monitor the service closely.

TypePad blogs experienced some downtime this afternoon due to a power outage in San Francisco, and we wanted to provide you with the basic information we have so far:

• The outage began around 1:50 pm Pacific Daylight Time
• TypePad blogs and the TypePad application were affected, as well as LiveJournal, Vox and other Six Apart-hosted services
• No data has been lost from blogs.  We have restored access to blogs as well as access to the TypePad application. There may be some remaining issues for readers leaving comments on blogs; we are aware of this and are working as quickly as possible to resolve the issue. (See update above.)
• TypePad members with appropriate opt-in settings should have received an email from us this afternoon about the outage.  We will send another email to members when the service has been fully restored.
• We will also be posting more details about today's outage to Everything TypePad.

We are truly sorry for the frustration and inconvenience that you've experienced, and will provide as much additional information as possible as soon as we have it. We also appreciate the commiseration from the teams at many of the other sites that were affected, such as Craigslist, Technorati, Yelp, hi5 and several others.

I don't understand how the folks responsible for service delivery of these sites, given the availability and affordability of technology and hosting capability on-demand, don't have BCP/DR sites or load-balanced distributed data centers to absorb a hit like this.   The management team of Sixapart has experience in companies that understand that the network and connectivity represent the lifeblood of their existence; what the hell happened here in that there's no contingency for power outages?

Surely I'm missing something here.

Craigslist and Technorati are services I don't pay for, so one might suggest taking the service disruption with a grain of SLA salt (or not, because it still doesn't excuse not preparing for issues like this with contingencies)  but TypePad is something I *pay* for.  Even my little hosting company that houses my personal email and website has a clue.  I'm glad I'm not a Netflix customer, either.  At least I can walk down to Blockbuster...

Yes, I'm being harsh, but I there's no excuse for this sort of thing in today's  Internet-based economy.  It affects too many people and services but really does show the absolute fragility of our Internet-tethered society.

Common sense obviously didn't make the feature list on the latest production roll.  Somebody other than me ought to be pissed off about this.  Maybe when Data Center 3.0 is ready to roll, we won't have to worry about this any longer ;)

/Hoff

Interestingly, one of the other stories of affected sites relayed the woes of 365 Main, a colocation company, whose generators failed to start when the outage occurred.  I met the the CEO of 365 Main when he presented at the InterOp data center summit on the topic of flywheel UPS systems which are designed to absorb the gap between failure detection and GenStart.  This didn't seem to work as planned, either. 

You can read all about this interesting story here.  This was problematic because the company had just issued a press release about a customer's 2-year uninterrupted service the same day ;)

Valleywag reported that the cause of the failure @ 365 Main was due to a drunk employee who went berserk! This seemed a little odd when I read it, but check out how the reporter from Valleywag is now eating some very nasty Crow ... his source was completely bogus!

Update: commenting is again available on TypePad blogs; thank you for your patience.  We are continuing to monitor the service closely.

TypePad blogs experienced some downtime this afternoon due to a power outage in San Francisco, and we wanted to provide you with the basic information we have so far:

• The outage began around 1:50 pm Pacific Daylight Time
• TypePad blogs and the TypePad application were affected, as well as LiveJournal, Vox and other Six Apart-hosted services
• No data has been lost from blogs.  We have restored access to blogs as well as access to the TypePad application. There may be some remaining issues for readers leaving comments on blogs; we are aware of this and are working as quickly as possible to resolve the issue. (See update above.)
• TypePad members with appropriate opt-in settings should have received an email from us this afternoon about the outage.  We will send another email to members when the service has been fully restored.
• We will also be posting more details about today's outage to Everything TypePad.

We are truly sorry for the frustration and inconvenience that you've experienced, and will provide as much additional information as possible as soon as we have it. We also appreciate the commiseration from the teams at many of the other sites that were affected, such as Craigslist, Technorati, Yelp, hi5 and several others.

Cisco Responds to My Data Center Virtualization Post...

"...I will squash him like a liiiiittle bug, that Hoff!"

OK, well they weren't responding directly to my post from last night, but as they say in the big show, "timing is everything."

My last blog entry detailed some navel gazing regarding some interesting long term strategic moves by Cisco to further embrace the virtualized data center and the impact this would have on the current and future product roadmaps.  I found it very telling that Chambers will be keynoting at this year's VMWorld and what this means for the future.

Not 8 hours after my posting (completely coincidental I'm sure ;) the PR machine spit out the following set of announcements from Networkers Cisco Live titled "Cisco Unveils Plans to Transform the Data Center."    You can find more detailed information from Cisco's web here.

This announcement focused on outlining some of the near-term (2 year) proofpoints and touts the introduction of "...New Data Center Products, Services and Programs to Support a Holistic View of the Data Center." 

There's an enormous amount of data to digest in this announcement, but the interesting bits for me to focus on are the two elements pertaining to security virtualization as well as service composition, provisioning and intelligent virtualized service delivery.   This sort of language is near and dear to my heart.

I'm only highlighting a small subsection of the release as there is a ton of storage, data mobility, multiservice fabric and WAAS stuff in there too.  This is all very important stuff, but I wanted to pay attention to the VFrame Data Center orchestration platform and the ACE XML security gateway functions since they pertain to what I have been writing about recently:

If you can choke back the bile from the  "Data Center v3.0" moniker:

...Cisco announced at a press conference today its vision for next-generation data centers, called Data Center 3.0. The Cisco vision for Data Center 3.0 entails the real-time, dynamic orchestration of infrastructure services from shared pools of virtualized server, storage and network resources, while optimizing application performance, service levels, efficiency and collaboration.
...

Over the next 24 months, Cisco will deliver innovative new products, programs, and capabilities to help customers realize the Cisco Data Center 3.0 vision. New products and programs announced today support that vision, representing the first steps in helping customers to create next-generation data centers.

Cisco VFrame Data Center

VFrame Data Center (VFrame DC) is an orchestration platform that leverages network intelligence to provision resources together as virtualized services. This industry-first approach greatly reduces application deployment times, improves overall resource utilization, and offers greater business agility. Further, VFrame DC includes an open API, and easily integrates with third party management applications, as well as best-of-breed server and storage virtualization offerings.

With VFrame DC, customers can now link their compute, networking and storage infrastructures together as a set of virtualized services. This services approach provides a simple yet powerful way to quickly view all the services configured at the application level to improve troubleshooting and change management. VFrame DC offers a policy engine for automating resource changes in response to infrastructure outages and performance changes. Additionally, these changes can be controlled by external monitoring systems via integration with the VFrame DC web services application programming interface (API).

I think that from my view of the world, these two elements represent a step in the right direction for Cisco.  Gasp!  Yes, I said it.  While Chambers prides himself on hyping Cisco's sensitivity to "market transitions" it's clear that Cisco gets that virtualization across both the network, host and storage is actually a real market.  They're still working the security piecem however they, like Microsoft, mean business when they enter a space and it's no doubt they're swinging to fences with VFrame. 

I think the VFrame API is critical and how robust it is will determine the success of VFrame.  It's interesting that VFrame is productized as an appliance, but I think I get what Chambers is going to be talking about at VMWorld -- how VFrame will interoperate/interact with VMWare provisioning and management toolsets. 

Interestingly, the UI and template functionality looks a hell of a lot like some others I've blogged about and is meant to provide an umbrella management "layer" that allows for discovery, design, provisioning, deployment and automation of services and virtualized components across resource pools of servers, network components, security and storage:

Cisco VFrame Data Center components include:

• Cisco VFrame Data Center Appliance: Central controller that connects to Ethernet and Fibre Channel networks
• Cisco VFrame Data Center GUI: Java-based client that accesses application running on VFrame Data Center Appliance
• Cisco VFrame Web Services Interface and Software Development Kit: Programmable interface that allows scripting of actions for Cisco VFrame Data Center
• Cisco VFrame Host Agent: Host agent that provides server heartbeat, capacity utilization metrics, shutdown, and other capabilities
• Cisco VFrame Data Center Macros: Open interface that allows administrators to create custom provisioning actions

That's ambitious to say the least.

It's still a raucous debate with me regarding where a lot of this stuff belongs (in the network or as a service layer) and I maintain the latter.  Innovation driven by companies such as 3Tera demonstrate that the best ideas are always copied by the 800 pound gorillas once they become mainstream.

Enhanced Cisco ACE XML Gateway Software

The new Cisco Application Control Engine (ACE) Extensible Markup Language (XML) Gateway software delivers enhanced capabilities for enabling secure Web services, providing customers with better management, visibility, and performance of their XML applications and Web 2.0 services. The new software includes a wide variety of new capabilities and features plus enhanced performance monitoring and reporting, providing improved operations and capacity planning for Web services secured by the Cisco ACE XML Gateway.

I'd say this is a long overdue component for Cisco; since Chambers has been doing nothing but squawking about Web2.0, collaboration, etc., the need to integrate XML security into the security portfolio is a must, especially as we see XML as the Internet-based messaging bus for just about everything these days.

All in all I'd say Cisco is doing a good job of continuing to push the message along and while one shouldn't see this faint praise as me softening my stance on Cisco's execution potential, it's yet to be seen if trying to be everything to everyone will deliver levels of service commensurate with what customers need.

Only time will tell.

/Hoff

 

Cisco & VMWare - The Revolution will be...Virtualized?

During my tour of duty at Crossbeam, I've closely tracked the convergence of the virtualization strategies of companies such as VMWare with Cisco's published long term product direction. 

One of the selfish reasons for doing so is that from a product-perspective, Crossbeam's platform provides a competitively open, virtualized routing and switching platform combined with a blade-based processing compute stack powered by a hardened, Linux based operating system that allows customers to run the security applications of their choice. 

This provides an on-demand security architecture allowing customers to simply add a blade in order to add an application service component when needed.

Basically this allows one to virtualize networking/transport, applications/security contexts and security policies across any area of the network into which this service layer is plumbed and control the flows in order to manipulate in serial or parallel the path traffic takes through these various security software components.

So that's the setup.  Yes, it's intertwined with a bit of a commercial, but hey...perhaps liberty and beer are your idea of "free," but my blogoliciousness ain't.  What's really interesting is some of the deeper background on the collision of traditional networking with server virtualization technology.

While it wasn't the first time we've heard it (and it won't be the last,) back in December 2006, Phil Hochmuth from Network World wrote an article that appeared on the front page which was titled "Cisco's IOS set for radical pricing, feature changes."  This article quoted Cliff Metzler, senior vice president of the company’s Network Management Technology Group as saying these very important words:

Cisco’s intention is to decouple IOS software from the hardware it sells, which could let users add enhancements such as security or VoIP more quickly, without having to reinstall IOS images on routers and switches. The vendor also plans to virtualize many of its network services and applications, which currently are tied to hardware-specific modules or appliances.

This shift would make network gear operate more like a virtualized server, running multiple operating systems and applications on top of a VMware-like layer, as opposed to a router with a closed operating system, in which applications are run on hardware-based blades and modules. Ultimately, these changes will make it less expensive to deploy and manage services that run on top of IP networks, such as security, VoIP and management features, Cisco says.

“The way we’ve sold software in the past is we’ve bolted it onto a piece of hardware, and we shipped [customers] the hardware,” Metzler said. “We need more flexibility to allow customers to purchase software and to deploy it according to their terms.” 

IOS upgrades require a reinstall of the new software image on the router or switch — which causes downtime — or, “we say, not a problem, UPS will arrive soon, here’s another blade” to run your new service or application, Metzler said. “This adds months to the deployment cycle, which is not good for customers or Cisco’s business.”

The article above fundamentally demonstrates the identical functional software-based architecture that Crossbeam offers for exactly the right reasons; make security simpler, less expensive, easier to manage and more flexible to deploy on hardware that scales performance-wise.

Now couple this with the announcement that John Chambers will be delivering a keynote at VMWorld and things get even more interesting in a hurry.  Alessandro Perilli over at the Virtualization.info blog shares his perspective on why this is important and what it might mean:

Chambers presence possibly means announcement of a major partnership between VMware and Cisco, which may be related to network equipment virtualization or endpoint security support.

Many customers in these years prayed to have capability to use virtual machines as routers inside VMware virtual networks. So far this has been impossible: despite Cisco proprietary IOS relies on standard x86 hardware, it still requires a dedicated EEPROM to work, which VMware doesn't include in its virtual hardware set. Maybe Cisco is now ready to virtualize its hardware equipment.

On the other side VMware may have a deal in place with Cisco about its Assured Computing Environment (ACE) product: Cisco endpoint security solution called Network Admission Control (NAC) may work with VMware ACE as an endpoint security agent, eliminating any need to install more software inside host or guest operating systems.

In any case a partnership between VMware and Cisco may greatly enhance virtual infrastructures capabilities.

This is interesting for sure and if you look at the way in which the demand for flexibility of software combined with generally-available COTS compute stacks and specific network processing where required, the notion that Cisco might partner with VMWare or a similar vendor such as SWSoft looks compelling.  Of course with functionality like KVM in the Linux kernel, there's no reason they have to buy or ally...

Certainly there are already elements of virtualization within Cisco's routing, switching and security infrastructure, but many might argue that it requires a refresh in order to meet the requirements of their customers.  It seems that their CEO does.

I think that this type of architecture looks promising.  Of course, you could have purchased it 6 years ago -- as you can today -- by talking to these folks. But I'm biased. ;)

/Hoff

I Promised I Wouldn't, but I Did...iPhone Smoothies! Die, iPhone...Die!

I'm so damned iSick of everything iPhone.  This is beautiful.  Die, iPhone, Die!

Brings new meaning to the phrase "blended threat."

If you've got NoScript running, here's the link.

/Hoff

Security RROI (Reduction of Risk on Investment)

The security blogosphere sure is exciting these days.  I can't decide whether to tune into the iPhone junkie wars, the InfoSec Sellout soap opera or the Security ROI cage match!

I'm going to pick the latter because quite honestly, the other two are about as inflated as Bea Arthur's girdle...

(edit: link added for Cutaway whose predilection towards Bea Arthur and her undergarments are disturbing at best...) Warning...May Cause Chaffing...)

Unless you've been under a rock (or actually, gasp!, working) you've no doubt seen Rich Bejtlich's little gem titled "No ROI?  No Problem" that re-kindled all sorts of emotive back and forth debating the existence of Security ROI.

It was revisited by Rich here and then here...and then picked up by Lindstrom, Hutton, Cutaway and the rest of the risk management cognoscenti.  All good stuff.

It seems that the unofficial scoring has the majority of contributors to the debate suggesting that Security ROI does not exist...sort of.  The qualification of the word "return" really seems to be the important lynchpin here as contribution (margin, profit, etc.) versus cost avoidance really is what sends people off the deep end.

It appears that if we define 'return' to suggest that what you get back is a way of avoiding shelling out money, then indeed, one may quantify a return on the investment made.

Fine.  I'm good with that.  To a point.

However, I've never used ROI in any metric I've produced.  NPV?  Nope.  ROSI?  Nuh-uh.

What I have chosen to use is RROI -- the reduction of risk on investment.  HA!  Another term.

Basically, I've used various combinations of metrics and measurements to quantify data points and answer the question:

"If I invest in some element of my security program (people, process, technology) -- or after I have invested in it -- am I more secure than I was before and how much more?  Furthermore, how should I manage my investment portfolio to give me the best reduction of risk?"

One doesn't hire security guards because of an expectation that this action will cause one to be more profitable; it's a cost of doing business that allows one to asses the risk based on impact and decide how, if at all, one could or should invest in security to defray the impact and cost associated with the event(s) one is trying to mitigate.

Ah yes, the old "why would you spend $1000 to protect a $10 asset?" question.  Can you answer this question for every security investment you make?

I'd say that I've always been able to communicate what the "return" (see above) would be on investments made and done so in a manner that has always seen my security budgets grow when necessary and trim when warranted.  The transparency I strive to produce is communicated in business terms that anyone who can understand basic math and business logic can process.  Maybe I'm just lucky. 

I'm not saying I have the problem licked or that I found the holy grail, but the problem just doesn't seem to be as daunting as some would have you believe.  Start small, be rational and build and manage your portfolio accordingly.

So, how many of you have risk dashboards that can, in near-time, communicate where you invest, why and how this maps to the business and helps you most effectively manage risk per dollar spent?  This is what's really important.

I'm just wondering that instead of trying to globally force-feed a definition across a contentious landscape of religion and philosophy, perhaps we could spend the time arguing less about terms and more about solving problems.  Ask the business how they want to see your security value communicated and go from there.  If they want ROI, then fine...define the "R" appropriately and move on.

I'm going to "return" to work now... ;)

/Hoff

Security Pay It Forward (Literally) - Giving Back to Tranax/Triton ATM Owners

The only thing worse than when people find out you're in the "computer industry" and ask you to diagnose why their USB-powered combo blender/Easy-bake oven keeps giving them the BSOD is when they find out you're in the "computer security" field and ask you to diagnose why their Symantec (nee Norton) Uber Blocking Pop-Up Personal Firewall prevents them from connecting to AOL.

Sometimes, however, I feel compelled to volunteer myself when I know I can quickly help so I can feel good about "giving back" and make the world a more secure place.

Today was such a day.

I took the kids to our local candlestick bowling joint en route to a matinee screening of "Hairspray" the movie (very good, by the way.)  As the kids were knocking down frames thanks to the bumpers in the gutters, I went to the ATM for monetary reinforcement in order to buy the requisite pop and pizza.

As I approached the machine, the floor manager -- noticing that I was going to use the ATM -- scurried to plug the machine in so I could use it.  Noticing that it was a Tranax unit since this particular marque has been in the news lately due to security concerns, I happily queried the manager as to whether or not they had changed the default password on the machine.

I don't really know why I did this.  Perhaps because I wanted to settle a bet with myself or just to show off my mad security current event skillz.  Honestly, I think I just wanted to see what would happen under controlled circumstances.  Nevertheless, I asked and waited patiently for a response as the machine whirred and clicked.

She looked at me puzzled and asked what I meant and why.  At which point I was going to be content in alerting her to the potential that someone could easily use the Internet to gain 10 seconds of courage and rip them off by re-programming the ATM to think it was giving out $5 bills instead of $20 bills by gaining access to the admin. interface via the default password.

At the exact moment I said this, the machine finished booting as she walked away shrugging her shoulders wondering no doubt why this tattooed idiot in bowling shoes was trying to "help."  As she did this, the screen started blinking alerting me that the cash magazine was empty and if would I like to enter the Administrator mode.

I called her back over to the ATM and said "watch" at which point I was queried for the administrative password which I dutifully keyed in as "######" (not shown so I don't enable those idiots who can't manage to find the real number via Google.)  The myriad of administrative options was splayed out before me and we walked through the various scenarios that might appear should we execute.

Das machine was owned and now she understood.

We agreed that this was a bad thing and that she should unplug the machine until the owner who serviced the unit could be contacted.  I suggested that she find a way to make sure that nobody could plug it back in easily and I walked her through changing the password.

I figured I'd done a good deed and proceeded go out into the parking lot and scour my car for loose change so I could at least buy the kids a soda since I could no longer get cash and I didn't exactly trust their security to use my credit card at this point.

I returned to find the manager giving me back the $23 I paid for bowling in return for the security lesson.

I thanked her for the trade and got the hell out of there before she asked me how to update the anti-virus signatures on the point of sale terminal that took credit card payments...

The moral of the story?  Don't be afraid to offer a little security help every once in a while.  You never know, it might earn you $23 and some free bowling.  Karma.  Nice.

Now I'm going to visit the Mobil station down by the highway...they have the same machines.  I could always use some free gas ;)

As Cutaway would say..."Go forth and do good things."

/Hoff

Freaky Friday Post: How to Enforce Security in the Penetentiary...Philipino Style

Many nation states find innovative ways of enforcing security in their stockades and jails.  We've got that crazy sheriff in Arizona who enables the prisoner's fashion sense by outfitting them with pink jumpsuit couture and then there's Gitmo.

Honestly, in the U.S. jails have become an effective method of obtaining 3 squares and a warm bed (albeit sometimes with somebody else in it) and quite honestly provide little in the way of taxpayer payback.

I say enough!  Let's look abroad for inspiration.  Let's see...the Taliban's a little extreme, Brazil...that whole waxing thing is over the top...ummmm...

Aha! The Philippines have solved this problem.  It seems they have made an investment that truly demonstrates ROI in the security space.  It allows for both freedom of expression and entertainment whilst repaying the monarchy in a tribute to the King Of Pop.

Ladies and germs, I present you the ensemble cast of inmates from the the Cebu Provincial Detention and Rehabilitation Center, Cebu, Philippines.  Hey, you slackers at Pelican Bay, nut up!

This truly is the "Thriller in Manilla!"

Wow.

Blue Man Group is teh pwned!

/Hoff

The Evolution of Bipedal Locomotion & the Energetic Economics of Virtualization

By my own admission, this is a stream-of-consciousness, wacky, caffeine-inspired rant that came about while I was listening to a conference call.   It's my ode to paleoanthropology and how we, the knuckledraggers of IT/Security, evolve.

My apologies to anyone who actually knows anything about or makes an honest living from science; I've quite possibly offended all of you with this post...

I came across this interesting article posted today on the ScienceDaily website which discusses a hypothesis by a University of Arizona professor, David Raichlen, who suggests that bipedalism, or walking on two legs, evolved simply because it used less energy than quad knuckle-walking.  If one looks at the force impact expended whilst quad-knuckle walking, it is comparably 4 times that of a bipedal footprint!  That's huge.

I'm always looking for good tangential analogs for points I want to reinforce within the context of my line of work, and I found this fantastic fodder for such an exercise.

So without a lot of work on my part, I'm going to post some salient points from the article and leave it up to you to determine how, if at all, the "energetic" evolution of virtualization draws interesting parallels to this very interesting hypothesis; that the heretofore theorized complexity associated with this crucial element of human evolution was, in fact, simply an issue derived from energy efficiency which ultimately led to sustainable survivability and not necessarily because of ecological, behavioral or purely anatomical reasons:

From Here:

The origin of bipedalism, a defining feature of hominids, has been  attributed to several
competing hypothesis. The postural feeding hypothesis (Hunt 1996) is an ecological model.
The behavioral model (Lovejoy 1981) attributes bipedality to the social, sexual and
reproductive conduct of early hominids. The thermoregulatory model (Wheeler 1991) views
the increased heat loss, increased cooling, reduced heat gain and reduced water requirements conferred by a bipedal stance in a hot, tropical climate as the selective pressure leading to bipedalism.

At its core, server virtualization might be described as a manifestation of how we rationalize and deal with the sliding-window impacts of time and the operational costs associated with keeping pace with the transformation and adaptation of technology in compressed footprints.  One might describe this as the "energy" (figuratively and literally) that it takes to operate our IT infrastructure.

It's about doing more with less and being more efficient such that the "energy" used to produce and deliver services is small in comparison to the output mechanics of what is consumed.  One could suggest that once the efficiency gains (or savings?) are realized, the energy can be allocated to other more enabling abilities.  Using the ape to human bipedalism analog, one could suggest that bipedalism lead to bigger brains, better hunting/gathering skills, fashioning tools, etc.  Basically the initial step of efficiency gains leads to exponential capabilities over the long term.

So that's my Captain Obvious declaration relating bipedalism with virtualization.  Ta Da!

From the article as sliced & diced by the fine folks at ScienceDaily:

Raichlen and his colleagues will publish the article, "Chimpanzee locomotor energetics and the origin of human bipedalism" in the online early edition of the Proceedings of the National Academy of Sciences (PNAS) during the week of July 16. The print issue will be published on July 24.

Bipedalism marks a critical divergence between humans and other apes and is considered a defining characteristic of human ancestors. It has been hypothesized that the reduced energy cost of walking upright would have provided evolutionary advantages by decreasing the cost of foraging.

"For decades now researchers have debated the role of energetics and the evolution of bipedalism," said Raichlen. "The big problem in the study of bipedalism was that there was little data out there."

The researches collected metabolic, kinematic and kenetic data from five chimpanzees and four adult humans walking on a treadmill. The chimpanzees were trained to walk quadrupedally and bipedally on the treadmill.

Humans walking on two legs only used one-quarter of the energy that chimpanzees who knuckle-walked on four legs did. On average, the chimpanzees used the same amount of energy using two legs as they did when they used four legs. However, there was variability among chimpanzees in how much energy they used, and this difference corresponded to their different gaits and anatomy.

"We were able to tie the energetic cost in chimps to their anatomy," said Raichlen. "We were able to show exactly why certain individuals were able to walk bipedally more cheaply than others, and we did that with biomechanical modeling."

The biomechanical modeling revealed that more energy is used with shorter steps or more active muscle mass. Indeed, the chimpanzee with the longest stride was the most efficient walking upright.

"What those results allowed us to do was to look at the fossil record and see whether fossil hominins show adaptations that would have reduced bipedal energy expenditures," said Raichlen. "We and many others have found these adaptations [such as slight increases in hindlimb extension or length] in early hominins, which tells us that energetics played a pretty large role in the evolution of bipedalism."

The point here is not that I'm trying to be especially witty, but rather to illustrate that when we cut through the FUD and marketing surrounding server virtualization and focus on evolution versus revolution, some very interesting discussion points emerge regarding why folks choose to virtualize their server infrastructure.

After I attended the InterOp Data Center Summit, I walked away with a very different view of the benefits and costs of virtualization than I had before.  I think that as folks approach this topic, the realities of how the game changes once we start "walking upright" will provide a profound impact to how we view infrastructure and what the next step might bring.

Server virtualization at its most basic is about economic efficiency (read: energy == power + cooling...) plain and simple.  However, if we look beyond this as the first "step," we'll see grid and utility computing paired with Web2.0/SaaS take us to a whole different level.  It's going to push security to its absolute breaking point.

I liked the framing of the problem set with the bipedal analog.  I can't wait until we come full circle, grow wings and start using mainframes again ;)

Did that make any bloody sense at all?

/Hoff

P.S. I liked Jeremiah's evolution picture, too:

 

 

BeanSec! 11 - July 18th - 6PM to ?

Yo!  BeanSec! 11 is upon us.  Wednesday, July 18th, 2007.

BeanSec! is an informal meetup of information security professionals, researchers and academics in the Greater Boston area that meets the third Wednesday of each month.

Come get your grub on.  Lots of good people show up.  Really.

Unlike other meetings, you will not be expected to pay dues, “join up”, present a zero-day exploit, or defend your dissertation to attend. Map to the Enormous Room in Cambridge.

Enormous Room: 567 Mass Ave, Cambridge 02139

Secure Services in the Cloud (SSaaS/Web2.0) - InternetOS Service Layers

The last few days of activity involving Google and Microsoft have really catalyzed some thinking and demonstrated some very intriguing indicators as to how the delivery of applications and services is dramatically evolving. 

I don't mean the warm and fuzzy marketing fluff.  I mean some real anchor technology investments by the big-boys putting their respective stakes in the ground as they invest hugely in redefining their business models to setup for the future.

Enterprises large and small are really starting to pay attention to the difference between infrastructure and architecture and this has a dramatic effect on the service providers and supply chain who interact with them.

It's become quite obvious that there is huge business value associated with divorcing the need for "IT" to focus on physically instantiating and locating "applications" on "boxes" and instead  delivering "services" with the Internet/network as the virtualized delivery mechanism.

Google v. Microsoft - Let's Get Ready to Rumble!

My last few posts on Google's move to securely deliver a variety of applications and services represents the uplift of the "traditional" perspective of backoffice SaaS offerings such as Salesforce.com but also highlights the migration of desktop applications and utility services to the "cloud" also.

This is really executing on the vision of the thin-client Internet-centric vision from back in the day o' the bubble when we saw a ton of Internet-borne services such as storage, backup, etc.  using the "InternetOS" as the canvas for service.

So we've talked about Google.  I maintain that their strategy is to ultimately take on Microsoft -- including backoffice, utility and desktop applications.  So let's look @ what the kids from Redmond are up to.

What Microsoft is developing towards with their vision of CloudOS was just recently expounded upon by one Mr. Ballmer.

Not wanting to lose mindshare or share of wallet, Microsoft is maneuvering to give the customer control over how they want to use applications and more importantly how they might be delivered.  Microsoft Live bridges the gap between the traditional desktop and puts that capability into the "cloud."

Let's explore that a little:

In addition to making available its existing services, such as mail and instant messaging, Microsoft also will create core infrastructure services, such as storage and alerts, that developers can build on top of. It's a set of capabilities that have been referred to as a "Cloud OS," though it's not a term Microsoft likes to use publicly.

...

Late last month, Microsoft introduced two new Windows Live Services, one for sharing photos and the other for all types of files. While those services are being offered directly by Microsoft today, they represent the kinds of things that Microsoft is now promising will be also made available to developers.

Among the other application and infrastructure components, Microsoft plans to open are its systems for alerts, contact management, communications (mail and messenger) and authentication.

...

As it works to build out the underlying core services, Microsoft is also offering up applications to partners, such as Windows Live Hotmail, Windows Live Messenger and the Spaces blogging tool.

Combine the emerging advent of "thinner" end-points (read: mobility products) with high-speed, lower latency connectivity and we can see why this model is attractive and viable.  I think this battle is heating up and the consumer will benefit.

A Practical Example of SaaS/InternetOS Today?

So if we take a step back from Google and Microsoft for a minute, let's take a snapshot of how one might compose, provision, and deploy applications and data as a service using a similar model over the Internet with tools other than Live or GoogleGear.

Let me give you a real-world example -- deliverable today -- of this capability with a functional articulation of this strategy; on-demand services and applications provided via virtualized datacenter delivery architectures using the Internet as the transport.  I'm going to use a mashup of two technologies: Yahoo Pipes and 3tera's AppLogic.

Yahoo Pipes is  "...an interactive data aggregator and manipulator that lets you mashup your favorite online data sources."  Assuming you have data from various sources you want to present an application environment such as Pipes will allow you to dynamically access, transform and present this information any way you see fit.

This means that you can create what amounts to application and services on demand. 

Let's agree however that while you have the data integration/presentation layer, in many cases you would traditionally require a complex collection of infrastructure from which this source data is housed, accessed, maintained and secured. 

However, rather than worry about where and how the infrastructure is physically located, let's use the notion of utility/grid computing to make available dynamically an on-demand architecture that is modular, reusable and flexible to make my service delivery a reality -- using the Internet as a transport.

Enter 3Tera's AppLogic:

3Tera's AppLogic is used by hosting providers to offer true utility computing. You get all the control of having your own virtual datacenter, but without the need to operate a single server.

Deploy and operate applications in your own virtual private datacenter

Set up infrastructure, deploy apps and manage operations with just a browser    
Scale from a fraction of a server to hundreds of servers in days

Deploy and run any Linux software without modifications

Get your life back: no more late night rushes to replace failed equipment

In fact, BT is using them as part of the 21CN project which I've written about many times before.

So check out this vision, assuming the InternetOS as a transport.  It's the drag-and-drop, point-and-click Metaverse of virtualized application and data combined with on-demand infrastructure.

You first define the logical service composition and provisioning through 3Tera with a visual drag-drop canvas, defining firewalls, load-balancers, switches, web servers, app. servers, databases, etc.  Then you click the "Go" button.  AppLogic provisions the entire thing for you without you even necessarily knowing where these assets are.

Then, use something like Pipes to articulate how data sources can be accessed, consumed and transformed to deliver the requisite results.  All over the Internet, transparent to you securely.

Very cool stuff.

Here are some screen-caps of Pipes and 3Tera.

 

 

 

More on GoogleTini...(Google/Postini Acquisition) by Way of Shimel's Post

Y esterday's post regarding my prognostication of the Google/Postini M&A activity yielded a ton of off-line feedback/opinion/queries.  I had three press/analyst calls yesterday on my opinion, so either I'm tickling somebody's interest funny bone or I'm horribly wrong ;)

Either way, Alan Shimel piped up today with his perspective.  It's not often I disagree with Alan, but the root of his comment leaves me puzzled.  Alan said:

I do not think that Google's acquisition of Postini is a shot across the bow of Microsoft.  I think Google goes about its business of delivering on its vision.  I think its vision is rather simple really. Google believes that the future belongs to Software as a Service (SaaS).  As part of their SaaS strategy, they need to secure their web based apps, as well as offer security as a service.  This is not really much different than Microsofts "Live" program, also a Software as a Service play.  That is where the competition is.

It appears that Alan's really re-stating what I said yesterday regarding SaaS and especially as I highlighted the security aspects thereof, but his statements are strangely contradictory in the scope of this single paragraph.

To wit, if Google is indeed focused on SSaaS (Secure Software as a Service) and they're looking to displace at least for certain markets traditional "Office" applications which are Microsoft's cash cow ($12B business?) how is this not a "shot across the bow of Microsoft?"

Further, if Microsoft is engaging in SaaS with Live, then it further underscores the direct competitive model that demonstrates that Microsoft (et al.) are firmly in the target hairs.

What am I missing here?

/Hoff

(EDIT: Added a link to an interview I did with TheStreet.com here.)

Tell Me Again How Google Isn't Entering the Security Market? GooglePOPs will Bring Clean Pipes...

Not to single out Jeremiah, but in my Take5 interview with him, I asked him the following:

3) What do you make of Google's foray into security?  We've seen them crawl sites and index malware.  They've launched a security  blog.  They acquired GreenBorder.  Do you see them as an emerging force to be reckoned with in the security space?

...to which he responded:

I doubt Google has plans to make this a direct revenue generating  exercise. They are a platform for advertising, not a security company. The plan is probably to use the malware/solution research  for building in better security in Google Toolbar for their users.  That would seem to make the most sense. Google could monitor a user's  surfing habits and protect them from their search results at the same time.

To be fair, this was a loaded question because my opinion is diametrically opposed to his.   I believe Google *is* entering the security space and will do so in many vectors and it *will* be revenue generating. 

This morning's news that Google is acquiring Postini for $625 Million dollars doesn't surprise me at all and I believe it proves the point. 

In fact, I reckon that in the long term we'll see the evolution of the Google Toolbar morph into a much more intelligent and rich client-side security application proxy service whereby Google actually utilizes client-side security of the Toolbar paired with the GreenBorder browsing environment and tunnel/proxy all outgoing requests to GooglePOPs.

What's a GooglePOP?

These GooglePOPs (Google Point of Presence) will house large search and caching repositories that will -- in conjunction with services such as those from Postini -- provide a "clean pipes service to the consumer.  Don't forget utility services that recent acquisitions such as GrandCentral and FeedBurner provide...it's too bad that eBay snatched up Skype...

Google will, in fact, become a monster ASP.  Note that I said ASP and not ISP.  ISP is a commoditized function.  Serving applications and content as close to the user as possible is fantastic.  So pair all the client side goodness with security functions AND add GoogleApps and you've got what amounts to a thin client version of the Internet.

Remember all those large sealed shipping containers (not unlike Sun's Project Blackbox) that Google is rumored to place strategically around the world -- in conjunction with their mega datacenters?  I think it was Cringley who talked about this back in 2005:

In one of Google's underground parking garages in Mountain View ... in a secret area off-limits even to regular GoogleFolk, is a shipping container. But it isn't just any shipping container. This shipping container is a prototype data center.

Google hired a pair of very bright industrial designers to figure out how to cram the greatest number of CPUs, the most storage, memory and power support into a 20- or 40-foot box. We're talking about 5000 Opteron processors and 3.5 petabytes of disk storage that can be dropped-off overnight by a tractor-trailer rig.

The idea is to plant one of these puppies anywhere Google owns access to fiber, basically turning the entire Internet into a giant processing and storage grid.

Imagine that.  Buy a ton of dark fiber, sprout hundreds of these PortaPOPs/GooglePOPs and you've got the Internet v3.0

Existing transit folks that aren't Yahoo/MSN will ultimately yield to the model because it will reduce their costs for service and they will basically pay Google to lease these services for resale back to their customers (with re-branding?) without the need to pay for all the expensive backhaul.

Your Internet will be served out of cache..."securely."  So now instead of just harvesting your search queries, Google will have intimate knowledge of ALL of your browsing -- scratch that -- all of your network-based activity.   This will provide for not only much more targeted ads, but also the potential for ad insertion, traffic prioritization to preferred Google advertisers all the while offering "protection" to the consumer.

SMB's and the average Joe consumers will be the first to embrace this as cost-based S^2aaS (Secure Software as a Service) becomes mainstream and this will then yield a trickle-up to the Enterprise and service providers as demand will pressure them into providing like levels of service...for free.

It's not all scary, but think about it...

Akamai ought to be worried.  Yahoo and MSN should be worried.  The ISP's of the world investing in clean pipes technologies ought to be worried (I've blogged about Clean Pipes here.)

Should you be worried?  Methinks the privacy elements of all this will spur some very interesting discussions.

Talk amongst yourselves.

/Hoff

(Didn't see Newby's post here prior to writing this...good on-topic commentary.  Dennis Fisher over at the SearchSecurity Blog has an interesting Microsoft == Google perspective.)

Take5 (Episode #4) - Five Questions for Shlomo Kramer, Founder/CEO of Imperva

This fourth instance of Take 5 interviews Shlomo Kramer, Founder and CEO of Imperva.

First a little background on the victim:

In 2006, Shlomo Kramer was selected by Network World magazine as one of 20 luminaries who changed the network industry.

Prior to founding Imperva, Mr. Kramer co-founded Check Point Software Technologies Ltd. in 1993. At Check Point, he served in various executive roles through 1998 and as a member of the board of directors through 2003. While at Check Point, Mr. Kramer played a key role in defining and creating several category-defining products and solutions, including FireWall-1, VPN-1, FloodGate-1, Check Point's OPSEC alliance, and Check Point's security appliance program.

Mr. Kramer has participated as an early investor and board member in a number of security and enterprise software companies including Palo Alto Networks, Serendipity Technologies, and Trusteer. Mr. Kramer received a Masters degree in Computer Science from Hebrew University of Jerusalem and a Bachelor of Science degree in Mathematics and Computer Science from Tel Aviv University.

Questions:

1) As most people know, you are a co-founder of Check Point and the CEO of Imperva.  You’re a serial entrepreneur who has made a career of bringing innovation to the security market.  What are you working on now that is new and exciting?

All my time has been devoted in the last few years to Imperva. This project continues to excite me. After five years of hard work, it is very rewarding to see Imperva being recognized as the leader in application data security and compliance. Imperva delivers data governance and protection solutions for monitoring, audit, and security of business applications and databases. This is really a hot issue for organizations given the new threat landscape, regulations such as PCI and SOX and the ever increasing privacy legislation. I have always believed what we do at Imperva will define a new product category and the last couple of years have been a big step towards that.

I am also involved as an investor and board member in a number of other great security startups.  One example is Palo Alto Networks (www.paloaltonetworks.com), a next-generation firewall company. Their products provide full visibility and policy control over applications across all ports, all protocols, all the time--with no performance degradation. We’ve just launched the company, it’s an exciting time for Palo Alto Networks.

Another great company I am involved with is Trusteer (www.trusteer.com). Trusteer addresses the critical problem of protecting on-line transaction. Trusteer came up with a revolutionary way to protect online business from any "client-side" identity threat such as phishing, pharming, and crimeware. Helping business strengthen consumer trust, reduce costs, and differentiate online services is a big challenge and Trusteer has a very interesting and unique solution.


2) So tell us more about Palo Alto Networks on whose Board you sit.   The company has assembled an absolutely amazing group of heavy hitters from industry.  Either you’ve already got the company sold to Cisco and everyone’s signing on for the options or this is really going to be huge.  What’s so different  about what PAN is doing?

Existing firewalls are based on Stateful Inspection, which employs a port and protocol approach to traffic classification. The problem existing firewall vendors face is the fact that much of their core technology (Stateful Inspection) is over a dozen years old and new applications have found a variety of ways to evade or bypass them with relative ease. Attempts to fix the problem by firewall vendors include 'bolting-on' Intrusion Prevention (IPS) or Deep Packet Inspection as an additional feature have proven unsuccessful, resulting in significant issues with accuracy, performance and management complexity.

Starting with a blank slate, the Palo Alto Networks founders took an application-centric approach to traffic classification thereby enabling visibility into-and control over-Internet applications running on enterprise networks. The PA-4000 Series is a next-generation firewall that classifies traffic based on the accurate identification of the application, irrespective of the port, protocol, SSL encryption or evasive tactic used.

3) Having been an early adopter of Check Point, Imperva, Vidius, Skybox, Sanctum, etc. I clued in long ago to the power of the Israeli influence in the security industry.   Why are so many of the market leading technologies coming out of Israel? What’s in the water over there?

Really the start was with IDF based incubation of security know-how some 20 years ago. That for sure has been the case when we started Check Point. Over the years, an independent security community has emerged and by now it is very much a self perpetuating eco-system. I am very proud of being one of the founders not only of Check Point and Imperva but also of this broader Israeli security community.

4) We haven’t had a big worm outbreak in the last couple of years and some would argue it’s quiet out there. While identity theft leads the headlines these days, what’s the silent killer lurking in the background that people aren’t talking  about in the security industry?

When we started Imperva in 2002, security was all about worms – it was about a “my attack is bigger than yours” hacker mentality. We believed that future threats would be different and would be focused on targeted attacks.  We placed a bet that the motive of hackers would shift from ego to profit.  We’ve definitely seen that trend materialize over the last couple of years. On the server side, 50% of data leakage involves SQL-injection attacks and XSS is increasingly a leading threat, especially with the added complexity of Web 2.0 applications. Additionally, on the client side we are seeing many more targeted attacks, all the way down to the specific brokerage and on-line banking system you are using. The crimeware infecting your laptop cannot be addressed by a generic, negative logic solution, like anti-virus or anti-spyware, nor will strong authentication help circumvent its malice.
These targeted attacks on business data and on-line transactions are the focus of both Imperva and Trusteer. Imperva focuses on the server side of the transaction while Trusteer focuses on the client side.

5) With Imperva, you’re in the Web Application Security business.  What’s your take on the recent acquisitions by IBM and HP and how they are approaching the problem.  For companies whose core competencies are not focused on security, will this sort of activity really serve the interest of the customer of is it just opportunism?

Just to clarify, Imperva is actually in the application data security and compliance business, a major component of which is Web application security.  Securing databases and big enterprise applications are also part of that picture, as well as addressing regulatory mandates around data usage.  It’s all interrelated.

I think the moves by HP & IBM validate a general trend that we at Imperva have been evangelizing for some time -- that application security is a huge issue, and we as an industry really need to get serious about protecting business applications and data.

I would argue that they won’t solve application security and compliance issues with these acquisitions alone.  The reason is that these solutions are only scratching the surface of the issues.  For one, most organizations use packaged applications and don’t have access to modify the source code to fix the issues they might find.  And lots of organizations take a long time to fix code errors even if they do have the capability to modify the code.  This argues for an independent mechanism to implement protections outside the code development / fix process. 

But the larger issue is scope – the data that organizations ultimately want to protect usually lives in a database and is accessed by a variety of mechanisms –applications are one, but direct access by internal users and other internal systems is another huge area of risk.  So addressing only one part of the application’s relationship to this data is not enough.  In my opinion, addressing the whole application data system is ultimately the way to address the core application and data security issue.

Fat Albert Marketing and the Monetizing of Vulnerability Research

Over the last couple of years, we've seen the full spectrum of disclosure and "research" portals arrive on scene; examples stem from the Malware Distribution Project to 3Com/TippingPoint's Zero Day Initiative.  Both of these examples illustrate ways of monetizing the output trade of vulnerability research.   

Good, bad or indifferent, one would be blind not to recognize that these services are changing the landscape of vulnerability research and pushing the limits which define "responsible disclosure."

It was only a matter of time until we saw the mainstream commercial emergence of the open vulnerability auction which is just another play on the already contentious marketing efforts blurring the lines between responsible disclosure for purely "altruistic" reasons versus commercial gain.

Enter Wabisabilabi, the eBay of Zero Day vulnerabilities.   

This auction marketplace for vulnerabilities is marketed as a Swiss "...Laboratory & Marketplace Platform for Information Technology Security" which "...helps customers defend their databases, IT infrastructure, network, computers, applications, Internet offerings and access."

Despite a name which sounds like Mushmouth from Fat Albert created it (it's Japanese in origin, according to the website) I am intrigued by this concept and whether or not it will take off.

I am, however, a little unclear on how customers are able to purchase a vulnerability and then become more secure in defending their assets. 

A vulnerability without an exploit, some might suggest, is not a vulnerability at all -- or at least it poses little temporal risk.  This is a fundamental debate of the definition of a Zero-Day vulnerability. 

Further, a vulnerability that has a corresponding exploit but without a countermeasure (patch, signature, etc.) is potentially just as useless to a customer if you have no way of protecting yourself.

If you can't manufacture a countermeasure, even if you hoard the vulnerability and/or exploit, how is that protection?  I suggest it's just delaying the inevitable.

I am wondering how long until we see the corresponding auctioning off of the exploit and/or countermeasure?  Perhaps by the same party that purchased the vulnerability in the first place?

Today in the closed loop subscription services offered by vendors who buy vulnerabilities, the subscribing customer gets the benefit of protection against a threat that they may not even know they have, but for those who can't or won't pony up the money for this sort of subscription (which is usually tied to owning a corresponding piece of hardware to enforce it,) there exists a point in time between when the vulnerability is published and when it this knowledge is made available universally.

Depending upon this delta, these services may be doing more harm than good to the greater populous.

In fact, Dave G. over at Matasano argues quite rightly that by publishing even the basic details of a vulnerability that "researchers" will be able to more efficiently locate the chunks of code wherein the vulnerability exists and release this information publicly -- code that was previously not known to even have a vulnerability.

Each of these example vulnerability service offerings describes how the vulnerabilities are kept away from the "bad guys" by qualifying their intentions based upon the ability to pay for access to the malicious code (we all know that criminals are poor, right?)  Here's what the Malware Distribution Project describes as the gatekeeper function:

Why Pay?

Easy; it keeps most, if not all of the malicious intent, outside the gates. While we understand that it may be frustrating to some people with the right intentions not allowed access to MD:Pro, you have to remember that there are a lot of people out there who want to get access to malware for malicious purposes. You can't be responsible on one hand, and give open access to everybody on the other, knowing that there will be people with expressly malicious intentions in that group.

ZDI suggests that by not reselling the vulnerabilities but rather protecting their customers and ultimately releasing the code to other vendors, they are giving back:

The Zero Day Initiative (ZDI) is unique in how the acquired vulnerability information is used. 3Com does not re-sell the vulnerability details or any exploit code. Instead, upon notifying the affected product vendor, 3Com provides its customers with zero day protection through its intrusion prevention technology. Furthermore, with the altruistic aim of helping to secure a broader user base, 3Com later provides this vulnerability information confidentially to security vendors (including competitors) who have a vulnerability protection or mitigation product.

As if you haven't caught on yet, it's all about the Benjamins. 

We've seen the arguments ensue regarding third party patching.  I think that this segment will heat up because in many cases it's going to be the fastest route to protecting oneself from these rapidly emerging vulnerabilities you didn't know you had.

/Hoff