January 5, 2009 - Volume 4, #2

Good Morning:
The holidays are over. Though as I was driving around my neighborhood, it seems not everyone has a new calendar. Some folks still have their decorations up, which is pretty annoying. Though I'm sure those wreaths will be pulled down and the lights dismantled over the next week - or else the neighborhood decoration police start squeeling a bit.   

More importantly, this week is about setting the tone for the rest of the year. My kids need to go through a serious detox. We've been a bit lax about sleep patterns over the holiday break, but that's got to end. When I poke my head into the oldest's room tomorrow AM at 6:30, it'll be a real shock to her, and probably to me as well. Maybe getting her a Space Invaders alarm clock will help. Probably not.

If you can't get your priorities in focus and make some progress on that list this week, then it's probably not going to get a lot better throughout the rest of the year.

I'm not going to belabor the points I made on Friday about commitment to change. Whatever you want to do this year, it needs to start today. Before you know it, the ball will drop on 2009 and another year will be in the books.

So stop reading my drivel and get to work. Have a great day.


Photo: "Space Invaders Alarm Clock" uploaded by _ES
Technorati: Information Security, CSO, Security Mike, Internet Security

The Pragmatic CSO: Available Now! Read the Intro and Get "5 Tips to be a Better CSO" www.pragmaticcso.com

5 for 2009

Before I jump back into my cycle of news commentary, I thought it made sense (on the first real work day of 2009) to give a little perspective on what I expect to happen this year. A lot of folks have made predictions (though seemingly not as many as in previous years) and I want to be clear, I am not in the prognostication business anymore - so these are just a few things to think about as we head into 2009.

1. Budget tightening - Unfortunately, I was right in my macro-economic projections from last year. I figured Q3 would be bad and Q4 horrible. The security business seems relatively insulated, but I don't expect that to continue through 2009. The reality is budgets will be tightened throughout the year as the depth of the malaise sets in. So it's wise to take an approach like MCW, which is to figure out what you can do with NO new funding or resources.
2. Product line extensions - Given the need to do more with less, it's going to be hard to get new vendors into the mix. But you will see a lot of existing vendors start to wrap more and more functionality into their existing "suite," which then allows customers to bring in new capabilities into a maintenance renewal. Of course, we've seen big security vendors adding more capabilities to their offerings for years. The difference we'll see this year is the vendors bundling in more value-add to maintain renewal dollars - as opposed to seeing those go away. The best example of this will be full disk encryption, which will emerge as a feature of the endpoint suite.
3. Fire sales - Given the difficulty of placing new products in customers in 2009, and the focus of Big Security to add value to their existing offerings - there will be a lot of carnage in security start-up land. VC funding will be scarce and cash flow will be challenging for these small vendors. So you'll see a lot of asset sales and companies going away. Customers need to be very focused on this both for new purchases (which will be minimal) and even renewals. It's reasonable to check a vendor's balance sheet and make sure they've got a decent plan to exit 2009 in one piece.
4. Services are everywhere - In this kind of environment, customers are increasingly looking at service offerings to allow them to reduce capital expenditures and address the skills gap (since it'll be very hard to add headcount). The biggest issue is going to be a lot of shysters offering services they can't deliver on. Smaller MSSPs may not have the infrastructure and processes to support the 24/7 types of oversight that security requires. So it's reasonable to really dig into any of these providers and make sure they can answer the right questions.
5. Hype deflation - Pssssst. That's the sound of the air coming out of the virtualization security balloon. Not that virtualization won't continue happening. Of course it will. But in the absence of any verifiable attack on a virtualized stack, there won't be much to talk about. That won't stop Hoff (and others) from trying, though. There is a chance that the PCI council will make a strategic mandate on virtualization, which could blow up the balloon. But I think they are much more likely to make a nebulous statement and decide to do nothing. Also expect new categories like network-based entitlement management to struggle, since there isn't really a compelling need for these boxes.

January 2, 2009 - Volume 4, #1

Good Morning:
Happy frackin' New Year. That's right. After being largely invisible in December, I'm going to try to be better about consistently posting the Incite a few times per week and some other random thoughts as they appear in my pea brain.   

You see, I've come to realize that I can't get everything done. I've been weighed down for the past month with guilt that I would spend a few hours doing my "personal" stuff when I had some much to do for my day job. What I've discovered, is that regardless of whether I work 10 or 18 hours a day - there is always more to do.

So screw it. I'm going to write my newsletter because I've missed doing it. The Boss reminded me of a few good one's that I wrote over the year (she doesn't exactly read them the day they are written) and I realized how much logging my daily rantings have become part of what I like to do.

So I'm going to keep doing it. And with that, take a look back at 2008 and see what you did right and wrong. What are you going to change? How are you going to change it? Are you sure? I've got no patience for the "resolutions" that everyone makes when the ball drops in NYC.

You either change or you don't. I mean MASSIVE CHANGE. Some folks look to make incremental changes. In my experience (especially with personal developement), it doesn't work. It's too easy to back slide into the old, bad habits. I do that all the time.

Don't fool yourself thinking that 2009 will be different unless you are going to be doing something different, actively and consistently. I've heard definition of someone insane is one who expects a different outcome from the same activity. I believe that.

So here's to you making the changes you need to make in 2009, and to having a great year!


Photo: "massive change" uploaded by 416style
Technorati: Information Security, CSO, Security Mike, Internet Security

The Pragmatic CSO: Available Now! Read the Intro and Get "5 Tips to be a Better CSO" www.pragmaticcso.com

2008 Incite Report Card

We could sit and agonize about how crappy 2008 was. But actually it was a pretty decent year for me. I'm very fortunate and I know it. But as Anton points out, there is no way I was going to miss getting back to my Incites for 2008 and seeing how I fared. Of course, my time schedule doesn't allow me to do such detailed analysis of each Incite, but I'll provide a sentence or two on each one - just to keep myself honest.

As I look at the Incites, I only have one comment. Pretty crappy... But like everyone else, I didn't foresee the depth of the economic malaise and that had a direct impact on a lot of these projections. At least, that's how I rationalize my continued inability to project much of anything.

Incite #1:  Express Your Inner Bean Counter

Grade: D+

This one didn't exactly go as planned. OK, it really should be an F. There was no consensus and there doesn't seem to be any consensus on the horizon. It's too bad because it's something that is sorely needed by the industry. But we are (justifiably) more worried about keeping the lights on and fighting to keep our already limited resources and funding. Though metrics will help in the long term. We don't have the luxury of thinking long term right now.

Incite #2: It’s time for an audit revolution

Grade: B

Whenever you see any of the surveys heading into 2009, compliance is still a critical issue and one that "will not" be deferred, regardless of the economic situation. I'm not quite sure I believe that, but I do think that compliance continues to be a major corporate imperative. Even in a global recession, the auditors still show up and we'll probably still treat them like crap. Which is another story for another day.

Incite #3: Best of Breed DOA

Grade: B+

Can you even get a stand-alone firewall anymore? I guess if you consider Palo Alto's box a "firewall," then maybe - but that's about it. This has happened and no one even talks about it anymore, and with Check Point's acquisition of Nokia's appliance business - it'll accelerate. Consolidation will continue in 2009, valuations will come down (reflecting the lack of options for most small security companies). I'm also right on target with the consolidation of security management offerings. At least I've made a huge career bet on it, so I'm not just blowing smoke on this one.

Incite #4: Weaving security into the network fabric

Grade: B-

Network security is largely just "accepted." Everyone has some equipment to protect their perimeter. The rush to bake security into the fabric will take longer than anticipated, mostly due to the fact that with the economic carnage - there are no real catalysts to invest in the infrastructure right now. We saw a few NAC vendors go out and some trying to keep their heads above water. But this is a market for the big boys and the sooner any independents find a partner, the better it will be for them (and their investors).

Incite #5: Night of the Internet Dead

Grade: A

There was seemingly no stopping the zombie machine as it continued to proliferate around the world. We did see an ISP of ill repute get thrown off the island (when other ISPs stopped peering with them), but an amazing thing happened. Attacks continued, machines kept getting compromised, and with the exception of a week respite, the head grew back. In 2009, trying to stop all of these attacks is a bit too much to ask. So focus on making sure you contain damage and (right) REACT FASTER.

Incite #6: Laptop encryption hits the big leagues

Grade: B+

Are there any stand-alone laptop encryption things left? I know, I know - a few - but not many. All of the big AV vendors have their own solution and in 2009, we'll likely see the bundling happen in earnest. Why wouldn't McAfee, Sophos and Symantec (once they buy GuardianEdge) just give it away? In this kind of environment, these guys will be pushing for renewals, and adding a lot of sweetener to get it to happen. What has lagged are the management tools from the O/S vendors (MSFT and Apple) to really make this happen as part of the operating system. The fact that no one is deploying Vista doesn't help either.

Incite #7: The SDLC is your friend

Grade: C

Another casualty of the economic downturn will be strategic things like the SDLC. Which is too bad, since it's critical that we address the root cause of these application attacks. Web application firewalls did find their sea legs, and they can send the check to "PCI Security Standards Council." When the PCI folks made the firewall a must-have, they carried the entire business with it. That will likely lead to Imperva and Breach getting a long look from the network security vendors in 2009. And the SDLC work that really needs to happen gets pushed back to 2010/11, best case.

Incite #8: Protect the Vault (that’s where the money is)

Grade: B

Database security limped along in 2008, as big companies started dipping their toes into the water. But this wasn't a very exciting business in 2008, and it's hard to see what's going to make it exciting in 2009. And every year this space doesn't break out is another year the big DB folks get closer to doing it themselves - or acquiring technology at fire sale prices. And when was the last time you heard anything about encryption infrastructure? I suspect a bunch of the small vendors hanging on in that space will go away in 2009, and the rest will be subsumed - because there just isn't a market for it. 

Incite #9: Get the jumper cables for DLP

Grade: B+

The fact is that DLP is a small market, and will remain that way. I've heard (anecdotally) that Symantec's group (the former Vontu) is doing well, but that's about it. The standalone vendors are struggling, and the big vendors are trying to figure out what to do with it. Licensing the engine to Microsoft seemed to be RSA's answer. I still hold to the reality that large enterprises can look at a stand-alone solution because their liability is a lot greater - everyone else should be playing around with their mail and web gateways and tuning those regular expressions. Yes, it's a lame answer - but can you go spend 6 figures on a DLP thing now? Right.

Incite #10: Hack thyself

Grade: C

Driven perhaps by the loud mouths that continue to talk down pen testing, this was still an uphill battle for those enlightened security professionals that actually wanted to see what was really at risk. I'll admit to being a little early on this one, but over the next 2 years it will play out. Why? Because most of the new attacks target applications and a lot of the application scanners actually have exploit-like code built in. So application testers (right, Q/A folks) will become "pen testers" as we expand the definition of pen testing. The economic environment has probably put the kibosh on any kind of formal "security assurance" group for the time being - but that is another one I believe will play out, though it may be part of the audit team over time.

December 9, 2008 - Volume 3, #93

Good Morning:
It's funny, in that I made a very major life change back in May and I haven't really talked about it. And I pretty much talk about everything here at the Incite. I maybe have alluded to it, I think. But then again maybe not. And given that I can't even remember what I had for breakfast this morning, the odds that I can remember what I wrote since May are nil.   

So it's time to come clean. Back in May I ate the last piece of meat I'll have for the foreseeable future. That's right, I'm now a vegetarian.  I've been evolving in this direction for the past year and pulled the trigger rather spontaneously in Seattle on a long weekend with the Boss.

After eating a fine piece of meat in a fancy restaurant, I turned to her and said, "I'm done." And that was that. The date was May 3, and I haven't looked back. Sometime I miss chicken wings, but not really.

I'm doing this for health reasons, since I'm no tree hugger. There is a lot of bad stuff in my genetic tree and I plan to harass and annoy my wife and kids for another 50 years or so. I've done some analysis and figured one of the better ways to do that is to stop eating meat. So that's what I'm doing.

I have to say that everyone I deal with has been very supportive. Our friends and family have been overly accommodating and have no issue (nor do they take offense) when I bring my supply of trusty Boca burgers or hijack their wok to do a quick stir fry. But it did create an interesting Thanksgiving.

I didn't want to do one of those veggie turkeys, since something about that seemed weird to me. So I made a vegetarian baked ziti and we stocked up on things like corn souffle and tons of vegetables, stuffing and mashed potatoes. It was a bit of carb overload, but amazingly enough it worked out fine.

And there is no meat in pumpkin pie or Cool Whip. At least some Thanksgiving traditions can stay traditions. Now the next challenge will by my annual Super Bowl party. What am I going to do if I'm not knocking down 40-50 wings? Guess I'll cross that bridge when I get to it...

Have a great day.


Photo: "vegetarian Thanksgiving" uploaded by hlkljgk
Technorati: Information Security, CSO, Security Mike, Internet Security

The Pragmatic CSO: Available Now! Read the Intro and Get "5 Tips to be a Better CSO" www.pragmaticcso.com

Incite 4U

Wow, it's been a while. Holidays will do that. So I'm not going to cover either useless (like the Apple AV tussle) or the uninteresting (pretty much everything else). I guess with the downturn, there just isn't that much news. But don't get lulled into a sense of false security. The bad guys are out there and they are waiting to pounce. Now is the time to make sure you know what's going on, before you don't.

December 8, 2008 - Management Training - #69

Mike's Pep Talk:

"It would be better if you begin to teach others only after you yourself have learned something."
-- Albert Einstein

I am a fortunate guy. The journey I'm on continues to amaze and astound me. I viewed The Pragmatic CSO as my opportunity to give a little back based on all of the great people that have taught me the ropes through the years. Though I don't have as much time to devote to P-CSO pursuits as I'd like, which is clearly evidenced by the lack of newsletters and podcasts of late, it's time to revisit the content and give folks that haven't been exposed to it another chance to get Pragmatic.

I've partnered with the folks at the Business of Security site to run a series of webcasts and virtual peer group sessions to run folks through the boot camp I put together a year ago. In this kind of economic environment, it's all the more critical that every security professional be focused on adding value and selling the benefits of security. Being Pragmatic is certainly a time-proven method to doing that.

The first session doesn't cost anything and will be held this Thursday via webcast. I'll run through the current state of security, and go into depth on the first section of the P-CSO - "Plan to be Pragmatic."

Even better, through the generosity of the Business of Security folks (and my employer, eIQ) I'm able to offer attendees to the session a 50% discount on the book and/or PDF. But to get the discount, you need to attend the session. 

SO, if you've been waiting to for the price of the P-CSO to come down - this is your chance.

There will also be a special discount for folks that want to participate in the peer group sessions. More details will be available during the session.

Here is the link to the registration page. I hope to see you on Thursday.

Photo credit: Army.mil

So my Spidey sense was tingling by the time I got to the house and I received maybe 3 or 4 of these strange messages. I headed right to Incite Central to log into my eBay account and see what the hell was going on.

Ruh oh. It was already locked. That’s when I got a message from the fine folks at eBay saying my account had been compromised as someone was using it to send bad emails to other eBay members. They also mentioned that the account was not used to list or bid on other items, just the email issue. There were instructions on how to “reclaim” my account.

I went through the process, which was through an online chat. The folks verified my identity (and the address I had on file was at least 10 years out of date, uh!) and reset my password. Then I had to change my account information, but the account was still locked. So I went through the process again, and after another identity verification, I was able to update my information.

Then my personal containment plan went into effect. I promptly changed the passwords to any account listed in eBay. It turned out to only be one email account, but I changed a bunch of other accounts – just in case. I figured better that than having a full on breach.

What happened to start this mess? A weak password. Pure and simple. I had set up my eBay account before I got strong password religion (and 1Password to manage them).

This was a low cost reminder for me of the importance of constant vigilance. I hadn’t updated my eBay info in 10 years and I used a terrible weak password. I got lucky. It could have been much worse.

Hat’s off to the eBay folks, who figured things out even before I did (and it didn’t take me long). Their system was proactive and straight forward to reclaim my identity. Any online provider can and should learn from this.

But the final lesson is yours. Check your stuff. Stay alert and use strong passwords. Remember it can happen to anyone. Even you.

Photo: "eBay Live 2005" originally uploaded by Jochen Siegle/TechShowNetwork