August 1, 2007 - Volume 2, #113
Good Morning:
Top 'o' the morning to you. I'm happy today. The drugs must be working.
Or it could be the Black Hat
fever that seems to be going around in Vegas. This show is like none
other. Most technology shows have little to no excitement. I guess
Comdex still has lots of booth babes, maybe Interop too. I haven't been
to a Web 2.0 show, so maybe there is excitement there. But Black Hat is
something else. The tattoos, the piercings (in public display, of
course) and the different shades of hair colors are all pretty unique.
Unless you go to a Motley Crue concert, I guess.
I got into Vegas yesterday after a little flight delay. Then the
partying started almost immediately (SHHHH! Don't tell the Boss) and
didn't end until late. But everyone is happy and congenial and excited
to get their little mitts on some cool security research, even if
there is some researcher drama [1]. I'm certainly
not in the middle of it, so I'm able to maintain my drama-free zone. I
think we all should strive for no drama, although I guess if you have
people you have drama. That's why I work alone. I got tired of spending
more time dealing with drama than actually working.
The good news is that there is going to be some cool research and
findings discussed over the next two days. I'm not sure how relevant
the information will be in the short term, but it will provide lots of
food for thought relative to what can happen and what we need to keep
our eyes on. It's also great to see so many old friends and meet new
folks.
For me, that's why I go to some of these shows. It's about learning,
but it's also about connecting.
I'm running late, so I'm off to see the Wizard.
Have a great day.
Technorati: Information
Security [2], CSO [3]
 [4] |
The
Pragmatic CSO: Available Now! Read the Intro and Get "5 Tips to be a Better CSO" www.pragmaticcso.com [5] |
Top Security News
Bill Brenner of SearchSecurity does a nice
little wrap-up [6] of the folks that decided to jump the shark, I
mean gun, relative to what their sessions will be about. The king of
security research marketing, Matasano Thomas, and his team will be
showing their virtualization research - which will be cool. To be
clear, Thomas does security research, but he's also a pretty fine
marketer, since everyone seems to talk about him all the time. Though
I'm sure he'll smack me upside the head for saying that. There will
also be a bunch of stuff around application security or lack thereof.
This makes sense because that's where all the action is. In terms of
the sessions I'm going to, most are application security related. Guess
it's just a sign of the times.
Link to this [6]
Core's research on breaking a database [7]
is a good case in point. It's critical to see how timing attacks can
theoretically work, but does this mean you should do something about
it? Nope. And thankfully Ivan Arce comes clean about that. What we
can't have is a bunch of bedlam running rampant because of a
theoretical attack. To make the point once again, research is good. We
need it to figure out where things are going and what new attacks will
be materializing sooner rather than later. But that doesn't mean right
now. Rob Newby does a good job of not being too
curmudgeonly about not being at Black Hat and making the same point [8].
Link to this [8]
60 day program to help companies get PCI
compliant [9]. I hate this kind of marketing. Really really hate
it. First, it's disingenuous. Not knowing anything about your
environment, maybe you can get to PCI in 60 days, maybe you can't. I
guess you could install Ingrian's product in 60-days, but to make a
claim about PCI compliance? Let's go over this again, you CAN'T buy
compliance. There are too many moving parts. The whole thing seems
fishy to me. So I advise everyone to ignore this. As opposed to taking
the next 60 days to install a product that can maybe help you, use the
two months to actually get your security program in gear. And I just
couldn't wait for my "security marketing gone wild" series to talk
about this. It's that annoying to me.
Link to this [9]
The Laundry List
- You go where the money is, even if it makes no sense. Tim Wilson rails on the idea of a CFO driven security program, but I'm rather focus on getting it done - not who gets the credit. - Dark Reading blog [10]
- These guys found the CFO. Perimeter raises another $50 million. MSS consolidation will continue. - Perimeter release [11]
- Clearswift breaks new ground? Maybe for them, but having a common web and email management console isn't exactly new. - Clearswift release [12]
- Q1 gets some Incite. Yes, I was the first victim of their Englishman, Irishman, and analyst podcasts. Good stuff here, if I do say so myself. - Q1 release [13]
Top Blog Postings
http://ravichar.blogharbor.com/blog/_archives/2007/7/27/3123217.html [14]
Link
to this [14]
http://blogs.zdnet.com/Ou/?p=636 [15]
Link
to this [15]