Upon reading Bill Brenner from CSO's interview with Heartland Payment Systems CEO, Bob Carr, I kind of got a bit unglued. I wasn't the only one, as Rich Mogull provided a much more respectful and well reasoned response than I could to voice similar disdain for the idea of blaming a data breach on the QSA. And our buddies Michael Farnum and Martin McKeay were happy to summarize and add their own spin.

So Bill was kind enough to allow me to vent a bit on CSO. You can read it in all it's glory:  http://www.csoonline.com/article/499565/One_Man_s_View_Heartland_CEO_Must_Accept_Responsibility

Here are a few of the money quotes:

"I say that's a load of crap. It's about time organizations suffering from a data breach owned up to the fact that they made a mistake. You see, the fine folks at Johnson and Johnson didn't throw the pharmacy under the bus when Tylenol got poisoned in 1982, did they? NO! They accepted responsibility (even though it wasn't their fault) and re-established trust with their customers."

"That, my friends, is the responsibility of the internal security team. That's what they do, and that's what they get paid for. And in Heartland's case, that's what they clearly failed to execute."

"But you have to hand it to Mr. Carr. He is proving to be a master at misdirection."

Basically, I'm not in the excuses business and neither should you. Organizations need to man up and accept responsibility when something happens on their watch and it needs to start at the top, with the CEO. So Bob Carr, you should be wearing a FAIL WHALE hat right now, wherever you are.

Andrew Hay thought he'd be the last to post a wrap-up of RSA. How wrong you are my friend? There is no boundary to the lameness originating at Incite HQ nowadays. But enough of the self-inflicted beatdowns. Personally RSA was great this year. It's always great to see so many old friends, make some new ones and basically plug back into the security collective after spending lots of time in the wilderness over the past 6 months.

But that isn't really the right point to make. What were my general impressions of the big show this year? It gets back to the point that perception is reality. Always has been, always will be.

It's been entertaining to see what the pundits have been saying about this years RSA. Ahead of the show I made a statement about the show being indicative of the strength of the industry (link). Well I don't have much more clarity 3 weeks later, which is pretty indicative of the state of the industry. A few guys like Oltsik were largely pretty negative. Ogren and Stiennon were positive. And Pescatore (Post 1, Post 2) was right in the middle.

Me? I'm not as dour as Oltsik, but less optimistic than Pescatore. And Stiennon enjoyed too much of that vendor happy juice. Way too much. He's as excited as a 15 year old girl at a Jonas Brothers concert, which is horrifying.

Here were a few things of note that I noticed:

• Since when is authentication cool? There were a lot of new vendors showing multi-factor authentication. I kind of figured I stepped into a time machine.
• Less attendance is not a good thing. I saw a bunch of folks rationalizing the crappy attendance by saying there were fewer t-shirt hunters and more "buyers". Meh. We had our share of decent conversations, and our booth was packed for most of the show. But it's not like in past years, no amount of happy juice can get you there.
• Compliance is just there. In past years, we saw everyone talking up their compliance capabilities. I didn't get the impression that was a key theme this year. It probably has to do with the fact that EVERYONE says it, so it's as good as no one saying it.
• The death of TLA. That's right the three-letter acronym seems to be dead. Very little about DLP and NAC. Not too much on GRC also (since no one knows what the hell it means, it's a good thing). PKI? No where to be found. Thankfully SIEM is a four letter acronym, eh?
• New UTM vendors. WHAT? I saw a few new companies hawking UTM like devices. Wow. Good luck with that.
• Everything as a service. Yes, much of the conversation was around SaaS and the nebulous cloud. I have a lot to say about that, but it'll wait until later this week.

But most of all, I heard data points on both sides of the industry health discussion. If you wanted to hear happy thoughts, someone would tell you a happy thought. If you wanted to hear about the end of civilization, more than a few Chicken Little's were in the house.

The thing that I was most aware of was the underlying fear. Most of the folks I talked to thought things were getting better. But they weren't really sure. It was kind of like they were trying to convince themselves things were getting better. And if they clicked their heels together 3 times, they'd be taken back home. I've long said that optimism is good, but that doesn't mean it's justified or real.

Folks on the user side weren't sure if their projects were going to be funded, or if they'd even have a job when they got back. Not all of them, but a lot of them still were operating under a cloud of uncertainty. The vendors put on their happy faces and talked about how the 2nd half of the year looked strong. Of course, looking strong and being strong are totally different things, now aren't they?

Personally, I think the strong will be stronger and the one's that suck will suck more. Darwin is at work here. Some companies are announcing strong results and clearly taking share (see McAfee). Others, not so much (see SonicWall). The business environment is clearly accelerating the strengthening and weakening of many companies.

Even if we've hit the bottom from a macro standpoint (which a lot of folks are saying now), it makes me think we've still got some bumpiness ahead. For whatever that's worth.

I'm honored, flattered and totally undeserving of winning the "Most Entertaining" blog award at the Social Security Awards at RSA this year. Given I was late to the event (and Rich had to spoil the surprise by sending me a 911 text to get my behind to the Blogger meet-up), and Alan got a bit long in the tooth in giving out the awards, and my total shock at winning much of anything - I was a little at a loss for words. Which is the first time I can remember that happened.

And even if I was my usual loudmouth self, the looks from the folks at the party made it clear I was the only thing standing between them and another cocktail. That's a bad place to be, so I kept my comments intentionally short.

I didn't get a chance to say thanks to a lot of folks that made this possible. However undeserving I am, the people around me enable this. So let me send thanks to:

1. The Boss - Yes, without the Boss to keep me honest and focused, none of this happens. She takes care of many things, so I can do what I do. And she supports me and loves me, even when I make that hard to do. I also know that she'll kick my ass if I don't thank her first. Every time someone gets up at an awards show and forgets to thank their spouse, she goes on a tirade. I won't make that mistake.
2. The munchkins - Though I don't view what I do as very entertaining, my kids sure are. So thanks to Leah, Lindsay and Sam - who give me an infinite amount of material to write about. They also teach me something new every day. It's great to see things from their perspective, which keeps me young (even though I look old).
3. My blogging peeps - Yes, the blogging community is integral to the success of all of us. There are too many to thank individually, so I'll just say thanks to everyone. We challenge each other, give each other a hard time, and make the end product much better. Incite is written by me, but it's clearly a joint production.
4. The bad guys - Everything is relative. Without dark, there is no light. Without bad guys, we don't understand what is good. So we can't do what we do unless they are doing what they do - as objectionable as that is. So we can get mad at "the bad" or we can be thankful that they keep us employed, keep raising the bar and ultimately give us a lot to talk about.
5. You - I've always said that I write for myself and I'm just lucky that other people find (entertainment) value in it. That was true at one time, but not anymore. Many people that came to my panels or the booth specifically to tell me they enjoy the Incite. Many also said they wish I had time to write more. Wow. It's a humbling experience and I coudn't thank those folks enough.

After getting out of the first two keynote speeches here at RSA, I have a few quick observations. First, I'm glad no one is alllowed to smoke in the keynote hall. RSA's Art Coviello and Symantec's Enrique Salem were so wooden reading off the teleprompters during their keynotes, even the slightest spark would have set them and the entire building ablaze. And neither of them announced anything of substance. Nothing really on new products, just some horse crap about the need to operationalize things and build an eco-system.

It seems the theme of Big Security at this year's RSA show is Kumbaya.

That's the message from Art and Enrique today. To combat the threat of the bad guys and "win," the industry needs to collaborate and organize. Personally I think this is a veiled response to the success of McAfee's SIA program. Neither announced a formal partnering program, but it's just a matter of time. If you can't beat them, copy them. That's the way of Big Security.

Here's the thing about "collaboration." End users don't care about whether the vendors work together. They just want their problem to be solved. They are frustrated that they aren't any more secure today (and probably less secure) than they were 6 years ago. And with the economic collapse, customers don't have the ability anymore to throw money at the problem and deploy technologies that have limited success and go thru the motions to put another widget in place. That game is over.

So all this stuff about collaboration is noise. It's to distract everyone that Big Security isn't getting it done. They aren't solving the problem. Basically the answer is what I've been saying for a long time (yes, before I went out and got a day job). You aren't going to get ahead of the threat. You need to react faster and contain the damage when you get hit (and you will).

I'm not saying we need to give up. Or stop trying to do the right thing. I'm saying we need to be realistic. Implementing a policy management environment to encompass the entire technology stack, as Art suggests, isn't realistic. Sorry to burst Art's bubble, but customer's don't have enough breadth or visibility to even dream about protecting the entire ball of wax.

It's good keynote fodder, but for the most part it's just more hot air.

PS: I posted a piece on the eIQ blog this AM about whether we should even both to try to "win" the battle against the bad guys: http://blog.eiqnetworks.com/2009/04/21/can-we-win/ 

For the first time in a long time, I'm not sure what to expect from this year's RSA conference. The early anecdotes indicated it may be a pretty weak showing this year. Then lately I'm hearing north of 15,000 people will attend. Perhaps they are including everyone in a 5 block radius of the Moscone Center in SFO, but that's neither here nor there.

To me, the health of the security industry will be gauged this week. Of course, everyone puts on their happy faces and basically lies their respective asses off. "Sure, business is great." "Scaling is our big problem." Blah blah blah. In this kind of economy, every company has issues. The question is how big the issues are.

So why did I think the conference was going to be weak? Basically because every other event I've been to since the economic meltdown has been mediocre at best, a total cluster-F at worst. End users have largely been keeping their heads down, not taking time to mingle at conferences. Basically, we've been trying to survive. RSA is the biggest dog in the security conference field, but still will folks get on a plane to see the sights?

Then I got the speaker notifications. I'm doing four panels and a peer to peer session. Now, I've certainly got an inflated opinion of my speaking abilities. And I've done sessions at the last 5 or so conferences that have gotten decent reviews. But to get 4 panels? Definitely means the gene pool of presenters is a bit thin this year.

On the other hand, lots of companies have been announcing decent earnings. Some have thrown in the towel (like Entrust), but quite a few are holding their own. It'll be interesting to see the tone at the AGC (America's Growth Capital) conference on Monday to get a feel for the market. 

I'll be at the conference all week, though as you can imagine, my schedule is pretty jammed packed with day job responsibilities, speaking gigs, and the like. If you can attend the sessions, my speaking gigs are:

• Tuesday @ 1:30 PM: STAR-105: Is SaaS the Future of Enterprise Security? 
• Tuesday @ 4:10 PM: BUS-107: Security Groundhog Day (this was the best panel last year - don't miss it)
• Wednesday @ 9:10 AM: NET-202: Using SaaS to Solve the Network Management and Security Challenge
• Wednesday @ 10:40 AM: P2P-203A: More Security with Less Monday and Fewer Resource (peer to peer session)
• Thursday @ 9:10 AM: BUS-302: Which Security Tools take Priority in a Challenging Economic Environment

So as you can see, I've got a full speaking plate. And my sessions indicate what are clearly the two major themes of this year's show. SaaS and navigating the turbulent economy. Both are kind of related, but as in year's past when you heard about NAC or GRC or DLP, you'll hear about the conference theme until your ears bleed. This year, SaaS will be the most hated term by Thursday.

Hope to see you at the show, if you are here. Check out one of my sessions or swing by eIQ's booth (#2058) and pick up a log data is not enough t-shirt or hat. You'll also be able to see the 2nd half of the "Don't be like Dick" video.

I almost fell out of my chair when I saw this morning's Dilbert. It's probably about digital TV, but it could easily be about PCI as well. Maybe one of his neighbors sells for a WAF vendor...