The Ashimmy Blog

Proofpoint–More Than Just FISMA, It’s All About Email

There has certainly been a big to do over FISMA certification and cloud hosting. Google and Microsoft have traded barbs, insults and law suits over who really has the goods when it comes to being FISMA certified.

Proofpoint, a partner of Microsoft's in the cloud based email business has now been FISMA certified along with Microsoft regarding an USDA deployment.

But Proofpoint is more than FISMA, they are a player in the email security and archiving business. I had a chance to sit down with Andrés Kohn and discuss what Proofpoint is all about.

Listen in as Andrés tells us about Proofpoint

Enjoy!

 

Related articles

• The Google-Microsoft Fight About FISMA Certification (groklaw.net)
• Microsoft and Google: Who's the most FISMA-compliant of them all? (zdnet.com)

Google Does Evil

Google seems to have violated its own prime directive with the premature disclosure and publishing of attack code by one of its researchers. According to this story in ComputerWorld, a Swiss Google researcher Tavis Ormandy gave Microsoft just 5 days before publishing the zero day vulnerability with attack code. This is just outrageous.

You can tell me that Ormandy did this without Google’s knowledge and consent. If that is so, they should fire him tomorrow. If it is not true, shame, shame, shame on Google.  Allowing their Microsoft-phobic psyche  make them violate their own prime directive to “do no evil”.

When two security researchers that I have a tremendous amount of respect for, Andrew Storms and Robert “R-Snake” Hansen are quoted saying things like:

"This stinks of retribution," said Hansen. "If Google really goes by responsible disclosure, they should fire Ormandy today." Hansen noted that Ormandy credited other Google security researchers for their help and linked to a Google blog on browser security in his message on Full Disclosure. "You shouldn't do that if you want to disassociate yourself from your employer."

That's impossible, argued Andrew Storms, director of security operations at nCircle Security. "[As a security researcher] you can't really separate your work from your employer. So you have to wonder if [Ormandy[] isn't intentionally feeding the feud between Google and Microsoft."

Like Hansen, Storms questioned Ormandy's decision to reveal his findings just five days after he reported the vulnerability to Microsoft. "You can't say in this case that the vendor was sitting on their hands, not being responsive, which is why researchers usually go public, to force [a vendor's] hand.

"This is no better than not reporting it to Microsoft," concluded Storms.

You know that what was done here was very bad and evil. Another example is that Google gives lip service to responsible disclosure while their employee had this to say about it:

He also slammed the concept of "responsible disclosure," a term that Microsoft and other vendors apply to bug reports that are submitted privately, giving developers time to craft a patch before the information is publicly released.

"This is another example of the problems with bug secrecy (or in PR speak, 'responsible disclosure')," Ormandy said. "Those of us who work hard to keep networks safe are forced to work in isolation without the open collaboration with our peers."

I am telling you, if Google does not fire this dude then their words about “doing no evil” don’t amount to a hill of beans. If I remember correctly violating the prime directive carries a death penalty even in Star Trek.

Adobe the new Microsoft?

The simple black dress never goes out of style. Or so my wife tells me every time she buys another one. Same is true for scapegoats in security.  This years whipping boy is Adobe. ScanSafe just came out their yearly report (it seems it is yearly report season. But that is better than yearly “I had another record year but won’t tell you the real numbers” press release season), at it seems a whopping 80% of web exploits involved the vulnerable, if not venerable PDF file courtesy of Adobe.

Whoa! That is impressive. I am sure many of us are just shaking our heads wondering what could Adobe be doing to improve this.

Microsoft can empathize I am sure. It used to be Windows and Office that was posting those kinds of numbers (OK not web exploits but attack vectors). Now it seems exploiting the Microsoft products has either gotten so much harder or is just not profitable enough compared to Adobe.

In any event I am looking for Adobe’s “Trustworthy Computing” initiative to kick off any day now. Until then I don’t think using PDFs is such a great idea.

Windows 7 rocks!

When Windows Vista came out a few years back, I played with it a bit. I quickly decided I couldn’t deal with the nagging. I ditched it and stuck with XP all this time. If it ain’t broke, don’t fix it.

As part of getting ready to launch the new company (will blog that next, but big stuff next week), I have joined the Microsoft BizSpark program.  For those of you who don’t know about BizSpark, it is a great program for start up companies.  Once accepted you have access to lots of great Microsoft (that’s right great Microsoft) software.

So this past week I was up late almost every night working away. I downloaded a copy of Windows 7, backed up my laptop’s hard drive onto a USB drive and had at it.

I didn’t think I would have many problems upgrading my IBM Lenovo ThinkPad. Though it was an XP machine, it has lots of RAM and is not that old.  Things went smooth as silk! I had Windows 7 up and running in no time with no mess and no fuss.

I was really impressed by how snappy it was on the latptop too.  I upgraded the latest version of Office and was equally happy to see that some of the bloat had gone down.  Windows 7 seems to be one that Microsoft got right. It just recognized everything and just worked.

After a few days of satisfied computing, I decided to put it to the test. My wife Bonnie’s machine is an ancient desktop. It is like a 1.8 Ghz, single processor Pentium with 3 or 4 Gigs of RAM. Two hard drives, a CD drive and a DVD drive.

I put the DVD in and crossed my fingers. The partitions were in the wrong format and so the entire disks had to be reformatted. So no windows.old files for me to use to put stuff back.

But no problem, Win 7 went right on and booted right up.  On first boot up, my sound card was not recognized, my USB wireless adapter did not work and the video card and display had generic VGA drivers.  I went into device manager. Clicked each faulty device with the yellow exclamation and installed drivers. Once I got the USB wireless adapter up by using the old XP driver, Windows 7 found updated drivers automatically over the net.

In about 20 minutes everything worked. Once I get the nVidia GeForce 2 video card working with the XP  driver I had great aero capability at high resolution and color depth.  The computer actually runs better now then it did with XP. Probably because 5 years of crap had been wiped off the machine.

Anyway, one day in and Bonnie’s machine is rocking. The kids used it for some online homework. Bonnie did her mail and I played the chess game for good measure. Windows 7 continues to impress me.

We are always quick to bash Microsoft, but it looks like the did something right with Windows 7.

 

Related articles by Zemanta

• 6 Essential Tips to Speed up Windows 7 (maketecheasier.com)

In search of Unicorns

Here at Interop the show floor was pretty dead yesterday.  I had a chance to sit in the audience on a panel on NAC hosted by Mike Fratto.  Mike had 5 panelists including a few friends of mine. It was pretty much the usual NAC panel.  Steve Hanna from Juniper/TNC touting the standards that his group offers, Cisco saying they will support standards, HP ProCurve always loves standards, Microsoft actually being very pragmatic and then there was JJ.  My friend Jennifer Jabbusch was her usual self talking as she sees it and giving quote fodder to the journalists like Michael Sean Kerner who wrote about the panel in this article.

Of course the media loves to jump on any angle as to why NAC has not brought world peace and helped cure cancer.  So Kerner’s article screams that authentication is where we screwed up.  He says the audience demanded to know when NAC is going to deliver on the promise. How can we have a standard without Cisco. Well I was in the audience too and had all I could to bite my tongue and not say anything.  But hey that is why I have a blog. So let me respond here:

1. Authentication is where we screwed up.  Who said NAC was about authentication?  Listening yesterday you would think that 802.1x authentication was a direct result of NAC needing a secure authentication process.  Guys lets not put the cart in front of the horse.  802.1x offers a lot of other features and advantages besides NAC authentication. In fact it is the other way around.  NAC vendors adopted 802.1x because it offered some distinct advantages.  It was widespread in wireless networks.  However, JJ is right.  It is complex. There are a lot of moving parts. If you have not done everything right to implement 802.1x on your network, don’t bother trying  to use it for NAC.  But if you had, it does work like a charm. As I have said  before it is not for the faint of heart.

But back to my original comment.  Originally NAC/NAP was not the authentication.  NAC rode on top of your existing authentication. We as an industry have issues around easy to use, robust authentication methods.  So this became NAC’s problem?  A good NAC solution should be able to use the authentication system you are using.  Authentication sucks?  Look to the folks developing authentication.  Hint: it is the same network vendors sitting on the panel.  But lets not saddle NAC with albatross.

2. Searching for the mythical NAC Unicorn. Fact is there was one member in the audience who was quite vocal (no not me) and kept insisting that NAC would not be real until everyone adopted one standard, that no matter what network we log into, no matter what different software I had, NAC would solve it all because “a big database” would contain all of this information. Yeah, all right.  I wanted to ask the guy if he still leave out cookies and milk for Santa Claus.  From what I understand this particular individual makes a habit of doing this at NAC panels.

The guy from Microsoft said it best. It is OK if NAC does not give you all of this, it is still valuable.  Stop trying to make it all things to everyone and take it for what it is. It is not the answer to authentication, it is near impossible to treat heterogeneous network environments like they were homogenous, but that is  not what it is about.  Stop looking for Unicorns and make use of what you have to work with!

Do you partner with Microsoft?

As I wrote about a few weeks ago StillSecure has partnered with Microsoft in supporting the Stirling beta release of Forefront. We have integrated both Strata Guard our IDS/IPS and VAM our vulnerability management solution with Stirling.  The official release of Forefront with this functionality is scheduled for Q4 or Q1 of next year. 

I have been trying to figure out what is the best way to work with Microsoft in supporting this release and obviously what is the best way for StillSecure to capitalize on this.  Brad Feld recommended a book called Partnering with Microsoft.

Partnering with Microsoft: How to Make Money in Trusted Partnership with the Global Software Powerhouse: Ted Dinsmore, Edward O'Connor: Books ISBN: 1578203171 ISBN-13: 9781578203178

Reading this book was invaluable. It really gets you to understand Microsoft’s structure and what to do to be successful.  If you are working with Microsoft, I highly recommend it!  Also, don’t be silly and buy it new, you can get it for a fraction of the cost used!

Microsoft brings security to the Forefront

All that glitters is not gold, sometimes its “Stirling”. Yesterday Microsoft officially took the wraps off of the next beta of their ambitious and audacious play to become a major player in information security.  StillSecure is very happy to be a strategic partner in Stirling, as one of just 10 3rd party companies that Microsoft choose to work with.  We are also one of the only ones who actually have the integration working and will be demonstrating this next week at the RSA show! Both our Strata Guard and VAM products integrate with Stirling.

Forefront is a complete line of security products including:

• Forefront Client Security
• Forefront Security for Exchange Server
• Forefront Security for SharePoint
• Forefront Threat Management Gateway (renamed from Internet Security & Acceleration Server)
• A complete management server and dashboard

Make no mistake about it. Microsoft plainly has Symantec and McAfee in their crosshairs with this product. They want to be a major player in security from the endpoint to the edge and even to the core of the network.  They are building on 2 aces in their hand. One is the ubiquitous presence of Active Directory which gives them an advantage around identity based control. Secondly, they obviously control the overwhelming majority of the desktops out there. But this is not Microsoft of 1995. The recognize that when they reach out into the network Windows is not everywhere. They are working with Linux systems, network gear and other non-Microsoft systems.

There may be some who think Microsoft and security is an oxymoron. To them I say be prepared to be fossilized. Microsoft is serious about security and this Stirling will go a long way towards bringing their security expertise to the “forefront”.

This weeks winner of the Captain Renault award

From the classic Casablanca:

Rick: How can you close me up? On what grounds?
Captain Renault: I'm shocked, shocked to find that gambling is going on in here!
[a croupier hands Renault a pile of money]
Croupier: Your winnings, sir.
Captain Renault: [sotto voce] Oh, thank you very much.
[aloud]
Captain Renault: Everybody out at once!

Last week I wrote about the "shocked to find gambling going on in here" revelation by Symantec, that the underground market for stolen data was in the hundreds of millions of dollars. This weeks winner of the "Captain Renault shocked to find there is gambling going on here" award goes to Secunia. They announced that their findings show 98% of Windows computers have at least one known vulnerability and nearly half have 11 or more programs at risk.

Bill Brenner has a good article on this as just Secunia spreading FUD and not many CIO's or security administrators are surprised by these findings. Bill points to a Verizon study that says 90% of all incidents involve a vulnerability that has a patch available for 6 months or more.  I think this is really important.

For all of the emphasis, time and money wasted on zero day attacks, the fact is 9 out 10 attacks take place against well known vulnerabilities.  Has the patch management process broken down?  Did it ever really exist?  Vulnerability management just isn't sexy anymore, but there are good products available.  In the face of such numbers, how can the security industry as a whole not get serious about patching, vulnerability testing and taking these low hanging fruit off the table before we get all hot and bothered about zero day stuff.

Related articles by Zemanta

• I'm shocked, shocked to find out that gambling is going on here
• Every Windows PC is at Risk if not Lucky- Confirms Recent Research
• Virtually every Windows PC at risk, says Secunia
• Windows patching abysmal, and getting worse

If you want to run with the big dogs, you have to play by the rules

I was reading an article today about Chinese "indignation" over Microsoft's black screen anti-piracy response.  I will tell you that my jaw dropped to the ground reading some of the comments from some of the Chinese officials and citizens.  Here are a few:

National Copyright Administration (NCA) Vice-Director Yan Xiaohong said his agency supported "the rights-safeguarding move taken by institutions including Microsoft," Xinhua news agency quoted him as saying in a report late on Monday.

But companies should "pay attention to the methods," Yan said. "Whether the 'black-out' method should be adopted is open to question. Measures for safeguarding rights also need to be appropriate," Yan said.

What could be more appropriate than stopping people from using software that they either pirated or are using in violation of copyright?

Dong Zhengwei, a Beijing lawyer, said Microsoft was abusing its market power and had filed a complaint to China's trade watchdog, the State Administration for Industry and Commerce, the China Daily said in separate report.

"Microsoft should be fined $1 billion," the paper quoted the lawyer as saying.

Yan said Microsoft's price policies needed to "fit the Chinese situation."

"The company adopted unified prices in the past without considering the income gap between developed and developing countries, so we need to kindly remind them that Chinese customers' affordability should be considered."

Are you kidding me?  Is this the same country that just put on that Olympic spectacle, to show they have "arrived" on the world scene.  The same country that runs billions of dollars in trade surplus with most every country in the world? The same country sending people to the moon?  The same company taking jobs away from our own economy everyday because of their lower  prices?  Sure their prices are lower, they don't follow the same rules we do.  What about if most American companies decided they didn't need licensed software.  Why stop there.  Lets not honor patents either.  The heck with it, lets bypass our electric and water meters and don't pay that either. Do you think it might make us more competitive?

Hey, if you want to play with the big boys, you should be playing by the rules. Inequalities and unfair advantages like not complying with copyright laws should not be tolerated.  Either we all play by the same rules or don't play at all!

Rumors of acquisitions abound

It is not just who is going to put Lehman Brothers out of their misery in the M&A grist rumor mill.  In the tech world there are two interesting potentially big deals being rumored:

1. Why are wireless companies like bellybuttons?  Because it seems like everyone has one.  Continuing the recent trend Juniper wants to be latest one on the block to acquire their own wireless company.  According to reports, they are interested in buying Meru Networks (96 million raised) or publicly traded Aruba.  While Meru has nice technology, an Aruba buy would be a great fit for Juniper.  Aruba is Cisco's biggest competitor in the wireless space, so should fit well with Juniper's take on Cisco persona.

From various sources, it will be one or the other of these two wireless providers, but Juniper is certainly buying one.

2. What took them so long?  I have always thought for the longest time that Citrix was a good buy for Microsoft.  Now once again rumors are flying that Redmond will finally pull the trigger on this multi-billion dollar deal.  Cicso, IBM and HP are also rumored to be in the hunt this time though. I guess the virtualization stuff is driving a lot of that.

I have also heard rumors that Citrix will be moving its HQ from Ft Lauderdale to Silicon Valley.  The South Florida tech community would certainly be a big loser in that one.

In any event, the march of consolidation moves on.