The Ashimmy Blog

Good News From Alert Logic

Image via CrunchBase

My friends at Alert Logic posted two press releases today containing good news for the company.  In the first release they announced that they had raised a Series E round of funding totaling 12.6 million dollars.

Besides existing investors, Updata Partners, Covera Ventures, DFJ Mercury, and Access Venture Partners, several members of the company’s management team invested as well.  It is always a good sign to see the management team putting skin in the game. The money will be used to expand all phases of the business.

In the second release, Alert Logic announced that they had broken through the 20 million dollar revenue run rate barrier. In the past I have taken private companies to task for releasing “another great record quarter” press releases. The reason I have is because they usually don’t include the actual numbers. But in this release Alert Logic announced 2.3 million in new ARR for the quarter, bringing the companies ARR to 20 million.

It would seem that Alert Logic’s SaaS delivery model and strategy of selling through cloud and hosting providers is working and paying dividends. The company has doubled revenue since 2009 when they began to pursue the service provider channel.

Very impressive news from Houston. Congratulations to Gray Hall, Misha Govshteyn, Urvish Vashi (an old Interliant friend) and the rest of the team there.

XO To Offer StillSecure MSSP Suite

In what is probably the last BD/relationship deal that I started while at StillSecure, XO Communications and StillSecure announced today an agreement for XO to offer the StillSecure managed services suite to its customer base.

The folks at XO have built a great business that stretches back to the dotcom days.  I remember back in those days working with Concentric Networks, which became XO. Now all these years later I was happy to do another deal with them.

But let me be clear I only got this deal started. There was lots of hard work on both sides to get this done. Steve Harris and Larry Middle have worked diligently all of these months and even years to get the deal done on the StillSecure side. Way to stay with it guys.

In typical business development experience, now comes the hard part. Translating this partnership into success in the field. With XO’s presence in the Fed space and StillSecure’s Federal focus there should be some fertile ground to gather some wins. But XO serves a large customer base and their need for security could the driver for this.

I continue to believe that SaaS and managed services is the future of security, especially in the SMB and mid-market.  This deal, the recent Dell-Secureworks deal and the overall health of the SaaS and MSSP market bear it out.

I wish both companies much success with this deal and will be watching to see how it fares in the market.

Having your cake and managing it too

I had to wonder reading Larry Walsh’s post today in Secure Channel. He is reporting on a new managed SIEM offering by FishNet Security. I am not sure what flavor Kool Aid Gary Fish fed Larry, but whatever it was it sure must have tasted good.  Gary Fish has Larry reporting that Fishnet’s new SIEM managed service solves the three hurdles to SIEM – cost, complexity and flexibility.

I say bull! Lets look at what is really going on here and what Larry is reporting. First off, unlike many managed services offering SIEM, in the FishNet model the customer has to actually buy the SIEM application that they are going to use. I assume that means hardware as well as software licensing.  I am sure that FishNet loves this. If you were a SIEM reseller, you would too. In most other SIEM models the cost of the application is subsumed in the cost of the managed service. As a matter of fact that is one of the advantages of the MSSP, you don’t have to buy the applications.

Gary Fish spins this saying that this gives the customer the flexibility to go use another SIEM product without being locked in. Again I say bull.  Going to use another SIEM product means walking away from the cap ex investment in the application itself. As they say it would be easier to take the management back in house from FishNet if you really wanted to invest that kind resources, but you could do that with a traditional MSSP offering as well.

Also because each customers SIEM is an individually managed, non-centralized instance, I question the true scalability of the service.  SIEMs are hard to manage to begin with.  Managing multiple SIEMs individually would seem to be like herding cats.

Unless FishNet has a behind the scenes multiple SIEM manager similar to what they did with FireMon for firewalls.  Anyway, I wish Larry would be a little more questioning of what FishNet put out here.

Symantec stakes its piece of the cloud

Symantec today announced that it will offer both its endpoint protection security solutions and storage management solutions through Amazon's EC2 platform. Now Big Yellow customers can have a hybrid solution of Symantec endpoint protection both locally on premises and up in the cloud.  I think this type of solution that recognizes that any transition to the cloud will happen gradually over time is much more realistic in terms of "securing the cloud". It will be interesting to see the up take of this. Are people going to be serious about securing these web services or is security going to be "one of our top priorities" but they won't put their money where there mouths are.

Another question unanswered is does this mean Amazon is exclusive with Symantec? Is there no room for a McAfee or other competitor? If not it really is a coup for Symantec. In any event the inevitable march towards securing the cloud and the staking of claims continues.

Exactly how much do TippingPoint and Qualys know about our networks?

Some great info about how the threat landscape has shifted from OS based attack vectors to application based vectors in the new report from SANS, TippingPoint and Qualys. It was good to see Microsoft getting some credit finally for the work they have done around shoring up Windows and that the OS is no longer the primary focus of hackers.

Of course the report would not have been possible without the voluminous data provided by TippingPoint and Qualys. TippingPoint provided attack data from over 6,000 organizations they protect. Qualys provided vulnerability data from over 9 million customers computers.  Staggering numbers for sure.

Here is my question: How much does Qualys and TippingPoint really know about your network?  Does Qualys know which computers on your network have which vulnerabilities? How did they find out? I thought your vulnerability data, stored on their systems is encrypted and not even there own employees have access to it. Can you imagine if that data got into the wrong hands? Someone who had a list of which devices had which vulnerabilities on your network would certainly make it a bit easier to wreak havoc on your system, no?  I would hope that the data was collected with the permission and knowledge of their customers. But the fact that they know the vulnerability status of 9 million computers is a bit disconcerting. It is just too tempting. 

The lesson is make sure that not even your security vendor has this type of information which could give someone the keys to kingdom unless you are comfortable with that.

Related articles by Zemanta

• SANS Report Says Organizations Focusing On the Wrong Security Threats (tech.slashdot.org)
• Organizations fail to address top cyber vulnerabilities, report says (seattlepi.com)
• Companies patch OS holes, but biggest priority should be apps (infoworld.com)
• Blog - Firms Patch Some Companies' Bugs Quicker than Others (technologyreview.com)

Shimel’s Inciteful Thursday

So despite his promises to the contrary, my bud Mike Rothman has been a blogging MIA pretty much since RSA. Hey I am sure he has a good reason, like some journey for self-awareness or something that is keeping him away.  Not even a Social Security Blogger award could get his juices flowing again.  So in Mike’s absence I am going to do another in my incite series with a bunch of short stories and even shorter commentaries.

Truth be told, I had too many things to write about today, so I blamed it on Rothman!

Have a great day.

1. InfoExpress does a press release on managed NAC – Last night I banged on InfoExpress for claiming a managed NAC service as reported by Tim Greene. It just didn’t sound like a managed service to me.  Well not sure if Tim jumped the gun or not, but today IE put out a press release on their service (though they still have nothing about it on the web site). To be fair the press release talks about more management of NAC than Tim’s article did.  But here is a bit of advice for the InfoExpress PR team: If you are going to have customer quotes in a press release, it may be worthwhile giving their name and title.  Just having quotes attributed to anonymous customers is a bit unbelievable. Something I would expect from NAC used car salesmen.

2. Mystery Virus plagues FBI and US Marshalls – It seems that a mystery computer virus (no not swine related) has hit both the non-classified FBI network and the US Marshalls network.  The FBI had to take down their network from the Internet, but it has now been reconnected. The US Marshalls service reportedly had 140 machines hit with the virus. They had to be taken down and are being disinfected as you read this.  I don’t have any more information on this, but there are rumors of a one-armed man being seen in the vicinity.  Where is Tommy Lee Jones when you need him?

3. Microsoft puts the heat on security vendors – Looks like my friend Charlotte Dunlap has herself a regular gig over at Forbes writing an infosecurity column sponsored by Juniper.  This time Charlotte writes about Microsoft rolling out a hosted email security solution as part of Stirling-Forefront. Charlotte is right on when she says that Microsoft clearly has Symantec and McAfee in their sights with Forefront.  I have written about this before as well. Go ahead and make fun all you want, Microsoft is serious about this and will keep at it till they get it right.  Of course I love the fact that they are partnering with forward looking security vendors (like StillSecure) and think there is a real opportunity to shake up the security world here.

4. How much work can you do on an iPhone?  Earlier this week I wrote about an iPhone being a Prius to Blackberry being Pinto (hey not my words, but some other author). In continuation of that story, Galen Gruman writes about using an iPhone instead of a laptop for a few weeks. I don’t know but I find it near impossible to write more than a sentence or two with my iPhone. Maybe my fingers are too fat or I just don’t have good hand to eye coordination, but I find it painful compared to my old HTC Windows Mobile phone to type longer then that.

Anyway, that is a wrap on this incite.  Good day to you Mike Rothman, no matter where you are!

Spring is in the air

I know you may not be feeling this way depending on where you live, but Spring is in the air.  How do I know? Easy, my anniversary has just passed.  For the 19 years I have been married, I know that once my anniversary is over it will soon be Spring.  Sort of my own bird like instinct maybe.  When we were first married we used to go to Maui every year for our anniversary.  It is always Spring in Maui, but by the time we would come home in early March, Spring was certainly on the way. Of course with the kids we don’t get to Maui much, but I watched a pre-season baseball game today, what more proof do you need then that?

So what does Spring have to do with anything?  Spring represents a rebirth. I think we need a rebirth.  We need to stop dwelling on the negative and start making our own luck and our own positives! To quote a greater thinker than I, “we have nothing to fear but fear itself”.  So take my word for it, Spring is on the way.  Start thinking about how you are going to break out of the winter/economy doldrums and attack your job, your life and your problems head on. 

Good luck with that!

1. Mike Rothman gave me a nice shout out yesterday in his blog about copying his format.  Besides thanking Mike, I want to say that I am thinking of this as just doing a few short blog/comments in one post.  I will of course add my own Shimmy schtick to it, but I like it. I will still do full posts when I see something I want to talk about. I am interested though if you readers like this type of blogging. Let me know.
2. The law of conservation of energy – Adrian Lane over on Securosis has a nice commentary up on the recent Symantec/Ponemon FUD that employees leaving their employment are taking IP and confidential data with them and that this number has gone up drastically.  As Adrian points out, no crap Sherlock! With all of the people being laid off, there are certainly more people leaving work.  The real issue though is how many of these people actually dong anything with this information. It reminded me studying science with my oldest son Landon.  The law of conservation of energy says that the amount of energy doesn’t change, just the form does. So really this is a potential threat, like potential energy. It remains to be seen if it will translate into anything more than that. Adrian says no, I say it desperate people do desperate things.
3. Dead men walking – While reading this story about Nortel laying off another 3200 people today I was reminded of a potential customer call I was on a while back for NAC. They were also looking at Nortel’s NAC solution and the CIO was telling me how good he felt dealing with a company Nortel’s size and the stability it offered over StillSecure. My how the mighty have fallen!
4. Its not a product, its a feature – Hoff loves to spout that one. I was reminded of the same thing today reading the article in Computer World by Mark Everett Hall that SaaS is not a market, just another channel. I actually agree with that statement and is one of the driving forces behind StillSecure’s recent ProtectPoint acquisition.  While many folks including Rothman question an organizations ability to sell service and product, I view the service offering as just another distribution channel.  Customers can buy our products as a hardware appliance, software or as a service. I think long term that view of SaaS is going to proven correct.
5. Firewall tools – I recorded a great podcast earlier this week with Secure Passage CTO Jody Brazil.  Jody is the former CTO of Fishnet and Secure Passage was originally spun out from Fishnet with the Firemon product. It is totally independent of FishNet now and is coming out of stealth mode.  My recording equipment messed up and am waiting on Mitchell to send me his file to edit. In the meantime Brian Prince of eWeek has a good interview with Jody. My view on this one is that PCI is totally driving this market.  The issue is will it be a victim of its own success. If it becomes big enough the firewall vendors will do a better job of packaging management tools with the firewalls and the 3rd party tools will find it hard to compete.  But who knows, maybe they get bought out by then.

Related articles by Zemanta

• Nortel to Cut 3,200 More Workers (gigaom.com)
• 7 Questions to Evaluate SaaS (gigaom.com)

SaaS, Cloud Computing – is it for everyone?

Came across a bunch of articles yesterday with a common theme of SaaS and cloud computing.  First was Mark Evertt Hall’s column in ComputerWorld calling for the government to adopt SaaS as a way cut inefficiency and waste. The column attracted a visceral response from some people who commented, their comments in line with how many in the government feel. The thought of depending on someone else keeping their applications and data available and secure is anathema to them. You would think that they do such a great job of keeping stuff up, running and secure that no one else could match it.  But that is not true. In fact I think many SaaS platforms are probably more scalable and robust than the average government agencies infrastructure.  Now, don’t get me wrong, there are some government activities which are just too sensitive and critical to outsource to SaaS.  But for the most part, I agree with Hall that the government can save money and effort by adopting some SaaS type of programs.

The second article was in C/net by James Urquhart about a recent study by Rackspace that showed up to 75% of small and medium business were unaware of cloud hosting and how it can help them.  Like James I wonder if the term cloud hosting is as well known as cloud computing.  But the bigger point by Urquhart was that the mid and SMB market’s are ripe for the advantages of cloud computing.  Again I agree with the author.  I think large companies have the resources to put up and maintain their own infrastructure.  Mid market companies can greatly benefit from the efficiencies of volume that cloud computing can bring them.

The last piece of news I read was that McAfee has actually combined all of the net delivered products into a SaaS unit. That would seem to go against having a lot of the old Foundstone stuff in their GRC unit.  Does this also then spell the end of the GRC unit? Is this just a case of McAfee hopping from one fad to the next?  It wouldn’t be the first time they have done that.

The Jericho Forum moves beyond de-perimeterization to the cloud

Saw this recent release on two new board members joining the board of the Jericho Forum and it sparked a synapse in my brain about a good panel discussion I caught during the SC World Congress in December by several Jericho Forum members.  You can watch two of the presentations delivered that day here.  Getting away from all of the rhetoric around de-perimertization and talking about securing the cloud and other topical security subjects made the Jericho folks much more relevant to me.

One of the new board members is Phillipe Courtot, CEO of Qualys.  Of course Qualys's SaaS vulnerability management solution is more of a cloud solution and not about perimeters.  For me anyway, I think this is welcome change in focus by the Jericho Forum.

Why MSSPs are going to rule the SMB/SME roost

I don't think there are too many people who disagree agree that the MSSP model of providing security is a valid and growing segment of the security business.  Recently, I have been giving a lot of thought as to whether this is just a pendulum type of swing that will soon swing the other way or if it is more fundamental. I am coming to the conclusion that it is more fundamental.  To be clear I am not talking about SaaS.  I think there is a big difference between what a company like Qualys does in SaaS and what a true MSSP does.  When I say MSSP, I mean actively managing the security, not just providing software over the web.

Here is a great illustration of why I think the MSSP model is fundamentally here to stay and right for a certain segments of the market. Last night we went over a friends house for a social gathering. I was speaking to one of the guys there who I see maybe once or twice a year.  He again asked me what it is I do for a living (how many security people get that question often).  That brought up the whole topic of computer security. 

This gentleman runs a business that signs up people for satellite TV services among other things and than is certified installer for these services.  Some of us I am sure have received spam from some of the less scrupulous in that field.  This guy has been at it for many years and has a very successful business. He told me because he "takes credit cards and all that" he was told he needed to have security.  "You know firewall and intrusion prevention and all that", was what he told me. He looked into using open source security tools that were "free".  His tech people couldn't make that work.  He looked at commercial products too.  Besides the cost of buying the product, the time and expertise needed to make them run was beyond his IT people and not really what he wanted them working on.  Through the data center where he hosted his web servers he was turned onto an MSSP.  For between 500 and 1000 dollars a month "they protect him 24/7 and he doesn't have to worry about it".  For this businessman, it was a no brainer.  You know what, given this set of facts, it is a no-brainer. Unless or until something fundamental changes in that equation, the MSSP model is here to stay.

Related articles by Zemanta

• SaaSy Security Suits SMB
• Symantec hedges bets with large stake in hosted security