The Ashimmy Blog

Life without Firewalls - Possible,Yes Practical, No

Image via Wikipedia

SC Magazine UK edition had an article the other day by Dan Raywood. He tells us of Kevin Dowd, CEO of CNS Networks and Security who has been running an experiment for years now running a network without perimeter firewalls. 

The premise is that we rely too much on our firewalls, they are not a magic bullet and you can have a secure network without them.  You can read the article for all of the tricks and tweaks done to try and secure the network.  They try to keep the network as simple as possible and actually seem to substitute a lot of host based firewalls in place perimeter firewalls.

As we used to say as little kids, “anything is possible”. But just because something is possible, doesn’t mean it is practical or even advisable. Why you would want to tie one hand behind your back and get into a street fight is beyond me.  Just doesn’t make a lot of sense.

My friend Jody Brazil, CEO of FIremon had some thoughts on this as well. He actually went through the exercise of pointing out some of the pitfalls and reasons you wouldn’t want to do this. You can read his thoughts at the link above.

But really, I would think we have all learned that there are no magic bullets in security. Why one would want to take a tool like a firewall out of the hands of security and network admins just doesn’t make a lot of sense to me.

Illena Armstrong responds

Last year (OK it was just a week or so ago) I wrote a post about SC Magazine Labs and their recent coverage of an OEM’ed NAC product which they were heaping accolades on as if it was the greatest thing since sliced bread. Well OK, just one of the top 20 products of the last 20 years!

As I said in that article, I have a lot of respect for the SC Magazine and the folks that run it. Illena Armstrong and staff do a great job of turning out a great product month in and month out, year after year. They have tried to be a force of good in the security market. That is why it was particularly out of character for the Veri-NAC stuff. 

I also know that Illena and others at SC Mag read my blog. I figured it was just a matter of time until someone responded. Illena responded today with a comment on the follow on article to the original post. I think it is important enough to give it center field play. Here is her response in its entirety:

For the benefit of this blog's readers, I wanted to take a moment to provide some quick facts about SC Magazine's product reviews.
Our testing methodology is published each month in the Product Reviews section of our magazine. Additionally, on our website (www.scmagazineus.com) you can find even more documents about our Group Tests, such as our FAQs, How We Test, and a sample of our submission form that vendors must fill out in order to have their products considered for inclusion in any of our monthly tests. (Just check out the Product section's "About Reviews" link.)
As background on our regularly published reviews, typically following a two- to three-month lead time, we usually include at least two Group Tests in each edition that cover particular product categories of interest to our readers. Reviews, as described on our website and in the monthly magazine, are not bake-offs. Rather, ratings of products are achieved by testing individual solutions against our standard set of criteria. To expound further, we have a general set of criteria that we expect to be met in our reviews and, with each test, we send out submission forms that provide a little bit more explanation about the criteria for the particular class of products on test at that time. So, there are some specific criteria that are peculiar to both the category and product type, which change somewhat from product group to product group.
Now, we do not generally discuss those in great detail because that would allow a vendor to “prepare” a product to perform well in the review even if it is not as good a performer in a production environment. By noting general expectations, we offer a level playing field for all group review participants to ensure fairness. As well, a product under test should reflect what a buyer would experience.
As for the vendors included in each regular Group Test, we try to cover as many appropriate products as possible. With the start of each test, we review companies whose products we've already tested and research the space to add any other companies to the list whose products may fit the topic at hand. So, we contact all the vendors that might fit a particular category being tested and also consider those who approach us directly. Some vendors may choose not to participate because of product release dates. Others, after filling out submission forms, may not meet our criteria for that particular test. In short, there are various reasons why this vendor or that one may not make it into a particular Group Test. From our perspective, however, the more the merrier.
As for the annual Innovators issue, this is not a group review edition. We look at our potential innovators from a variety of angles. First, we look for innovative technology. This very often appears in small organizations, but not always. Second, we look for innovative marketing and business practices. A neat product is not worth much if it never gets into the marketplace. Peter's pretty clear about that in his product opener: “As in previous years, my formula for selection was a mix of technical and business innovation.” And, often these innovators have carved out a very specialized market space for themselves.
Overall, when you read the full Innovators issue – our third annual one – you should get the flavor of what we were looking for and what we are trying to accomplish in this yearly offering. We're calling out those players in the market who are demonstrating innovation in their overall company missions, their corporate and strategic planning, and the products they're offering. These vendors are chosen by us -- the editorial staff -- prior to even being notified of their selection. We then conduct interviews for this annual Innovators section to get the thoughts of the company’s visionaries, not to perform the review -- a fact that is explained in the introduction.
All our reviews are objective and well-researched. Indeed, our product reviews section, other special editorial sections and various features have won accolades from the Association of Business Publication Editors over the last couple years -- another fact we've touted both in the pages of our monthly edition and on our website.
I encourage all of you to hit the SC Magazine website for accurate information about how the content for our publication and its associated properties is gathered and published. And, if you have additional questions or comments about SC Magazine, its website, its other special publications, or its live and online events, you can contact me directly by emailing me at illena.armstrong@haymarketmedia.com or by calling me at (508)278-9768.
Thank you for your time.
Illena Armstrong
Editor-in-Chief
SC Magazine

I don’t doubt or dispute anything Illena says. However, I will stick by my original assertion. SC Magazine lab personnel were very well aware that this product is an OEM of another product. They thought it was a “big deal” for the company that developed the underlying product and were helping him out. By the authors own admission, he “stopped the presses'” to add this product as an honorable mention for innovation. At the very least they had an obligation to state it was an OEM. Also explain how an OEM’ed product would result in tremendous innovation, let alone being one of the top 20 products of the last 20 years.

Illena, I seriously have the utmost respect for you and all the folks at SC Magazine. But having this product featured in 4 consecutive issues without some more disclosure around it should have raised some serious flags in your process.

The Praetorian Prefect tries to ride to the rescue and a blog fight ensues

Its been a while since I have done one of these, but lets see if I still have it. It seems Daniel Kennedy, the Praetorian Prefect (sounds like a WWE character doesn’t it? Should I be Hulk Hogan) has come to the defense of Peter Stephenson in my NAC Twilight Zone post from earlier today. The Prefect writes a rather long comment with his opinion in this matter. I could have continued this little blog tussle in the side ring of the comments section. But it is long enough, I have enough to say and damn it, its the holiday season. Lets take it to the center ring and get reaaddyy to ruumble!

To start it off here are the Prefects comments in their entirety:

Knowing Peter Stephenson, I haven't found him to be biased. I can base that on the fact that many vendors whose products are reviewed don't like his and his son's findings very much (usually a good sign of someone who's not 'in the bag'). They also have taken the time to explain their lab setup, methodology, and link the results back to both. Sounds like StillSecure might be on that list.
You've "watched a budding relationship"? Senior people at security product companies are supposed to form relationships with trade magazines, and especially those who test their products. People who don't are boneheads who shouldn't be in sales. But you talk around this fact to suggest that the reviews of the lab are biased because of this relationship. That's a bold piece of conjecture without better proof.
It looks and sounds like a pretty honest and up front operation. You get the results they found based on the environment they have and the inputs they are looking for. If they don't match the inputs you want to use for a buy decision, their findings probably won't be helpful to you. Still, the reviews are basically free, I understand what they're doing, I know their competency level, and thus this is helpful in determining players to look at in each space. Better than a quadrant anyhow.
Regarding this product, you have two entries, one from October that is the actual review, and this bizarre stub of a page in November that contains none of the regular review ratings. Sounds like a plain old clerical mistake. Picking it for the award? A little bizarre, but clearly it was fresh in everyone's mind over there (and no surprise that the most recently released product has features other products haven't had over the years). Its a little strange, but a far cry from then moving to claim that the Stephensons are publishing biased reviews.
Aren't you the guy who tackled me at a security conference because I picked up a StillSecure T-shirt?

OK, lets take this apart with my 10 reasons why Constantine was right to dissolve the Praetorian Guards:

1. Good Daniel, you know Peter too and have not found him to be biased. Has he reviewed any of your products? Have you been involved in any reviews he has done? Have you ever done any business with Peter? Was this when he worked in the lab at Norwich University or after he left and started doing consulting?

2. You are basing the fact that he must not be biased because you have heard vendors complain about his findings. Well that sounds downright scientific to me! Maybe they are bitching because they have a reason to? Maybe the fact that the testing there is a bit “out of the ordinary” yields the results that we see. Take a look at what products they choose for awards and consistently SC Mag product reviews like to choose winners “off the beaten path”.

3. They take the time to explain the methodology and lab set up you say?  Daniel what if I told you I have won best buy awards from SC Magazine lab doing a phone demo of my product and power point slides? They never actually touched the product. Would you think it was such a good set up then?  Before you run off at the mouth, you should make sure you have the facts straight.

4. StillSecure is on the list of disgruntled vendors. Wrong again my Praetorian friend. In fact StillSecure has done extremely well on SC Magazine reviews.  Just about all of our products have taken 5 stars, best buys and been finalist in reader choice awards at SC Magazine. Most recently in September I believe, our MSSP service took a best buy.  So you are very wrong on that front.  Not to mention that I don’t work at StillSecure any more. So any ax to grind from the StillSecure front is moot.

5. The relationship between Peter and a CEO of a company.  Daniel ask around the community, they will tell you I can schmooze with the best of them.  I was not referring to that type of relationship building. But I don’t want to get sued either. Yes I was vague. I am going to remain vague.  But I have my own good reasons to say what I did. The important thing is that relationship should not carry over to an OEM client without disclosure. 

6. Better than a quadrant you say. Perhaps. But Daniel that assumes the tests are what you think they are. Yes, they should be taken with a grain of salt and as I said most people think all magazine reviews (not just SC Mag) are bought and paid for anyway.

7. Daniel you say I have two entries? Go read the post again and click all the links. There is a full review in the NAC group test for October.  There is a separate “product review” in November (yes that is bizzare, but BlackBox didn’t have the product up on the website in time for the October issue). Then there is the special mention for Innovation of the year in December. (would you give an OEM of an existing product an award for innovation?) Finally there is today’s press release from BlacBox itself that Veri-NAC has been picked as one of the 20 top security products of the last 20 years by your friend at SC. A little strange? More than just a little Daniel.  So Romans were good in math, how do you get 2? By my math it is 4 times in the last 4 months.

8. I am not saying they are biased reviews, they are pushing this product in an unusual way and it begs the question of why.

9. Did I tackle you at a security conference for taking a StillSecure t-shirt? Usually if I tackle you, you stay down, so I am not sure. Maybe I didn’t get a clean shot in. But I always liked to think t-shirts were for customers and not adult trick or treaters. Which one were you?

10. (Just because I need a 10 for my top 10 list). Don’t come on my blog spouting off without the facts to back them up.  Have a happy holiday.

Reality check please! You are about to enter the NAC Twilight Zone

You know I am big fan of the people at SC Magazine. From Illena Armstrong on down I really like the folks from Haymarket. Also, over the years at StillSecure, the magazine has been very kind. StillSecure has won its share of awards and bake offs from the folks at SC Magazine. I have Dan Kaplan as one of the judges for the Security Bloggers Awards. But especially now that I am not affiliated with a vendor, I have to call them as I see them.

Peter Stephenson and his son Mike basically run the lab for product reviews and group reviews over at SC. Over the years to say they have made some unorthodox choices is a great understatement. While it is good to see some new names rather than the usual suspects, it also calls into question the creditability of the judges.

That is a bad thing.  Most people already look at most product reviews as bought and paid for by vendors. There is a portion of the security world who think of SC Magazine as the “People" magazine of security (yes I have actually heard that from more than one person). I thought I knew better. I know the people there and know they try their best to put out a great magazine, month in and month out.

But I just am compelled to call this out. Hey I wouldn’t be ashimmy otherwise. Rothman is already saying that I am going soft. So there is a real creditability problem at SC Magazine labs. It is around NAC.

Over the years I have watched a budding relationship between the lab director at SC Mag, Peter and the CEO of NetClarity. For those of you who don’t know, Net Clarity is the maker of a NAC product that is aimed at the lower end of the market. The CEO there does a good job of smoke and mirrors and marketing, but like most NAC vendors I doubt they are doing much in revenue.

Interestingly though every time Net Clarity would be reviewed by SC Mag they would always get a stellar review and either a best buy or what ever the highest rating was. Hey, I get it – they like the product there and the CEO and Peter are buddies. That is the way of the world.

Interestingly, another player entered the NAC world (at least at SC Magazine, because it was unseen anywhere else) back around October.  All of a sudden an SC Mag group test of NAC had no Net Clarity, the usual winner for SC Mag. Instead the recommended product was a product called Veri-NAC by BlackBox.

Now I know the NAC market pretty well. I had never heard of the product. A Google search turned up nothing at the time. Even more interesting was that there was nothing on the Black Box site about the product either. I think you would have to agree, its pretty strange for a supposed best in class winner at a major magazine review to be totally unknown even by its own vendor.

So being the journalistic blogger I am, I did a little digging. That is when I came across some interesting information. The picture of the BlackBox NAC product and description was a dead ringer for another NAC product I knew. Which one? Bingo, you got it – Net Clarity! It seems BlackBox is an OEM of Net Clarity. Now, no one has confirmed this officially to me, but you can take it to the bank. Unless by now they have bought Net Clarity outright and it has not been announced yet.

In any event, someone’s hands are in the cookie jar here! Hey you want to give the award to your buddies OEM partner, that is fine. At least have the creditability to say that it is an OEM of a proven product we have reviewed before. Don’t try to put one over on anyone here.

Frankly I confronted the lab reviewers about this but let it go because I was leaving StillSecure anyway. But I have seen some things that compel me to bring this to the full light of day.

One month after the October award review, the SC Mag lab reviews the same product again! Have you ever heard of a magazine reviewing a product two months in a row. Could it be that BlackBox screwed up the launch of the Net Clarity OEM product by not having it on the web site yet and so SC Mag labs reviewed it again, so that this time people could actually go to the web site of BlackBox and buy the damned thing? I don’t know, its pure speculation on my part. But it sounds logical.

But wait there is more! SC Magazine ran a special for security innovator of the year in early December. Who do you think the lab manager asked to be added for a special mention? You got it Veri-NAC by BlackBox! Now that sounds like innovation to me. What about you?

The tangled web gets even stickier . SC Magazine recently celebrated their 20th anniversary (congrats guys). The lab folks have come up with a list of the 20 Most Influential Security IT Security products over the last 20 years. Who do you think made the list? That’s right, blow me down, but BlackBox’s Veri-NAC is one of the top 20 over the last 20 years.

Are you kidding me? A NAC product? An OEM of another NAC product that is not generally rated at the top of its class by many?  I don’t know about you, but it is time for a reality check here. Is Peter Stephenson imitating Rod Serling and am I in the NAC Twilight Zone? 

Guys you want the security industry to take you seriously, you need to get serious. This kind of stuff needs to be taken to the curb with the rest of the trash!

Let me also end with I don’t work at StillSecure. I don’t care if you pick their NAC or any of their products. I really don’t care what NAC you pick. Frankly I really don’t care much about NAC these days. But this kind of stuff just won’t fly. You might as well come out with your own Silicon Valley Reporter awards.

Related articles by Zemanta

• SC World Congress Concludes with Announcement of Winners of Security Innovators Throwdown (prweb.com)

Seizing management power, is not keeping it

This past weekend I received my hard copy of the 20th anniversary issue of SC Magazine.  Hate it or love it, 20 years covering information security is a statement.  Congrats to Ilena and the rest of the team there! One article by Dan Kaplan caught my eye (BTW, I had no idea that Dan checks my blog for ideas, as Joe Franscella says). “Seizing Management Power” chronicles the evolution of the CISO position “from introverted techie into slick businessperson”. Dan looks at Howard Schmidt’s career from police officer and Ham radio enthusiast to security pro today. He also looks at several other prominent people who have held the CISO position at large corporations.  Interesting in that each of these people came in and set up security programs and then moved on.

Today’s CISO’s are as likely to have an MBA as they are a CISSP says Kaplan.  I agree with Dan, they are as likely. But just as the mission has evolved from techie to business speak, the scope has also been narrowly defined. It is an architectural position, not a long term place at the table. As the article points out, the CISO needs to be proficient in “people, processes and technology”.

Ultimately though Kaplan states that “going forward, though, as the CISO position assures its foothold in the corporate boardroom, some observers wonder if the function has an infinite lifespan”. My theory is not an infinite lifespan in terms of function. There will always be the need to come in and set up or reshape a security program.  But once that is done, what is next? How long does the CFO and CEO want to keep paying big bucks for the architect? The CISO comes in with a mandate and and power, but can they keep it? That is the hole in the bottom of the CISO bucket.

I think the CISO’s architect role can be accomplished with a proven methodology, in a given time frame and within an agreed upon a budget and then handed off to a caretaker and not the architect. CISO’s are too highly compensated to be expensive cheerleaders. At the end of the day that is why I think CISO is a great place for a consultant.

Security Bloggers Network news

Image of RSA Blog MeetUp 2009

I have not written lately about the Security Bloggers Network. The network continues to chug along adding new security blogs from around the world.  The feed is deep and rich with lots of great content on a daily basis.  We still have much work to do to make the site more valuable to both SBN members and readers, but there are never enough hours in the day. Anyway a couple of updates regarding the SBN:

1. The SC World Congress is about 3 weeks away. Both SBN bloggers and readers are eligible for special discounts to attend this show in NYC.  You can get all of the details in this earlier blog post I did on it.

2. Security Bloggers meet up for RSA Europe.  Our security bloggers meet up at RSA in San Francisco has become quite the event. Now for the second year a bunch of bloggers are organizing a European version of the meet up. If you are attending the European RSA show and would like to meet up with other bloggers email bloggermeetup@infosecramblings.com for details. Space is limited to just 50 bloggers, so please do so promptly if you want to be sure to attend.

3. Lijit search widget – Lijit is supporting the SBN website and feed. Their vision is that the Lijit search engine will power SBN wide searches. it is a valuable tool for all SBN members. If you are an SBN member you can get the widget at http://www.lijit.com/external/network_signup/sbn.

4. Social Security Bloggers Awards -  Believe it or not, we are already starting to plan next years RSA security bloggers meet up. I think we are going to take another try at the Social Security Blogger awards. This year we are thinking that voting for the awards will be open to SBN members. Making it sort of a an award by bloggers for bloggers, along the lines of the Screen Actors Guild (SAG) awards.  I would be interested in thoughts on that, so feel free to leave a comment with what you think on it.

Thats all for now, but stay tuned for more SBN news soon!

Related articles by Zemanta

• Whats up with the SBN? (stillsecureafteralltheseyears.com)
• Welcoming the new Lijit Welcome Wijit (sethlevine.com)
• SC World Congress SBN discount (stillsecureafteralltheseyears.com)

StillSecure MSSP earns Best Buy and 5 out of 5 stars!

I am happy to be able to post today some news that I have known for about a week already.  SC Magazine recently conducted a group test of MSSPs. The bake off included all of the usual suspects and some you may not be as familiar with.  They did a pretty deep dive on the offering and besides giving us an overall 5 out of 5 stars awarded StillSecure the Best Buy award in the category!

This is especially sweet because it is the first time our ProtectPoint MSSP service has actually been reviewed and it copped top spot out of the gate.  I always tell people that we liked what we saw so much in the ProtectPoint service that we bought it - lock, stock and barrel. Now over the last few months we have expanded the service offering with more and deeper solutions, as well as added some StillSecure technology.  We think it is a great MSSP offering and I guess the SC Magazine staff did too.

Of course we are not done yet. Look for even more offerings and solutions in our MSSP group soon. In the meantime congratulations to Steve Harris and the whole team who are on the job 24x7x365 making StillSecure’s MSSP service the best it can be!

SC World Congress SBN discount

This is the second year for the SC World Congress. This years Congress is at the Sheraton in NYC.  Besides some great exhibitors (including StillSecure), they have an amazing line up of speakers and presentations.  If you are in the NYC metro area you should really try to catch this one. Expo passes are free and as a courtesy to SBN members the SC Congress folks have let us extend the following offer:

Make plans now to attend the second annual SC World Congress - Enterprise Data Security Conference & Expo, October 13-14 in New York City. The Congress features a comprehensive, two-day program presented in four tracks-including the unique Editors Choice sessions-and the industry's most comprehensive fall product expo showcasing IT security solutions from the leading vendors and hot startups.  Emphasizing quality content, innovative formats and sessions, global perspectives and ROI, this is the one event you can't afford to miss.  Security Blogger Network readers and newsletter subscribers can receive a 25% conference discount—$746 discounted from $995—by using the code COLLEAGUE in the box marked Promotional Code on the registration page.  No code is required for expo admission.  This special offer expires after September 10. After Sept 10th a $100 discount on conference fees, applied to the prevailing rate, by using the code Bloggers in the box marked Promotional Code on the registration page.  No code is required for expo admission.  The rate deadline is September 18. www.scworldcongress.com

I will be there so if you do attend please stop by and say hello!

When you're a hammer everything looks like a nail

One of my favorite sayings and I have Mike Rothman to thank for it.  It popped into my head this morning while reading a guest opinion piece in SC Magazine by Jon Green, VP of Aruba Networks (VP of what I don’t know). Once you get past Jon’s cutesy wireless and NAC = BFF stuff and read what he is talking about there are some good things there about how NAC can help a network.  But you need to remember what kind of hammer Jon is. 

Aruba is a company that makes and sell wireless gear and OEM’s Bradford Network NAC product.  They sell a lot of the OEM’ed NAC into the edu market. So of course what Jon says is based upon the experience Aruba has selling NAC. Therefore when Jon says retrofitting NAC onto wired networks is much harder then putting NAC into the wireless networks understand the perspective. You see the nail?  He says this is because the wireless networks are new and don’t need to be retrofitted. But what about if you are upgrading the wired network too? That does happen.  At the end of the day if you are using 802.1x whether it is wired or wireless, NAC is much easier to do, assuming you know your 802.1x. 

Here is my point though, what good is just putting NAC on your wireless network if the wired network is not protected? As the song goes “it just takes one bad apple”. In fact NAC’ing your wireless network while leaving the wired network open is like locking the door but leaving your windows open.  If you are going to use NAC you need a plan that will have all devices coming on your network being authenticated and secured.  Not just the ones that come on through the gear you sell.  Otherwise instead of BFF, it is just BFD!

One other thing Jon, not sure how many actual NAC deployments with remediation you have actually worked on, but let me know how many endpoints are patched and remediated in a just a few seconds. Maybe the testing takes a few seconds but remediation takes longer then that. Makes your piece sound a little too PR'sh.

What are you doing Tuesday night at RSA?

The security bloggers event is not that night, so what is the hot ticket for Tuesday night at RSA? For me and many of the movers and shakers in the security industry, the SC Magazine annual awards show at the Hilton is the place to be. It is the security industry’s version of the Oscars. Ilena Armstrong and team put on a first rate event. The drinks are top shelf, the food is decent, the entertainment is very funny and the networking is great! Oh yeah, seeing who wins is pretty exciting too.

Anyway, if you would like to attend this years event there is still time. Here is the link to register. I have been to at least 4 or 5 of these and have never had a bad time!