The Ashimmy Blog

Special Offer for Security Bloggers Network Members: The Plateau Effect: Getting from Stuck to Success

An exclusive offer for the Security Bloggers Network - Hugh Thompson Invites you to celebrate the release of the book The Plateau Effect by NYT bestselling author Bob Sullivan and RSA Conference Program Chair Dr. Hugh Thompson.

You can get a free signed bookplate from the authors to insert into your book if you: 

1. Tell your readers about the book’s publication using the hashtag #PlateauEffect on your social media before May 4th

2. Send a link to your tweet or screenshot of your blog or Facebook post to PlateauContest@gmail.com

3. For the first 50 we receive (sorry, U.S. only), we'll mail you the book plate!

The book will be available on May 2nd at bookstores and through Amazon.

Hugh Thompson is a friend of the SBN, so if you can give it a shout out and help a friend out!

European Security Blogger Meetup and Awards

I am happy to report that Brian Honan with a big hand from Jack Daniel and our good friends at Tenable Network Security are putting on the 2nd annual Security Bloggers Meet up during Infosec Europe.

The European Bloggers Meetup is of course based on the RSA Conference Bloggers Meet up that we hold every year.  From what I understand it was a nice get together last year thanks to Firemon for sponsoring it.  Now in this second year they are going to try and add European Security Blogger Awards to the mix as well.

I am both flattered and pleased to see the idea being franchised over across the pond. I am waiting to hear all about it and hope to make it out to the event next year!

In the meantime head over to Brian’s blog for details and links to register for the event, nominate blogs and vote.

Related articles

• European Security Bloggers Meetup and Awards (uncommonsensesecurity.com)
• Security Blogger Award Winners 2013 (ashimmy.com)

Microsoft Trustworthy Computing Sponsors Security Bloggers Network

I am very pleased to report that once again the good folks over at Microsoft's Trustworthy Computing Group have agreed to sponsor the Security Bloggers Network.  The SBN has a long history of working with TWC and we are happy to work with them again.

Microsoft is holding their second annual Security Development Conference in San Francisco, May 14-15, 2013. The conference will feature Scott Charney, Corporate VP Trustworthy Computing, Microsoft; Edna M Conway, Chief Security Strategist Global Supply Chain, Cisco Systems; Brad Arkin, Senior Director of Security Adobe Secure Software, Engineering Team (ASSET).

Conference specialty tracks target three different types of professionals: Engineers, Project Management, and Leadership. Combining keynotes from thought leaders as well as specialized breakout sessions, this conference is a can’t-miss for security professionals at any level. You can register now and USING THIS CODE AND SAVE $300 OFF THE REGISTRATION PRICE: SBN@SDC#13!

I had a chance to chat with director of TWC Tim Raines. We were going to talk about the conference, but Tim and I started talking about the TWC, the world of security and what the challenges on the horizon are. By the time we were done, we never got to the conference, LOL!

Anyway, I think you will find the conversation very interesting. Enjoy and if you can go to the conference.

Related articles

• RSA 2013: Microsoft Calls For Global Push On eID Schemes (techweekeurope.co.uk)
• RSA: Microsoft's Keynote and Sessions Guide (blogs.technet.com)
• RSA Keynote Scott Charney (securemaryland.org)

Security Blogger Award Winners 2013

Well it was an epic Security Blogger Meetup and awards this year. In many ways it was the best one we have had. But nothing is perfect and we are already planning to be bigger, better and more inclusive next year.  In the meantime I know many folks have been waiting to see who the winners of the Social Security Blogger Awards were.  So without further adieu, for the record here are the nominees and winners:

Best Corporate Security Blog

Other nominees:

McAfee Blog: click here

CloudFlare Blog: click here

SecureWorks Blog: click here

Solutionary Minds Blog: click here

Kaspersky Lab Securelist Blog: click here

Veracode Blog: click here

Trend Micro Blog: click here

AND THE WINNER IS:

Naked Security Blog: click here

Best Security Podcast

Other nominees:

Liquidmatrix Security Digest: click here

EuroTrashSecurity: click here

SANS Internet Storm Center: click here

Southern Fried Security: click here

Risky Business: click here

Sophos Security Chet Chat: click here

And the winner is:

Paul Dotcom: click here

The Most Educational Security Blog

Other nominees:

BH Consulting's Security Watch Blog: click here

Security Uncorked Blog: click here

Dr. Kees Leune's Blog: click here

Securosis Blog: click here

Social-Engineer.org Blog: click here

Critical Watch Blog: click here

The Security Skeptic Blog: click here

The New School of Information Security Blog: click here

And the winner is:

Krebs On Security: click here

The Most Entertaining Security Blog

Other nominees:

Packet Pushers Blog: click here

Securosis Blog: click here

Errata Security Blog: click here

Naked Security Blog: click here

Uncommon Sense Security Blog: click here

PSilvas Blog: click here

And the winner is:

J4VV4D's Blog: click here

The Blog That Best Represents The Security Industry

Other nominees:

SpiderLabs Anterior Blog: click here

1 Raindrop Blog: click here

Naked Security Blog: click here

The Firewall (Forbes) Blog: click here

Threat Level (Wired) Blog: click here

Securosis Blog: click here

Michael Peters Blog: click here

And the winner is:

Krebs On Security Blog: click here

The Single Best Blog Post or Podcast Of The Year

Other nominees:

The Epic Hacking of Mat Honan and Our Identity Challenge: click here

Application Security Debt and Application Interest Rates: click here

Why XSS is serious business (and why Tesco needs to pay attention): click here

Levelling up in the real world: click here

Secure Business Growth, Corporate Responsibility with Ben Tomhave: click here

And the winner is:

Meet The Hackers Who Sell Spies The Tools To Crack Your PC (And Get Paid Six-Figure Fees): click here

The Security Bloggers Hall Of Fame

The other nominees are:

Richard Bejtlich

Gunnar Peterson

Naked Security Blog

Wendy Nather

And the winner is:

Jack Daniel

Congratulations to all of the nominees and of course congrats to the winners.  See you next year at the Security Bloggers Meetup. If you did not get an invite this year, be sure to write to info@securitybloggersnetwork.com requesting to add your blog and be on the list!

Special thanks to our sponsors: Qualys, Sourcefire, Akamai, Fortinet, Barracuda Networks and Jeanne Friedman and the RSA Conference!  Also a special shout out to Trainer Communications for helping with the voting as always!

Why Not Everyone Can Come to the Security Bloggers Meetup

Rich Mogul has a good post up about the security bloggers meetup today. It gives the history and details of how and why we started the Security Bloggers Meetup.  I don’t disagree with anything he has to say.

On the other hand I am here in San Francisco.  Seeing some of you whom I consider my friends upset about not being invited to a party is upsetting to me.  If you know me, you know that I would gladly take dollars out of my pocket and make sure you drink, eat and have a good time.  But really that is not what it is about. As Rich said we have a waiting list for sponsors, so money is not the issue. 

There are two issues at play here and they are very different. I want to make sure we understand that.

Issue 1: This is a party for the bloggers by the bloggers.  As Rich wrote, that has always been the idea behind the bloggers meetup and the blogger awards.  It is a marketing free zone. No PR, no marketing, only bloggers. If you don’t blog, podcast or write about security, you should not be there. Have people gotten been admitted in years past who didn’t blog? Yes.  Some names always sneak in that we don’t catch. If you were lucky enough to get in one year, doesn’t mean you will next year or even this year though.

Will this change in the future? I really don’t think so, though I think we need to do a better job of defining what qualifies.  We will get started on that as soon as this years event is in the books.

Issue 2: Just because you are invited, who can you bring with you.  I hear you on this one. I brought my wife out with me to RSA this year for the first time. If she had not already gone home, I would be hard pressed to not bring her with me to the party. Same goes for your significant other, best friend, partying buddy, etc.  But guys it really becomes an issue of space. The location has capacity rules, if we go over the SFFD can close the whole thing down.  We can’t do it.  As Rich said we will look into a bigger place for next year and look at how we accommodate these kinds of requests.  But for this year, the cake is already baked.

So if I or any of us have offended you, pissed you off or you think we are being arbitrary and capricious, please forgive us. We are really do try to throw the best party and awards we can for the security blogger community!  Write to me with suggestions and we will do better next year.

For those two hundred or so of you who did get an invite, I am looking forward to lifting a glass and catching up.

Related articles

• About the Security Blogger's Meetup (securosis.com)
• Bloggers Are Real People (jillianlevi.wordpress.com)

Where is AShimmy at RSA?

You can feel the pace rising to a crescendo, you sense it coming. But don’t look now, RSA is just next week.  The last two months have been pretty much a blur in getting ready for the big conference.  As usual I should have done 12 things I didn’t, but the dozens of things I have done is going to have to be enough. 

I am happy to be chairing two panels during RSA week this year.  The first is on Monday, the 25th (also my 23rd wedding anniversary) at the annual and well attended Americas Growth Capital Conference, over at the Westin.  The panel I am chairing is at 11:30 a.m..

The topic is Cloud Security Services: The Evolution Continues

Here is the abstract:

With the initial gold rush to the cloud it seemed that every security vendor was pushing a cloud security service. Every security company had to have their “story on the cloud” for customers, analysts and investors. But over the months and years we have seen a steady evolution of cloud security services beyond those early “everything but the kitchen sink” strategies.

More than just putting data and analysis off premises, today’s cloud security services are truly leveraging the unique features of the cloud like elasticity, massive scale and instant on provisioning.

Just because you can do it in the cloud doesn’t mean the cloud is the best place to do it. As we move beyond the explosion of cloud security services, which types of security services are best suited to the cloud? Which cloud security services will have markets large enough to create substantial business opportunity? Which cloud security services are so disruptive that they will eliminate or replace non-cloud based security services?

Evolution can be a cruel master, only the strong survive. The losers fall into the trash heap of history. Our panel will tell you who the winners will be in cloud security services.

I am joined on the panel by:

Matthew Prince, Co-Founder, Chief Executive Officer, CloudFlare

Dave Dewalt, Chief Executive Officer, Chairman, FireEye, Chairman, Mandiant

Jay Chaudhry, Founder, Chief Executive Officer, Zscaler

Stuart Scholly, President, Prolexic

Carson Sweet, Co-Founder and CEO of CloudPassage

It should be a great panel!

Then on Wednesday I am chairing a great panel at RSA at 9:20 am in room 304 on Ipv6 Vulnerability Management: From Theory to Reality. The agenda:

Join the leading lights of the vulnerability management industry as they carry forward their discussion on the challenges of managing vulnerabilities and network security in an IPv6 network. Where last year the discussion was theoretical, this years panel will focus on actual case studies of standing IPv6 networks in govt., retail, large enterprise and the cloud.

My fantastic panel for this one is:

Wolfgang Kandek - Chief Technology Officer, Qualys
Ron Gula - Chief Executive Officer and Chief Technical Officer, Tenable Network Security
HD Moore - Chief Security Officer, Rapid 7
Tim Keanini - Chief Research Officer, nCircle
Misha Govshteyn - Vice President Emerging Products, Alert Logic

Besides that I will of course be at the Security Bloggers Meet up and Security Blogger Awards on Wednesday.  Besides that I will be in and out of meetings and sessions, parties at night and usually at the W bar before heading in for the night.  If you see me, be sure to say hi.

Enjoy RSA, let the fun begin!

Related articles

• Qualys CEO to Address Security in a Hyperconnected World During Keynote Session at RSA Conference USA 2013 (sys-con.com)
• RSA USA 2013: Right Around The Corner (mandiant.com)
• Illuminating the Dark Matter of your network with iScan Onlines Opportunistic Scanning (ashimmy.com)
• CloudPassage CEO Carson Sweet to Speak about Cloud Security at AGC's West Coast InfoSec and Technology Growth Conference (virtual-strategy.com)
• Zscaler Unveils New Analytics Technology to Provide Real-Time Visibility into Global Traffic (news.softpedia.com)

Security Blogger Awards Finalist Voting Is Now Open!

Well finally I am happy to report that the finalists have been selected and voting for the 5th annual Social Security Blogger Awards is now open!. I know many of you did not understand and were confused by the preliminary rounds of voting. However, our new method of picking finalists has resulted in what we think is our strongest group of finalists ever.

We have many of the blogs and podcasts that have been nominated before (quality is quality), but we also have many new or never before nominated sites as well.  Many thanks to our all star panel of judges who nominated some of the finalists – Bill Brenner of CSO, Kelly Jackson-Higgins of Dark Reading, Wendy Nather of The 451 Group and none other than Beaker himself, Chris Hoff.

Also many thanks to all of the blogs and podcasts who requested to be nominated. Whether you made the finals or not, keep blogging.

You can go vote for your picks here. As in years past, to vote in the finals you have to be a security blogger or podcaster yourself.  All votes are reviewed by humans, so please just vote once and don’t try to game the system.

Special thanks to Trainer Communications for all of the help with voting and helping. Also special thanks to sponsors of the Bloggers Meetup – Qualys, Fortinet, Sourcefire, Akamai, Barracuda Networks and RSA Conference.

Here are the finalists.  Good luck to them all!  Of course winners will be announced at the Bloggers Meet up at RSA Conference 2013.

Best Corporate Security Blog

McAfee Blog: click here

CloudFlare Blog: click here

SecureWorks Blog: click here

Solutionary Minds Blog: click here

Kaspersky Lab Securelist Blog: click here

Veracode Blog: click here

Trend Micro Blog: click here

Naked Security Blog: click here

Best Security Podcast

Liquidmatrix Security Digest: click here

EuroTrashSecurity: click here

Paul Dotcom: click here

SANS Internet Storm Center: click here

Southern Fried Security: click here

Risky Business: click here

Sophos Security Chet Chat: click here

The Most Educational Security Blog

BH Consulting's Security Watch Blog: click here

Security Uncorked Blog: click here

Dr. Kees Leune's Blog: click here

Securosis Blog: click here

Social-Engineer.org Blog: click here

Critical Watch Blog: click here

The Security Skeptic Blog: click here

Krebs On Security: click here

The New School of Information Security Blog: click here

The Most Entertaining Security Blog

Packet Pushers Blog: click here

J4VV4D's Blog: click here

Securosis Blog: click here

Errata Security Blog: click here

Naked Security Blog: click here

Uncommon Sense Security Blog: click here

PSilvas Blog: click here

The Blog That Best Represents The Security Industry

SpiderLabs Anterior Blog: click here

Krebs On Security Blog: click here

1 Raindrop Blog: click here

Naked Security Blog: click here

The Firewall (Forbes) Blog: click here

Threat Level (Wired) Blog: click here

Securosis Blog: click here

Michael Peters Blog: click here

The Single Best Blog Post or Podcast Of The Year

The Epic Hacking of Mat Honan and Our Identity Challenge: click here

Application Security Debt and Application Interest Rates: click here

Why XSS is serious business (and why Tesco needs to pay attention): click here

Meet The Hackers Who Sell Spies The Tools To Crack Your PC (And Get Paid Six-Figure Fees): click here

Levelling up in the real world: click here

Secure Business Growth, Corporate Responsibility with Ben Tomhave: click here

The Security Bloggers Hall Of Fame

Jack Daniel

Richard Bejtlich

Gunnar Peterson

Naked Security Blog

Wendy Nather

Related articles

• And The Nominees Are . . . (365.rsaconference.com)
• Social Security Blogger Awards 2013 Judges Announced (ashimmy.com)

Blogger Award Voting Is Open

A little later then we wanted, but the preliminary round of voting for the 2013 Social Security Blogger Awards is open as of today.  As I wrote in an earlier post we are doing something a little different this year.  In addition to finalists nominated by our judges, we are also letting bloggers and podcasters nominate themselves for th preliminary round.  The top vote getters in each catagory of the preliminary rounds will be added to the finalists.

Voting for the preliminary round will continue for the rest of this week.  Then voting in the finals will commence.  We hope this will allow a new generation and some "fresh faces" into the award process.

Of course the winners will be announced at the Security Bloggers Meetup at RSA Conference this year.

If you are interested in voting in the preliminary round, you can do so here.

 

Related articles

Security Blogger Awards 2013 News

Social Security Blogger Awards 2013 Judges Announced

Well it is getting towards that time of year. RSA will be here before we know it.  If RSA is getting close, so is the 7th annual Security Bloggers Meet up (7 already) and the Security Blogger Awards with it.  As I wrote earlier we are going to do some things a little different this year. 

In addition to our blue ribbon panel of judges picking finalists, we are going to open up nominations to those who would like to nominate their blogs and podcasts.  Those nominees who garner enough votes will then also be in the finals.  If you would like to nominate your blog (you will have to put a badge on your blog for the voting) please write me at info@securitybloggersnetwork.com. Be sure to include what category you would like to nominate your blog for.  Some folks already have written me and I will be preparing the badges soon.

In the meantime I want to introduce this years Security Bloggers Award Judges:

1. Bill Brenner – Bill needs no introduction to those in the security industry. He has been a judge since the first blogger awards and thankfully has agreed to continue this year.

2. Kelly Jackson Higgins -  Kelly is a senior editor of Dark Reading and like Bill has been a judge in our awards since the beginning.

3.  Wendy Nather – Wendy of 451Group was a first time judge last year and brought some fresh perspectives to our panel. She has graciously agreed to judge again this year.

4. Christofer Hoff – Yes, that’s right! Beaker himself has agreed to judge this year. Actually I have a very long standing relationship with Chris’s blogging. I have been reading his blog since before it was cool (or cloud). I was thrilled he accepted our invite and I am sure he will do a smashing job!

So there you have it. The 4 judges for this years awards. You may contact them at your own peril. They are under no obligation to speak to anyone about the awards, but it is up to each judge.  Also if you want to go the popular nomination route, please write me as above.

BTW, the award categories for this year are:

Best Corporate Security Blog

Best Security Podcast

The Most Educational Security Blog

The Most Entertaining Security Blog

The Blog That Best Represents The Security Industry

The Single Best Blog Post or Podcast Of The Year

The Security Bloggers Hall Of Fame

There you have it. Good luck to all of the bloggers and podcasters out there.

Do you want to nominate your blog or podcast for the Social Security Blogger Awards at RSA?

I wrote a few weeks ago about how we are changing the nominating process for this years Social Security Blogger Awards at RSA.  We will allow those bloggers and podcasters that choose to do so to nominate their blogs for the finals.

Those blogs and podcasts that get the most votes in the nomination process will make the finals along with those selected by our panel of judges (who will be announced shortly).  Last year several security bloggers and podcasters wanted more transparency into the process and the ability to nominate blogs.  We have done so.

To date though, I have only seen a handful of requests for nominations come in.  I don’t have a problem with that as I think our judges nominate the best.  But I want to make sure everyone who wants to be nominated has a chance to do so.  If you would like to nominate your blog or podcast please email info@securitybloggersnetwork.com.

If you bloggers and podcasters reading this can pass it along to anyone who may be interested, that would be great.

RSA and the Bloggers Meetup will be here before you know it!

Related articles

• Security Blogger Awards 2013 News (ashimmy.com)
• Security Blogger Awards 2013 (ashimmy.com)
• 2011 Security Blogger Awards (veracode.com)