The Ashimmy Blog

The Death of Product Reviews

Image via Wikipedia

My friend Bill Brenner has a post up on his Salted Hash blog today about a recent browser security study done by Accuvant LABS. The study shows that Google Chrome was the safest browser tested. Like Bill, I use Chrome too and agree with the Accuvant study.

The problem for Bill is that the study was sponsored by Google, the makers of Chrome. The fact that they paid for this study in Bill’s mind and in many other people’s minds calls the legitimacy of the entire study into question. Even if it is correct, it just doesn’t sit well with Bill.

Frankly I have the same problems with most product reviews, bake offs, analysis reports, etc. I have written about this before as well. In my mind it is a big reason why no one seems to pay attention to product reviews anymore.

It doesn’t make a difference if it is an “independent lab” doing the testing, a magazine’s testing department, industry awards or an analyst firm analyzing the market, the first thing I look at is who is paying for it. Sometimes finding out who is paying for it is not so easy or transparent either.

To be fair, some firms like Securosis for instance will say upfront that some research they are doing is being financed by a paying customer. Such was the case when Mike, Rich and Adrian did a dive on “fact based security security metrics”. The boys said upfront and at the bottom of the page that they thanked Red Seal for sponsoring the research.

Now does that mean that everything they wrote was for the benefit of Red Seal? I know Rich, Mike and Adrian too well to believe that. But it does give me pause when I read the report to remember that fact.

But I will say that over time I have come to soften my attitude on this issue (I must be getting old). For me it is a case of forewarned is forearmed and I take that disclosure in terms of evaluating how much weight to give the research. The same way a juror has to weigh the testimony of a witness depending on their believability.

In the case of Bill’s browser study, same thing. The chances that Google had a heavy hand in the study by Accuvant is pretty low, but it is something to consider. That is just the way it is.

But for Bill and the other doubting Thomas’s out there, what is the alternative?

One alternative is what Rick Moy and the guys at NSS Labs are doing. They have turned this equation on its head. They make their money from the end user, so the vendors being tested have little to no influence.

As Bill says just because Google paid for it doesn’t mean the study is wrong, but it does give you something else to consider. But since no one wants to do these tests or studies for free, someone has to pay and that is the truth of it.

Related articles

• What's the Most Secure Web Browser? [Security] (lifehacker.com)
• Accuvant Labs: "Chrome is the most secured browser" (miguelalmeida.net)
• Chrome sandboxing makes it the most secure browser, vendor study claims (arstechnica.com)
• Which Browser Is Most Secure? A New Study Reports A Surprise (ostatic.com)
• Google-Funded Study Knocks Firefox Security (news.slashdot.org)
• Chrome Is Most Secure of the Top Three Browsers, Study Finds (pcworld.com)
• New study claims that Chrome is the most secure browser (zdnet.com)

One Weekend Left To Vote

Only one weekend left to vote in this years Social Security Blogger Awards. You can vote here:http://www.zoomerang.com/Survey/WEB22BQFS9A3BN/.

Remember you must leave a verifiable email address and blog address in order for your vote to count. From what I am told, our votes this year have already exceed the total number of votes last year. But make your choices known.

Here are the finalists:

Best Corporate Security Blog

• Veracode ZeroDay Labs (http://www.veracode.com/blog/)
• Fortinet - http://blog.fortinet.com/
• Symantec Connect (http://www.symantec.com/connect/)
• Gunter Ollmann/Damballa Research http://blog.damballa.com/
• Arbor Networks http://asert.arbornetworks.com/

Best Security podcast

• Pauldotcom http://www.pauldotcom.com/
• Southern Fried Security http://www.southernfriedsecurity.com/
• CERTS Podcast Series http://www.cert.org/podcast/
• The Silver Bullet Security Podcast http://www.cigital.com/silverbullet/

Most educational security blog

• Jeremiah Grossman (http://jeremiahgrossman.blogspot.com/)
• Chris Hoff – Rational Survivability (http://www.rationalsurvivability.com/blog/)
• Jon Oltsik, Enterprise Strategy Group http://www.enterprisestrategygroup.com/category/our-team/analysts/jon-oltsik/
• Naked Security/Sophos http://nakedsecurity.sophos.com/
• Evil Bytes /John Sawyer http://www.darkreading.com/blog/archives/evil-bytes/index.html

Most entertaining security blog

• Naked Security  http://nakedsecurity.sophos.com/
• View from the Bunker  http://viewfromthebunker.com/
• Uncommon Sense Security/Jack Daniels http://blog.uncommonsensesecurity.com/
• Securosis Blog/Insights/ Mike Rothman http://securosis.com/blog

Security Blog that best represents the industry

• Threat Post http://www.threatpost.com
• Krebs on Security http://www.krebsonsecurity.com
• CSO Online Blog http://blogs.csoonline.com/
• Threat Level (Wired) http://blogs.csoonline.com/
• Schneier On Security http://www.schneier.com/

The single best security blog post of the year

• The Death of Security as We Know It (http://techbuddha.wordpress.com/2010/11/16/2011-the-death-of-security-as-we-know-it-or-operationalizing-security/)
• CyberSecurity and National Policy by Dan Geer (http://www.harvardnsj.com/2010/04/cybersecurity-and-national-policy/)
• Ralph Langner, Langner Communications series on Stuxnet http://www.langner.com/en/2010/12/09/our-stuxnet-timeline/
• “SecurityBSides Turned Me into an Adult” by Michelle Klinger, from her Fear Not the Assessor bloghttp://topheavysecurity.com/2010/12/13/securitybsides-turned-me-into-an-adult/
• Brian Krebs (krebsonsecurity) Sept. 30, 2010 “U.S. charges 37 alleged money mules” http://krebsonsecurity.com/2010/09/u-s-charges-37-alleged-money-mules/
• “How to Become an Information Security Thought Leader by Chris Eng  http://www.xtranormal.com/watch/7897173)

This may be our strongest slate of finalists ever. Every single nominee is a strong contender. I am sure the races will be close, so every vote counts.  Don’t wait vote now!

Related articles

• Security Blogger Network Social Security Awards Voting has Begun! (securityheavy.com)
• And the winners are .. (ashimmy.com)
• Mike Rothman of Securosis on Dell buying Secureworks (securecloudreview.com)
• Social Security Awards (andyitguy.com)

Mike Rothman and Ashimmy on Dell-Secureworks and more

Mike Rothman has been appearing as a guest on my podcast for 5 years or so now. It is always a pleasure to have him on.  To kick off the new year Mike weighs in on the Dell-Secureworks deal.  Who would have though Mike would have something to say about it?  Of course Mike has something to say on just about everything, but it is always fun and interesting.

Besides the Dell deal, Mike and I talk about security incidents and brand damage in reply to an article George Hulme had in Infoweek yesterday. We also touch on RSA Conference coming up in about a month and what Mike and the rest of the Securosis team will be doing there.

One place they will be is at the Security Blogger Meet up where the Social Security Blogger Awards will be handed out. Mike is a nominee for most entertaining security blog for his weekly incites. If you haven’t already voted, head over to this link and vote!

In the meantime enjoy the podcast!

Related articles

• Friday Summary: January 7, 2011 (securosis.com)
• HP(en!s) Envy: Dell Buys SecureWorks (securosis.com)
• Thoughts on Dell-Secureworks deal, it's all good, but SaaS it isn't (alertlogic.com)
• Dell Buys SecureWorks Primetime for MSSPs or Catch up to IBM and HP? (ashimmy.com)

And the winners are …..

It is that time of year again! Starting today voting is open for the 3rd annual Social Security Blogger Awards.  You can vote at http://www.zoomerang.com/Survey/WEB22BQFS9A3BN/. Be warned that you must leave a verifiable email and blog address in order for your vote to count. Of course the winners will be announced at the Security Bloggers Meet up at the RSA Conference next month.

Before I announce the finalists, I want to give a special thanks to our all star panel of celebrity judges:

1. Bill Brenner of CSOOnline

2. Ellen Messmer of Network World

3. Kelly Jackson-Higgins of Dark Reading

4. Larry Walsh of Channelnomics

Without further delay I am very pleased to announce the finalists for the 3rd Annual Social Security Blogger Awards:

Best Corporate Security Blog

• Veracode ZeroDay Labs (http://www.veracode.com/blog/)
• Fortinet - http://blog.fortinet.com/
• Symantec Connect (http://www.symantec.com/connect/)
• Gunter Ollmann/Damballa Research http://blog.damballa.com/ 
• Arbor Networks http://asert.arbornetworks.com/

Best Security podcast 

• Pauldotcom http://www.pauldotcom.com/ 
• Southern Fried Security http://www.southernfriedsecurity.com/ 
• CERTS Podcast Series http://www.cert.org/podcast/ 
• The Silver Bullet Security Podcast http://www.cigital.com/silverbullet/

Most educational security blog

• Jeremiah Grossman (http://jeremiahgrossman.blogspot.com/)
• Chris Hoff – Rational Survivability (http://www.rationalsurvivability.com/blog/)
• Jon Oltsik, Enterprise Strategy Group http://www.enterprisestrategygroup.com/category/our-team/analysts/jon-oltsik/ 
• Naked Security/Sophos http://nakedsecurity.sophos.com/ 
• Evil Bytes /John Sawyer http://www.darkreading.com/blog/archives/evil-bytes/index.html

Most entertaining security blog 

• Naked Security  http://nakedsecurity.sophos.com/
• View from the Bunker  http://viewfromthebunker.com/
• Uncommon Sense Security/Jack Daniels http://blog.uncommonsensesecurity.com/
• Securosis Blog/Insights/ Mike Rothman http://securosis.com/blog

Security Blog that best represents the industry

• Threat Post http://www.threatpost.com
• Krebs on Security http://www.krebsonsecurity.com
• CSO Online Blog http://blogs.csoonline.com/
• Threat Level (Wired) http://blogs.csoonline.com/ 
• Schneier On Security http://www.schneier.com/

The single best security blog post of the year

• The Death of Security as We Know It (http://techbuddha.wordpress.com/2010/11/16/2011-the-death-of-security-as-we-know-it-or-operationalizing-security/)
• CyberSecurity and National Policy by Dan Geer (http://www.harvardnsj.com/2010/04/cybersecurity-and-national-policy/)
• Ralph Langner, Langner Communications series on Stuxnet http://www.langner.com/en/2010/12/09/our-stuxnet-timeline/ 
• “SecurityBSides Turned Me into an Adult” by Michelle Klinger, from her Fear Not the Assessor blog http://topheavysecurity.com/2010/12/13/securitybsides-turned-me-into-an-adult/ 
• Brian Krebs (krebsonsecurity) Sept. 30, 2010 “U.S. charges 37 alleged money mules” http://krebsonsecurity.com/2010/09/u-s-charges-37-alleged-money-mules/ 
• “How to Become an Information Security Thought Leader by Chris Eng  http://www.xtranormal.com/watch/7897173)

Every single one of these blogs is already a winner having been selected by our blue ribbon panel of judges. Voting closes at the end of the month, so please don’t wait to vote!

Is Small The New Small?

Years ago (2006) my friend Mike Rothman wrote a piece called “Big is the New Small”. Of course others with even bigger mouthpieces than Mike (hard to believe I know), have also said similar things over the years.

In case you are not familiar, the basic tenants of Mike’s position were that innovation doesn’t only happen at the small company anymore.  That customers are willing to sacrifice a little innovation and even not go with a best-of-breed product in order to have “one throat to choke”. That the problems confronting us were beyond the scope of anyone not big to tackle. The small player did not have the resources to get it done. That the small start up will fade away or if they are any good be gobbled up by the Bigs.

Lets be fair. At the time Mike said this, I didn’t agree with him. Orthodox thinking said that companies would appreciate the better service, nimbler character and frankly better product that a small dedicated team could provide rather than Mr Big. I countered and so went one of the better blog wars I had with the “mouth of the south”.  Ah, the good, old golden days of security blogging. I just don’t fight with Mike as much anymore. But I digress.

My thought on “big is the new small”, is that this too shall pass. As I have gotten older, I have observed that so much of this kind of thing is like a pendulum swinging.  Outsourcing vs inhouse, big vs small, Republican vs Democrat – the haves versus the have nots.

So now it seems that perhaps the worm is turning on the big versus small issue. I was reading an article in Yahoo news from the AP this weekend. The article said that some are questioning the shopping spree that big tech vendors have been on. In the last three years over 350billion has been spent on tech M&A.

Here are some comments from new big customers from the article:

"The demand is not coming from the customers," says Gopal Khanna, who oversees a $600 million technology budget as chief information officer for the state of Minnesota. "On the contrary, I'm best served when there's a phenomenal amount of innovation happening. ... Sometimes creating behemoths slows down that innovation engine."

Larry Bonfante, chief information officer of the United States Tennis Association, started battling recently with one of his suppliers, which supports USTA's computer applications and runs its help desk. Bonfante won't name the company but says it was bought a year ago by a large, publicly traded company.

"Our service and our relationship with that company since then has gone absolutely into the tank," Bonfante says.

Bonfante used to be able to call the supplier's CEO with problems. After the takeover, Bonfante's contact became a lower-level staffer, and USTA employees had trouble getting their questions answered. Bonfante says he's dumped suppliers three or four times in his nearly 30-year technology career because their service suffered after an acquisition, and he has considered jettisoning this supplier too. Service improved after he put the company on notice, but he says he's still watching the situation closely.

"When the smaller guys are gobbled up by bigger guys, in theory it's supposed to be better, but in our experience it's been worse," he says. "It's certainly not something that I'm really excited about. It has the potential to be a positive experience, but my experience has told me that more times than not, it's problematic."

Rob Ewing, senior vice president of systems and technology for InterCall, which sells conference-call services, says his company stopped buying new licenses from a provider of database software just six months after it was acquired. The main problem: The support staff was cut.

"Resolutions to issues went from less than a day to more than a week," Ewing says. "It was very frustrating."

 

Doesn’t sound like Big is the New Small is working for these guys.

A professor at MIT on technology mergers says,

"When technology companies merge, you often have a two plus two equals three equation," says Michael Cusumano, a professor at the Massachusetts Institute of Technology's Sloan School of Management.

Here is another quote:

"I sit here and I think: What mergers have really benefited everybody, both the companies and the customers? And there aren't a whole lot. There are a lot more that go bad than are successful," says Rosen, a former president of Share Inc., an organization of IBM customers. "I have never seen a merger that saves the customer money."

For me what really hit the nail though was the Verisign numbers. They spent 20 billion of shareholder money and sold most of that back for less than 1 billion.

So it would seem to me that Big is not working out for the customers. It is not working out for the shareholders. It certainly works out for the few employees who get to cash in from small to big, but the majority don’t.

So remind me again, what is the advantage of Big being the new small?  Have people started coming to their senses about small companies and remembered the value they bring?  Is it time to take that simple black dress out of the closet, because small is the small?

Related articles by Zemanta

• Tech Customers Question Industry's Takeover Spree (huffingtonpost.com)
• Tech customers question industry's takeover spree (sfgate.com)
• Tech customers question industry's takeover spree (seattletimes.nwsource.com)

Envelope please, and the winners are . . .

OK for the first time in public, here are the finalists for the 2010 Social Security Blogger Awards! The finalists were chosen by our blue ribbon panel of judges (Mike Fratton, Bill Brenner, Kelly Jackson-Higgins and Larry Walsh). The members of the Security Bloggers Network will be recieving ballots shortly with the names of the finalists and they will cast the deciding votes for who this years lucky winners are. So without further delay, the finalists are:

 

Best Technical Security Blog

SANS Internet Storm Center

Evil Bytes by John Sawyer

Praetorian Prefect

Darknet.org

Frequency X ISS blog

Best Non-Technical Security Blog

Security Uncorked

Schneier on Security

Krebs on Security

ThreatPost

TaoSecurity

Best Security Podcast

PaulDotCom

SANS ISC Stormcast

An Information Security Place

CSO Security Insights

Security Catalyst

Best Corporate Security Blog

JEREMIAH GROSSMAN (White Hat Security)

SOPHOS GRAHAM CLULEY BLOG

MICROSOFT SECURITY RESPONSE CENTER

FORTIGUARD BLOG

CISCO SECURITY BLOG

Most Entertaining Security Blog

Rational Survivability by Chris Hoff

Security Incite by Mike Rothman

Uncommon Sense Security by Jack Daniel

SecBarbie by Erin Jacobs

Emergent Chaos by Adam Shostack and ensemble

What an all star list of finalists. Each and every blog and podcast on this list are deserving of winning. It is a testament to the quality and quantity of blogs that the security industry has spawned. Congratulations to each and every one of them. May the best blogs win!

I also want to point out some honorable mention blogs and podcasts that did not make the finalists because they were not eligible, though they were nominated:

Securosis Blog

Network Security Blog and Podcast

and my own Ashimmy, after all these years.

Of course the winners will be announced at the Security Bloggers Meet-up at RSA in just over a month! Good luck to the finalists and hope to see you at the meet up.

Has Cisco taken Rohati back into the fold?

This is the time of year for M&A deals.  No I am not talking about the analyst deals of the last few days (but good luck to all of the Securosis-itcs). Not sure how the Gartner-Burton Group will shake out. Is
Gartner getting into the consulting business? But here is one rumor I heard today on good authority, but am trying to get more confirmation on: Cisco has acquired Rohati.

Who is Rohati you ask? Well I originally wrote about them back in June of 2008. My friend Richard Stiennon thought that they were the greatest thing since sliced bread. Then when Tom Noonan was appointed to their board, I had a chance to have Tom on the podcast with Mitchell and I.

Rohati was founded by a bunch of ex-Cisco folks and I always felt that eventually Cisco would take them back into the fold. If my information pans out, that may be just he case. I am very curious to see if this was a move to save what Rohati had developed (see my earlier posts for that) or did Rohati fetch a nice multiple for their founders and investors. 

It would be good to see the year get off to some good acquisitions, at good multiples!  If anyone knows anything, please speak up!

Related articles by Zemanta

• Research Consolidation: Gartner Acquires Burton Group For $56M In Cash (techcrunch.com)

Grumpy's Christmas Cheer

You gotta love Mike Rothman. There is something deeply rooted there that makes him who he is.  Just as everyone is getting deep in the holiday spirit, his inner Grinch comes out and he puts out his most vitriolic column in a long time.  Me on the other hand, I think of Mike as my own personal GI Joe. I dress him up with whatever hats and costumes I can find.  Here since he is the anti-thesis of the Christmas spirit, Mike dons a Santa hat.  Mike should just be lucky I don’t have any full length body shots of him otherwise he would really be in trouble!

Anyway, what has Mike so grumpy (besides canned muzak Christmas music that is). Well first it seems that its one thing to have to be drowned in end of year “what’s going to be big next year” predictions. It is quite another thing when those predictions suck.  Frankly, I don’t blame him. I have just shut down any page or article I have seen with that kind of blather.  It is far more fun to look at last years predictions and realize how wrong they were.  But Mike, if I am not mistaken, I have seen you make your share of predictions as well. And for the record not all of them were so good.

Next he takes a totally unprovoked swipe (well not a swipe, more like a left hook) at Dan Kaminsky.  Yeah, Dan is full of himself a bit, but he is pretty defenseless in this case.  I know your Mom taught you better then to pick on people.  While we are on the topic of picking on people, Mike also pokes Santa (that’s Michael Santarcangelo, not the guy up in the North Pole) for having a mobile home and wanting IT folks to develop a culture of compliance (for the record I thought it was a bad idea too. The culture of compliance, not the mobile home). 

Mike also goes after the Cisco blogger on Network World. OK, I will give him that. I don’t like that guy either. Next Imperva gets Mike’s Captain Obvious award and Russ Cooper is accused of skipping the egg nog and going straight to the heroin.

Mike finishes on a bright note though. He loves the idea that NSS kicked some IPS vendors in the nuts in their report (so did I) but can’t help himself by taking a swipe at Kevin Tolly and Tolly reports. (Mike I have done this before, expect a note from Kevin asking you to substantiate what exactly you mean there)

Then Grumpy has the balls to tell us to take note of how much we are working during this great holiday season, acknowledge our problems and take a bit of a rest getting ready for 2010?

Mike if you are going caroling next year, I would love to go with you. I can’t carry a tune, but afterwards we could pig out on the Chinese food!  Get in the spirit man!!

Is Vigilar done?

Rumors on Twitter today about Atlanta based security firm Vigilar closing its doors.  I tried to confirm but found out nothing determinative one way or another. It looks like nothing has been updated on the web site since this summer.  A call to the company line was answered by the telephone system, but I received the same voice mail message from the PR contact whether I hit the sales extension, PR or service.  Not a good sign for sure.  Usually the sales line will always pick up at most companies.

Anyway, I know AndyIT Guy and Mike Rothman are down that way.  Maybe they can find out what the story is. 

Authors Update: I just received a message from “deep throat” that the Vigilar marketing rep has been soliciting recommendations on LinkedIn. Usually indicative of something going on.  Again, just another brick in the wall, but not definitive.

Authors Update 2: I just had another contact tell me he is a creditor of Vigilar and received a bizarre email that they have shut down the VAR business due to an acquisition falling through. He further reports that all of the VAR/Services people have been laid off.

Usually where there is smoke there is fire.

An Incite-ful Tuesday: Playing catch up

It happens to me every year at this time. I want to enjoy the holidays with the kids. Friends are having parties, lines are long at the stores and it seems like I can never get to everything on my list.  On top of this I am hard at work putting everything together for the new venture. I almost forgot what its like to get the website together, power points, business cards and the thousand other little things in that make it real.  Luckily I have some great folks I am working with and I don’t have to carry the load myself. In the meantime I have like 6 or 7 tabs open on the browser (in Chrome as I am really liking it better than Firefox right now) on topics I want to comment on. So will do a Rothman and lump them together here.

Anyway, I am sure you are all busy with your holiday plans and activities as well.  It may seem like nothing ever gets finished and there is always so much more to do. But take a moment, look around and realize what the season is all about. Be grateful for what you have, it is probably more than most in this world have. Enjoy!

1. US, Russia and UN in SALT-START treaty negotiations on limiting cyberwarfare.  I am old to enough to remember first President Nixon and then many others signing treaties with the former Soviet Union limiting the number of nuclear missiles we had aimed at each other.  I remember always thinking phew, now each side only has enough to destroy the world 20, 10 or even 5 times over.  But bothering me was the fact that it would only take one time to destroy the world. I still remember shelter drills where we would have to either crouch down under our desks or go into the school basement in case we were attacked.  Like hiding under one of those crappy little desks at school was going to save us from a nuclear holocaust! Anyway, I was reminded of all this reading an article in the NY Times detailing that the US has joined the rest of the world, but especially Russia in discussing limiting cyberwar weapons.  My only question is you can supposedly count missiles, how are going to count logic bombs? But I am sure there are smart people working on all of this and will be watching what comes out of it.

2. Security is a people thing! One of the lessons I have certainly learned about security is that you can have the greatest technology in the world. You can have the latest new security gizmos and appliances, layered in one after the next. But if you don’t have the right people in place, empowered with the resources and authority they require, it just don’t mean a thing. Max Huang, CEO of O2Security says the same thing in this opinion piece over at SC Magazine. Good to see a vendor guy coming to the same conclusions.

3. NAC market shrinks to 37m in Q3. Jeff Wilson and his band of Infonetics have put out a new NAC report which I wrote about earlier. In this article in TMC Net they use Jeff’s numbers to report that the NAC market actually shrunk to about 37m last quarter. Of course you need to know what they define as the NAC market. Is it just appliances, is supporting gear included or agents? I think he is talking just appliances. In any event, I think that is widely optimistic. But even giving Jeff the benefit of the doubt, it pales in comparison to the wild numbers that were tossed around a few years ago by the analyst community on where NAC would be now.  But hey they weren’t the only ones wrong about NAC ;-)

4. Raising the barriers to resell your products – FAIL. I never understood this strategy. WatchGuard announced a new MSSP partner program in this report on the MSP mentor. Nothing special really, they are packaging the on premises appliances and remote management to the MSP partners to offer a turn key managed service for them to go to market with. Fortinet and others do the same thing.  But what Watchguard is saying is their special sauce is “is their 4-part certification process to become a partner, according to Chris McKie, director, global analysis and public relations, WatchGuard.” They are going to make partners go through 2 levels of technical certification. There sales teams have to be of a certain size and quality and WatchGuard’s support team has to approve the partner as well. 

I understand raising the bar and having skin in the game. But if you make it too hard for people to resell your products, guess what? That’s right, they won’t resell your products. I am not advocating that you have a Cisco situation with resellers cutting each others throats for a point or two, but when you are WatchGuard I would think you want to broaden the channel.

Anyway, that is it for today. I have a podcast scheduled for tonight with Mitchell and whole list of other stuff I have to get on to. Have a great day!