The Ashimmy Blog

Security Roundtable, Episode 6

Recently I was on a Security Roundtable discussion around instant messaging.  The SRT team on the podcast were:  Larry Pesce of Pauldotcom, Martin McKeay of Network Security Blog and Podcast and myself.  Our IM expert who appeared on short notice and for which we were all very grateful is Krishna Kurapati, CTO of Sipera Systems.  Some real world, good stuff on IM security and support if you are interested.  You can get the podcast here.  Enjoy!

Security Roundtable Podcast #5

The Security Roundtable, that crazy bunch of security/podcasting guys that I am lucky enough to be part of, has just posted episode #5.  For this one, our special guest was Dan York of the VOIPSA and the Blue Box podcast.  We all got a good lesson on VOIP security.  Definitley take a listen.  You can get it here.

Besides Dan, the Round Table members on the panel for this one were:

Paul Asadorian | Pauldotcom Security Weekly

Martin McKeay | Network Security Podcast

Larry Pesce | Pauldotcom Security Weekly

Michael Santarcangelo | The Security Catalyst

Alan Shimel | SSAATY (Still Secure After All These Years)

I love doing these round tables and hope you have as much fun listening to them

The Knock on NAC

As those who read my blog regularly know, I have been involved in a bit of a debate with Mike Rothman, Richard Stiennon and Chris Hoff over NAC and Secure Network Fabric.  The back and forth led Martin McKeay to put together a podcast with all of us to discuss this matter civilly (for the most part).  We all agreed to post this under the Security Roundtable as a neutral site.  It has now been posted and you can listen for yourselves here.  Though we all got our shots in, I am not sure if we drew any conclusions or if there were any knockouts. We did surprisingly agree on somethings though, which shows there is hope yet for peace in the world.  Please have a listen and let me know your thoughts.  I also have a one question poll on NAC on the right sidebar of my blog. Please take the time to answer!  If we get enough response, we may have a part 2 to this discussion.

The great equalizer

As I have mentioned earlier, tomorrow night I am taking part in a skypecast with Richard Stiennon, Mike Rothman, Martin McKeay and Chris Hoff on the merits of NAC and something Richard calls Secure Network Fabric.  Martin is playing referee and we will be hosting it through the Security Roundtable.  If you are interested in chiming in, I think you can, by joining our Skypecast. It is scheduled at 8:30 PM East Coast time. If not, I am sure we will post it via the Security Roundtable within a few days for you to listen to.  It should be really fun. 

As I was telling Mitchell Ashley yesterday, the fact that we are even having this podcast and discussion is really a testament to the power of the Internet, blogging, etc.  Mike Rothman has an article today about how research is different today that it was 8 or 10 years ago.  Mike talks about the availability and depth of information available via the net and blogs.  He is dead on, however there is another angle to this.  Eight or ten years ago, as a vendor, I would hire a PR agency to help my firm deal with the analyst community.  We would pay money and try to curry favor with them, trying to keep them current and briefed on what we are doing (actually that is pretty much what we do with some of the analyst dinosaurs now).  However, thanks to the power of the written and spoken word via blogs, podcasts and the net, I have the ability on equal footing to put my views out there side-by-side with respected and experienced analysts like Richard and Mike. I interact with folks like Mike and Richard, as well as countless other security folks on an almost daily basis.  Instead of privately briefing them and then hoping they at least can see my point of view, if not agree with it, I have the chance to sit side by side with them and bring my case to you.  This would have been unimaginable a short time ago.  The power of it, is I think turning the analyst game on its ear.  A new breed of analyst like Mike and Richard are filling this vacuum. It is also changing how users, customers and the media get their information and spin on security strategy and technology.  I am honored and lucky to be part of it and am glad I am using it to my advantage, I hope.  See you all tomorrow night!

65 in 1

I missed this one a few days ago, but thought it ludicrous enough to mention anyway.  Oracle just released their quarterly update patch.  Looks like a lucky thing they did, seems it takes care of 65 discovered vulnerabilities, some 23 or so critical.  I wonder what Martin McKeay and my friends on the Security Roundtable would say about this.  Funny, I don't see anybody jumping up and down like they do when Microsoft puts out a patch.  Take 3 months worth of Patch Tuesdays, and you have just about the same amount of patches here.  Anybody want to tell me that Microsoft's record on these are worse than the rest of the industry?  Here is another thing I don't understand, with all of the critical data kept in Oracle databases, why aren't their customers demanding better written software and more frequent updates. Quarterly updates is just not responsible or reasonable in today's atmosphere.  This type of response I think screams for more public disclosure by people finding these holes.