The Ashimmy Blog

XO To Offer StillSecure MSSP Suite

In what is probably the last BD/relationship deal that I started while at StillSecure, XO Communications and StillSecure announced today an agreement for XO to offer the StillSecure managed services suite to its customer base.

The folks at XO have built a great business that stretches back to the dotcom days.  I remember back in those days working with Concentric Networks, which became XO. Now all these years later I was happy to do another deal with them.

But let me be clear I only got this deal started. There was lots of hard work on both sides to get this done. Steve Harris and Larry Middle have worked diligently all of these months and even years to get the deal done on the StillSecure side. Way to stay with it guys.

In typical business development experience, now comes the hard part. Translating this partnership into success in the field. With XO’s presence in the Fed space and StillSecure’s Federal focus there should be some fertile ground to gather some wins. But XO serves a large customer base and their need for security could the driver for this.

I continue to believe that SaaS and managed services is the future of security, especially in the SMB and mid-market.  This deal, the recent Dell-Secureworks deal and the overall health of the SaaS and MSSP market bear it out.

I wish both companies much success with this deal and will be watching to see how it fares in the market.

To StillSecure – Goodbye and good luck

I have not blogged for a few weeks now. When last I left you all I was in NYC reminiscing about returning home to the city.  The following week I celebrated my birthday.  On reflection I realized that this was the beginning of the 9th year of my life that I had given to making StillSecure a success.  In this day in age, 8 or 9 years at the same job or company is almost unheard of. After much soul searching I came to the conclusion that for the next decade of my life it was time to do something different.  So after speaking with board members and Raj Bhargava, StillSecure CEO, I am leaving StillSecure effective today.

I have had the chance to meet lots of people, do lots of different things and really play a meaningful role in building this company. For that I am very grateful.  The experience, the friendships and the memories will last me a lifetime.  But all good things come to an end and it is time for me to find the next adventure in my life.  I wish all of my friends at StillSecure good bye and good luck as they continue to to make StillSecure a great company.

What am I going to do next?  I honestly don’t know.  I am going to take a few weeks to spend time with my wife and sons (whom I have been too often away from over all these years).  I am going to clear my head and see what opportunities are out there. 

In the meantime I will continue blogging as I have in the past. Now no one can accuse me of being a “vendor puke” and I hope I can be objective. I am going to change the name of the blog to “the ashimmy blog” and the domain http://www.ashimmy.com already should work.  I will be redesigning as well over the coming weeks.  I also want to spend more time making the security bloggers network site more of a destination and resource for the security blogging community.

You can reach me at ashimmy (at) hotmail. com if you would like or of course leave a comment.

I hope you will all continue to find the blog as entertaining and useful as you have in the past.

thanks

Alan

SSAATTY Podcast: Mirror Pond - The best Safe Access NAC ever!

This is a special edition of the StillSecure, After all these years podcast. I am joined by John Curry, director of customer security at StillSecure to discuss the latest, greatest version of StillSecure's Safe Access NAC product code named Mirror Pond.  Mirror Pond has won rave reviews from customers, media and engineers alike.  John tells why and what you can do with Mirror Pond.

WARNING: Listening to this podcast could change your attitude on how, when and why you should use a NAC solution. Listen at your own risk.

If you have any questions about the podcast, please write to podcast@stillsecure.com. If you have any questions about Mirror Pond, NAC or other StillSecure products, check out the StillSecure web site.

Mirror Pond - The best Safe Access NAC release yet!

StillSecure, After All These Years Podcast

StillSecure MSSP earns Best Buy and 5 out of 5 stars!

I am happy to be able to post today some news that I have known for about a week already.  SC Magazine recently conducted a group test of MSSPs. The bake off included all of the usual suspects and some you may not be as familiar with.  They did a pretty deep dive on the offering and besides giving us an overall 5 out of 5 stars awarded StillSecure the Best Buy award in the category!

This is especially sweet because it is the first time our ProtectPoint MSSP service has actually been reviewed and it copped top spot out of the gate.  I always tell people that we liked what we saw so much in the ProtectPoint service that we bought it - lock, stock and barrel. Now over the last few months we have expanded the service offering with more and deeper solutions, as well as added some StillSecure technology.  We think it is a great MSSP offering and I guess the SC Magazine staff did too.

Of course we are not done yet. Look for even more offerings and solutions in our MSSP group soon. In the meantime congratulations to Steve Harris and the whole team who are on the job 24x7x365 making StillSecure’s MSSP service the best it can be!

StillSecure comes to Facebook

Image via CrunchBase

So perhaps just a bit late to the party we have opened a StillSecure page on Facebook. Now as if I don’t have enough to do I have to try keep some good content up there.  Not 100% sure what kind of content to place there but am going to give it a try and see. I would be interested in what you think a company’s facebook page should have.  Leave a comment and let me know.  Also visit the page and become fan if you like. You can comment there as well.

A busy Monday in the security-sphere

You can tell that Summer is starting to wind down (how did that happen, it was just the 4th of July). Today’s news was full of stuff that bear watching.  Watching the news as closely as I do it is easy to to see the rhythms and currents in the quality and quantity of the news.  Like the bears smelling the first snow of the season as a signal to hibernate, the pace of developments is telling me that we are heading into the back from vacation, lets get busy time of year.  So hope your vacations were fun, but better buckle down and get busy!

1. Fortinet to test the IPO waters. President Obama says the worst is behind us and the markets have been picking up.  Sounds like a great time to try a security based company IPO? Maybe not. The last few have not exactly blown the doors off of anyone, but maybe this time will be different. Fortinet certainly has the revenue to justify it, though I don’t think a 7.4 million profit on revenue over 200 million in 2008 is a great margin. Of course the question is what does 2009 look like for them. Has the recession hit them hard? Have the continued to grow? In any event, this may nudge along other less qualified security and technology companies to put their toes in the IPO waters. With valuations in money raising and M&A so low, something has to give to change the equations.  Good luck to the folks at Fortinet!
2. Marrying NAC to IPS? Why didn’t I think of that? Wait a second I did! Sourcefire and Bradford put out a press release detailing integration between Sourcefire’s IPS and 3D system and the Bradford NAC product. Funny I remember Bradford announcing this same functionality a year or two ago with Snort and then Top Layer and then Nitro. I don’t know this sounds too much like a me too Barney release for my tastes. But Bradford has been silent for a while, so I guess this means they are still in business.  The functionality addressed is actually very similar to how StillSecure’s Safe Access NAC product works with our Strata Guard IDS/IPS system. Safe Access can use Strata Guard as a dedicated post-connect NAC sensor or as a stand alone IDS/IPS with added functionality. StillSecure has been offering this type of functionality for years already, as has Bradford for that matter. This would have been a good announcement in 2007 but today, not so much guys.
3. Lifetime warranties, the new black in networking gear – Extreme Networks announced this a while back but just came across this article in AMEInfo detailing it. Extreme now joins HP ProCurve and Cisco is offering some type of lifetime warranty.  HP ProCurve started this trend but it looks like it is becoming the de facto standard in the network gear space.  I think it is great if there is not a lot fine print that renders them useless.
4. Seeding the clouds? Terremark which is supposed to be growing pretty rapidly (at least my friend Pete Nicoletti says so), reported a run rate of 2.5 million dollars a year in this article on MSPMentor. While more than 2 million dollars is a lot of money (I could use that right now), as an indicator of big things to come, it just doesn’t get my juices flowing.  I would expect more revenue from cloud services than that. Hell, I would like to see more from cloud security alone than that.  BTW, I am doing a podcast on cloud services and cloud security very soon, so stay tuned!

Anyway that is all I have for today.  Have a great day!

Is StillSecure really secure? You betcha!

This is in response to a blog from a William Lee blog article the other day. I don’t know William and I am sure he has the best of intentions. Anyway William wanted to see if our Strata Guard Lite product really worked. He tried to set it up on a virtual machine on Windows and ran some Metasploit exploits at it. He claims that Strata Guard didn’t even see the attack and let it through.

When I first read William’'s post the other day a few things jumped right out at me that screamed here is a mistake waiting to happen.

1. He was running a 3 way VM set up with virtual switching. While that in and of itself is not indicative of a trouble, if you don’t know the finer points of this, it could be trouble. Also running virtual desktops is a lot different then virtual servers. If William made any configuration mistakes, it would prevent Strata Guard from seeing the traffic.

2. He boasts about turning all 6000+ rules onto block. That doesn’t sound like a very experienced IDS/IPS strategy.

Anyway, I didn’t want to jump to conclusions. I asked our security engineers to have a look.  I am happy to report that recreating William’s set up, Strata Guard can of course detect the exploit William references. In fact there is something like 49 rules dealing with that particular exploit.  The problem is in the VM set up.  William does not have SG seeing the traffic! So in answer to William’s question: Is StillSecure really secure? Set up right and you tell me.

NAC is about getting people on the network, not off

Today StillSecure announced something that I have wanted for a long time.  Our Safe Access NAC product can now use WSUS to remediate non-compliant endpoints. Prior to this it was possible to use WSUS but it was much more of a custom job. We have had integration with MS SMS for a long time and from time to time have worked with many of the patch mangers out there. But WSUS is the most widely used of any patch solution out there. It should make life much easier for users whose devices are not compliant.

For too long people have emphasized NAC’s ability to quarantine and remove non-compliant devices from the network. But that in my mind is a red herring.  Unless it is a rogue user or something like that, keeping them off the network is not productive to anyone.  NAC should be about making sure they are compliant. If they are not, make them compliant and get them on their way. Don’t throw them off the network, that doesn’t do anyone any good.

There have been various ways of doing this with NAC. Some solutions have sort to have their own file push capability built in. The problem is that being a NAC solution is hard enough. So is being a patch manager.  Being both is a recipe for disaster. You wind up doing neither well. You can work with patch managers, but which ones? With SMS and now WSUS we are guaranteed to work with the widest number of devices out there.

Related articles by Zemanta

• NAC incite March 3 2009 (stillsecureafteralltheseyears.com)
• Dude, that is not a managed NAC service (stillsecureafteralltheseyears.com)

You can check out, but you can never leave

Just wanted to give a quick shout out to Joe Webster, a security bloggers network member and until recently a great resource at StillSecure.  Joe just left StillSecure to pursue a tremendous career opportunity that he could not pass up. He wrote about why he left and his time and impressions of StillSecure here on his blog.

During his time here at StillSecure, Joe has been a great resource and team member in making Safe Access a best-in-class NAC product. He has also become part of the family partaking in and leading many social activities.  We are all saddened to see Joe leave the fold, but wish him the very best in his new gig.

Managed Vulnerability Management

Is that one management too many?  Yesterday StillSecure announced that we were rolling out a managed vulnerability management service based around our VAM vulnerability management product.  Why a managed vulnerability service versus the SaaS model that is all the rage? Simple, for a large percentage of our target customers just having a vulnerability scanner and server hosted is not enough! They need help through the whole lifecycle of vulnerability management.  They need help in determining what assets to scan - why, what, when, how to scan.  What do to do with the results and most importantly they need help to asses their risk and take appropriate steps.  Traditional vulnerability management products and SaaS solutions just don’t do it for them.

On the other end of the spectrum security consultants can come in and give a picture in time assessment.  However because they are generally one time scans they lack the continuity to give a complete vulnerability lifecycle perspective. So we think the idea of a managed vulnerability management service is one whose time has come! Lets see what the market says.