The Ashimmy Blog

NASA - It’s a science thing

I was reading my friend Bill Brenner’s Salted Hash blog today on the disclosures of vulnerabilities in the NASA systems that could have endangered the space shuttle missions.

Bill remembers having discussions with a NASA official years ago that set off red flags with him regarding policies and processes (or rather the lack of them) on the NASA network.

I also had a chance to speak with folks from NASA a few years back. Actually I was not interviewing them for a press opp, but instead was looking at potential security business for StillSecure.  Also back then I spent a lot of time speaking to folks at the DOE Labs like Los Alamos and some of the people from DOI and US Geological Survey.

All of these folks had somewhat of a common view towards information security and data security. They viewed themselves and what they do as scientists doing science.  In their mind science is best done by sharing.  Therefore the idea of “locking up” the data and making it hard for people to access was anathema to them.

If they think the whole idea of restricting access to the data is wrong, you can imagine how they feel about security. Why do they need it? They want people to be able to share and help advance the science.

While it is a noble view and I understand how they feel, obviously it does not take into account how some people in the world operate.  The folks from NASA would never think that someone would actually want to blow up a shuttle.  The USGS wants everyone to see the data from the seismic monitors they have on the bottom of the ocean. The scientists at Los Alamos, well lets leave that alone for now.

So I am not surprised to hear about NASA’s vulnerabilities either. It is a cultural thing in an agency with a scientific culture.  It is up to the security folks there though to put the controls in place that will keep it all safe or science be damned.

Related articles

• Houston, We Have a Problem: Critical NASA Systems Vulnerable (pcworld.com)
• Security fails could put NASA missions at risk (zdnet.com)
• NASA spacecraft vulnerable to cyber-attack (blogs.nature.com)

Shimel’s Inciteful Thursday

So despite his promises to the contrary, my bud Mike Rothman has been a blogging MIA pretty much since RSA. Hey I am sure he has a good reason, like some journey for self-awareness or something that is keeping him away.  Not even a Social Security Blogger award could get his juices flowing again.  So in Mike’s absence I am going to do another in my incite series with a bunch of short stories and even shorter commentaries.

Truth be told, I had too many things to write about today, so I blamed it on Rothman!

Have a great day.

1. InfoExpress does a press release on managed NAC – Last night I banged on InfoExpress for claiming a managed NAC service as reported by Tim Greene. It just didn’t sound like a managed service to me.  Well not sure if Tim jumped the gun or not, but today IE put out a press release on their service (though they still have nothing about it on the web site). To be fair the press release talks about more management of NAC than Tim’s article did.  But here is a bit of advice for the InfoExpress PR team: If you are going to have customer quotes in a press release, it may be worthwhile giving their name and title.  Just having quotes attributed to anonymous customers is a bit unbelievable. Something I would expect from NAC used car salesmen.

2. Mystery Virus plagues FBI and US Marshalls – It seems that a mystery computer virus (no not swine related) has hit both the non-classified FBI network and the US Marshalls network.  The FBI had to take down their network from the Internet, but it has now been reconnected. The US Marshalls service reportedly had 140 machines hit with the virus. They had to be taken down and are being disinfected as you read this.  I don’t have any more information on this, but there are rumors of a one-armed man being seen in the vicinity.  Where is Tommy Lee Jones when you need him?

3. Microsoft puts the heat on security vendors – Looks like my friend Charlotte Dunlap has herself a regular gig over at Forbes writing an infosecurity column sponsored by Juniper.  This time Charlotte writes about Microsoft rolling out a hosted email security solution as part of Stirling-Forefront. Charlotte is right on when she says that Microsoft clearly has Symantec and McAfee in their sights with Forefront.  I have written about this before as well. Go ahead and make fun all you want, Microsoft is serious about this and will keep at it till they get it right.  Of course I love the fact that they are partnering with forward looking security vendors (like StillSecure) and think there is a real opportunity to shake up the security world here.

4. How much work can you do on an iPhone?  Earlier this week I wrote about an iPhone being a Prius to Blackberry being Pinto (hey not my words, but some other author). In continuation of that story, Galen Gruman writes about using an iPhone instead of a laptop for a few weeks. I don’t know but I find it near impossible to write more than a sentence or two with my iPhone. Maybe my fingers are too fat or I just don’t have good hand to eye coordination, but I find it painful compared to my old HTC Windows Mobile phone to type longer then that.

Anyway, that is a wrap on this incite.  Good day to you Mike Rothman, no matter where you are!

Good Night, and Good Luck

It was with great sadness that I read the end of Tim Greene’s NAC column today. Tim tells us that he is ending the NAC column and newsletter and transitioning to cloud security (that should make Hoff and Amrit happy).  While I don’t always agree with what Tim writes about NAC, he has been a consistent voice and great advocate for the technology.  The NAC industry will miss the spotlight he shined on it.  I am sure he will do a bang up job on cloud security and wish him well.

The following quote from Good Night, and Good Luck movie is by Edward R. Murrow about TV, but in many ways it could be said about NAC and Tim’s column:

To those who say people wouldn't look; they wouldn't be interested; they're too complacent, indifferent and insulated, I can only reply: There is, in one reporter's opinion, considerable evidence against that contention. But even if they are right, what have they got to lose? Because if they are right, and this instrument is good for nothing but to entertain, amuse and insulate, then the tube is flickering now and we will soon see that the whole struggle is lost. This instrument can teach, it can illuminate; yes, and it can even inspire. But it can do so only to the extent that humans are determined to use it to those ends. Otherwise it is merely wires and lights in a box. Good night, and good luck.

Good Luck Tim!

Defending the caveman, Tim Greene, analysts and me

Back on March 3rd I wrote a blog about an article Tim wrote about the NAC market and mentioned views of Lawrence Orans at Gartner and some folks at the 451 Group. Reading the article initially it seemed that Tim spoke to both Gartner and 451 for the article.  After the fact Tim put out a note that he had not spoken to either party and had only quoted what he read in some public blogs by the parties. 

Now it seems that some folks thought what I wrote implied that 451 Group would violate a trust or NDA type of agreement and make public information that they were not supposed to.  That is not what I meant at all. In fact all of the people I have dealt with at 451 (Paul Roberts and Nick Selby) are both stand up guys who would do no such thing.  What I was saying is that 451 digs harder then other analysts to get the details that many companies would rather not disclose. They are persistent in questioning and digging and making assumptions about what they do and don’t hear.  Many of their customers are VCs and other vendors, so many tend to be cautious in giving out information of this nature to them.  That is what I meant, not that they would do anything dishonest or violate a trust.  Hope that clears that up.

The bigger issue for me though is that blogging and other web technologies are having a profound impact on the analyst world.  The fact that my blog brought up these kinds of comments is proof of that. I think many of the older style analysts (like a Gartner) are going to find rough sledding in this brave new world.  They have to rethink how they monetize their opinions and research (if you can call it that).  But that is a blog article for another day!

Related articles by Zemanta

• Blogs are Climbing the Gartner Slope of Enlightenment (socialmediatoday.com)
• NAC incite March 3 2009 (stillsecureafteralltheseyears.com)
• We are all analysts now (derek.abdinor.co.za)

RSA is on the way! March 18, 2009

OK I got back early from California (because someone I was meeting had to be hospitalized I am afraid) so have some time to blog.  It has been tough lately, but there are lots of stories to touch on.  First of all we are in full swing for the pre-RSA season.  My calendar is already filling up with appointments while I am out in San Fran.  I will be presenting at the Americas Growth Conference again this year on the Monday before RSA.  The AGC event has become a staple over the years and in these challenging times should be even more interesting this year.  Of course there is the security bloggers meet up with planning in full swing ready to rock (SBN members get an invite). Also the SC Magazine awards dinner and event which I was invited to and will be attending.  Thursday morning I moderate an all star panel on what to do about security in this economy.   All in all, RSA is shaping up as a great time! 

While I am registered as a speaker, an exhibitor and 5 year member, I was surprised that this year to attend just the expo and keynotes, there were no free passes.  In some ways it is good, it may keep some people out who are adult trick-or-treaters or resume pushers.  In other ways if you are in the local area the 75 dollars for an expo pass may stop you from attending.  Well here is where I can help. I have 4 expo passes to RSA to give away.  Leave a comment with why you deserve one and if you can convince me you win one. I wish I had full passes to give out to all of the tracks and all, but those are hard to come by. Hope to see you at the conference.

Couple of other stories:

1. Vyatta adds security to the router. I don’t know about you but this is so Cobia 2007!  Come on guys we did this at StillSecure with Cobia 2 years ago.  Plus reading the press on it, it is hard to see what special sauce if any Vyatta adds over the plain vanilla open source offerings that it is based on.  I guess it was to be expected, but I think they are going to have to do better then this to be successful.

2. Is Sun going to rise at IBM? – Looks like Big Blue might be picking up what is left of Sun.  Great, that gives IBM another database to work with (they already have DB2 and Informix), some open source stuff and another silicon design.  On the other hand, Sun has to do something as I am not sure what the future holds for them as a stand alone.

3. How to evaluate if MSSP is right for you- article in searchsecurity about how to properly evaluate whether MSSP is the right for you.  Pretty elementary stuff, but a start to making the decision.

4. NAC, its not just for compliance anymore. – Tim Greene’s article this week calls out how NAC for compliance is yet another great use of NAC.  Yes NAC can be quite the Swiss army knife of security, but is NAC as a compliance tool enough to drive a new NAC sale or just another use for a tool you already bought?  That is the big question about the NAC market.

A NAC prophesy revealed

Image via Wikipedia

Almost a year ago I wrote a blog post called “Shimel the NAC Prophet”. In it I poked fun at what I hold told a reporter months before the story was written, but it didn’t take a real prophet to foresee where the NAC market was going.  With the recent news around consolidation in the NAC market (Vernier finally dying, Mirage getting scooped up) many are wondering what is next.  Tim Greene writes today about the continuing evolution of the NAC market.  I wrote yesterday that of the three NAC appliance vendors that I know of (including StillSecure) at least one of them is actively seeking strategic alternatives.  I heard today that another one is pulling out of its RSA booth plans.  So will NAC be a casualty of the current economy? Is it just the natural evolution of the marketplace? Is it that NAC does not work?  Do I still believe in NAC?

Sometimes I wish I could write on my blog everything that I think and say in my role at StillSecure as chief strategy officer.  But alas if I did it would do serious harm to our strategy, our company and would be akin to shooting myself in the foot (or somewhere else).  About a year ago I gave a presentation to our executive team where I white boarded what I saw as the future of NAC from the end of 2008 through 2010. I may not speak to as many people as Rob Whitely at Forrest-er or Lawrence Orans at Gartner, but I feel that I certainly have my finger on the pulse of the NAC market as much as anyone else.  Let me share with you now what I told our team over a year ago.

The NAC market would break down into three categories.  The first would be infrastructure players.  Cisco, Juniper, HP ProCurve, Extreme Networks, Enterasys, Aruba, etc.  These guys are providing the network pipes and connections.  NAC is so inherently intertwined with network infrastructure that these folks were a natural fit for NAC. They would continue to offer NAC as part of their secure pipes strategy that they were all going to push.  They were not going away and would either own or partner for NAC capability.

The second group are the endpoint providers. Symantec, McAfee, Sophos and I put Microsoft in there.  They had significant real estate on desktops.  They already had agents there and it was a no brainer to bundle a NAC agent with it.  I thought that this model had some inherent weakness.  They still had to integrate with the network in order to have a premium NAC product and did not have a post-connect NAC capability.  This has proven right on, except for Microsoft NAP.  Symantec had to retain the old Sygate SNAC piece to be competitive and that was long in the tooth.  McAfee was forced to use IPS as enforcement, a weak model or buy something (like a Lockdown).  Sophos was building on the old Endforce, but seemed to be becoming more and more to relying on the unified agent model.

The third category of NAC vendor was the stand alone NAC vendor.  You could break them into out of band and in line, but my feeling was that in line really did not scale.  Sure they could morph into something more than NAC as what is today’s ConSentry and Nevis have done, but as NAC appliances, out of band would win out.  Even still, there were too many out of band NAC vendors and many of them didn’t really scale. My prediction was that by late 2009 there would only be two or at most three NAC appliance vendors.  I still stick by that prediction. 

My challenge to my fellow StillSecure teammates at the time was what did we have to do to make sure we were one of the two or three survivors.  They key for us was the fact that we had developed military grade NAC, not a NAC bought and bred for the edu market.  Where most NAC vendors were hard pressed to show deployments of more than 10,000 devices, we were checking in excess of 300k devices a day  at one location.  Ultimately that scalability was what we thought would win the day.

So lets be clear.  I still am very much very bullish on NAC.  I think we will still have a lot of choices in NAC.  Infrastructure, agent or appliance.  I think more then ever the market is coming around to seeing that NAC is a versatile technology that can solve several problems. NAC today is much better then early versions. It is ready for prime time. There are multiple deployment options and not one size fits all. I hope that is clear enough.

Not if, but when and what . . .

Tim Greene has an article up today called “StillSecure on the fence about hosted NAC” about an interview I did with him earlier around our ProtectPoint MSSP acquisition. In the article Tim does a great job of highlighting some of the challenges and decision points around how to successfully have a managed NAC service.  It is not just rolling out a box, but how do you interact with the customers network gear, the endpoints on the network and the competing constituencies around managing networks, security and desktops. 

As Tim again rightly points out there may be elements of NAC as part of a bigger managed compliance and identity and access control service.  To us here at StillSecure that type of service would be something of high value to our customers. 

We are thinking through all of these scenarios and issues before putting pen to paper around our NAC managed service.  Perhaps a SaaS version may be offered earlier.  In any event we are committed to utilizing our Safe Access NAC technology as part of our managed services portfolio.  Giving customers a choice to utilize our solutions as hardware, software or as a service (managed or otherwise) is core to the StillSecure value proposition.

While I am at it, I just wanted to mention something that I told Tim. Through thick and thin, good times and bad, Tim Greene has been a consistent voice for NAC in the tech media world.  I may not always agree with what he writes, but his spotlight on NAC has been a beacon, often times in the dark for the NAC industry. I along with the rest of the NAC industry should be grateful for all he does!

Authors note: Looking at this picture on my blog, I'll be damned if it doesn't look like Mike Fratto dressed as a cowboy ;-)

Related articles by Zemanta

• NAC nags big security vendors you get what you pay for (stillsecureafteralltheseyears.com)
• StillSecure Acquires ProtectPoint (feld.com)
• Here a NAC, there a NAC, everywhere a NAC NAC (stillsecureafteralltheseyears.com)

NAC compatibility with switches – A case against SNMP

This week Tim Greene cautions to make sure that your NAC gear is compatible with your network switches. This is a big issue especially if your NAC solution uses SNMP to communicate with your switch.  As Tim points out many out of band NAC solutions do this.  However, this does not have to be the case!  There are many out of band NAC solutions that do not use SNMP for a variety of reasons. I have written on this before, SNMP is just not a scalable way to solve this issue. It is one of the primary reasons that the Lockdown Networks (now McAfee) NAC was so unsuccessful that Lockdown had to shut down.

Even 802.1x, which is of course a vendor agnostic standard has differences in support from switch vendor to switch vendor and even from switch OS to another OS.  But overall because of the standardization of 802.1x it is much more uniform than the catch-as-catch can world of SNMP. As such there is less of a chance of your 802.1x capable NAC solution not working with your 802.1x capable switch.

Of course there are other ways besides SNMP and 802.1x of doing out-of-band NAC. DHCP is a viable alternative, especially if you deploy best practices to lock out static and spoofed IPs.  Companies that use SNMP include Bradford Networks, Cisco and some others. Overall though, yes make sure your NAC works with your switches. You should not have to buy new switches to use NAC.  But like everything else about NAC, a little bit of planning and aforethought goes a long way!

If you are going to throw stones, have the stones

One of the things I hate most about the Internet is that it affords too many people the luxury of hiding behind anonymity.  I understand the need for it sometimes, but my feeling is that if you are going to throw stones at someone, at least have the stones to stand up and say who you are and why you might be saying those things.  A case in point:

Yesterday I wrote about two articles Tim Greene wrote about NAC. As I often do when I write about someone’s article, I went back to Tim’s column and left a comment with a short statement and a link to my article. When I went back there was a response to my comment from some guy who calls himself LAN Guy. Here is what Mr Guy had to say:

Alan,
It's interesting you'd point out on you blog that "other" vendors jumped on the NAC bandwagon with their IPS roots.
To quote your blog... "Just like the underlying technology powering several NAC solutions were originally designed as worm-catching IPSes ... that failed because of a lack of mission and became NACs instead, NAC for worm catching just doesn’t cut it anymore either."
Hmmmm.... didn't StillSecure (a.k.a. Lattis Networks of old) start out with IDS/IPS and VAM?
Keep up the good work Alan - you're very entertaining. Ever consider politics??

I replied to Mr L Guy with this:

My LAN Guy (I love people who like to throw stones, but don't have the stones to use their real name), the fact is that exactly because we already had IDS and VAM we knew they were not the right tools for NAC and instead built Safe Access from scratch. Glad I entertain you and no I never consider politics!

This got me to thinking though about what is LAN Guy’s angle and why he wouldn’t use his real name. So I looked under his name on Network World and found LAN Guy likes to comment about NAC articles.  Here are his two previous comments:

Novell's NAC play is a joke

By LAN_Guy on Mon, 10/06/2008 - 6:47am

Interesting that Novell has gotten press recently about having a NAC solution. The 'news' that they OEM technology from StillSecure is not 'news' at all. This comes from their acquisition of Senforce over a year ago in August 2007. As for integration with other products: they've done nothing as a result of this acquisition in over a year - so what would make anyone think they'll integrate anything any time soon. Just another company jumping on the NAC bandwagon. What a joke...

and

RE: ConSentry's LANShield gear has NAC

By LAN_Guy on Thu, 08/14/2008 - 1:00pm

Tim,

"In situations where budgets are tight" (btw is there any other situation?), ConSentry is one of the LAST vendors I'd look at based on price. Their list price is about $300 per port - VERY pricey for an edge switch, even if it sorta does NAC and sorta does some pseudo-content filtering. ProCurve and others have some very strong offerings at less than 1/2 the price, which frees up funds for a REAL NAC solution, a REAL content filtering solution, and/or other things. I'm very wary of an "all-in-one" approach like ConSentry's. I'd rather have a separate hammer, screwdriver, and pliers (i.e. the right tool for each job) than some hammer+screwdriver+pliers gizmo that doesn't do any one job particularly well.

 

So it looks like LAN Guy while fancying himself quite the NAC expert, does not have much good to say about any of them. I wonder if perhaps he works for another NAC vendor? Does he have another axe to grind. 

LAN Guy from your comments it sounds like you read my blog. If you read this, why don’t you step up and say who you are and lets have a real discussion about what you like and don’t like about different NACs. If you just want to hide behind some anonymous identity and throw stones, maybe you should crawl back under the rock you came from.

NAC - its not some Chinese New Year thing

Did you ever eat in a Chinese restaurant with the paper place mats that have the different animals of the various years?  You know the year of the Rat, the year of the Monkey, the horse, etc.  For too long, too many people kept predicting that the next year was the year of NAC. You would expect to see it next to the rat, horse and monkey on the next place mat.  But alas like a good Chinese meal, with NAC 2 hours later you were hungry again.  I am past those kind of bold predictions.  As Tim Greene says in his newsletter today, NAC won't get its own year.

However, I don't think it is a bad thing.  Enough of the over hype, enough of the impossible goals.  What NAC has become is a real way that enterprises in all verticals and sizes are using to make their networks more secure.  It is beyond the silver bullet phase.  There is no magic. It is not a panacea.  But it does work, it does help improve your security and is getting better all the time.  What more can you ask for?