A Spanjaard in the Works

Over on PCI Answers I've been talking about Henk Jan Spanjaard at Decru today. I met him at InfoSec last week, and he was a genuinely nice, friendly guy. I've never met a Dutchman I didn't like, must be something in the air :) I asked him why he hadn't tried to poach me from Vormetric and he said "because I didn't know where you were!" Which is at least diplomatic.

Then, whilst searching for a quote about European disclosure I also came across this little gem from HJS:

"Bedrijven moeten zich afvragen hoeveel zin firewalls hebben als de opgeslagen data niet beveiligd is. Ze doen de deuren op slot, maar laten de ramen open. Op deze manier lopen bedrijven onnodige risico’s op het gebied van security", zegt Henk Jan Spanjaard van Decru.

I don't speak Dutch, I just love the way it sounds. Loosely translated this means: "Companies must wonder how much intelligence firewalls have themselves as stored data is not protected. They lock the doors, but leave the windows open. This way companies are in danger of unnecessary risks", says Henk Jan Spanjaard from Decru.

This is exactly my point about firewalls, neatly explained in a few lines. I think I'm going to start saying it in Dutch.

Maybe I'll make more sense?

Playing $oftball

Slightly off message today, but after yesterday I deserve a break and it's the weekend...

There's been a lot in the press around my home town of Winchester, UK, about Paul Allen of Micro$oft's intention to buy local football (that's soccer to you American types) club Southampton F.C. The story broke yesterday morning in the Daily Echo - a complete rag of a newspaper - so I wouldn't be in the slightest bit surprised to find out that someone at the Echo has a number of shares in SFC and is just pissed off that they're doing so badly again this season. The share price jumped 30% yesterday on the back of this "exclusive".

There are various reports from Allen's camp to the effect of "what?", "Southampton, where's that then?", etc. but apparently Southampton have confirmed that there is an offer on the table. Well, if it's in the Guardian it must be true (er...). Considering Paul Allen's track record with sports teams, it would seem that his match with Southampton is a good one . I haven't been to watch an SFC match since my season ticket ran out in 2001, but I can't say I've felt like I've missed anything. Mind you, I feel pretty much the same about Microsoft.

Football is becoming duller and duller the more money is pumped into it, when Abramovich bought Chelsea it just became scary. Glazier buying Man. U made it laughable, Madejski at Reading, Gay-whatever-vich buying Portsmouth didn't register, more Russian blood money dissecting our national game and pride.

All it ever seems to achieve is more young men on coke-fueled Saturday night rampages in their 20s having to apologise to the press/their families/partners/friends, getting fat, then burning out in their 30s to become whisky soaked middle-aged sad cases with little of their earnt fortune remaining.

Still, I'm not bitter or anything.

A Brief History of the Future.

Joshua led the Israelites 7 times around the ancient city of Jericho until the walls came down. Joshua was a man after my own heart. I would gladly walk 7 times around every firewall in the world if it would make them crumble to dust. Once again however, I digress.

The aim of the Jericho Forum is to promote business by taking away the hard outer layers of perimeter security that are ubiquitous these days. Some people can't see this ever happening, and like the people who believed so strongly that the world was flat, they resort to name calling and snorting to prove their point (sorry this is such an old article, but it's still the 5th entry on Google when searching for "Jericho Forum", number 3 being a discussion board for the TV Series Jericho. Doh!)

Deperimeterisation is a very long word, but it makes such a lot of sense if you spell it right. I'm beginning to see it happen already. I talked previously about AppGate and Secerno; these are both a step towards creating better security at the app and db levels. I've seen some fabulous security this week, firewalls are being incorporated into UTM devices fairly universally now, and this is a great way to get rid of them altogether.

Once UTMs have replaced all the firewalls we will be left with proper devices at the perimeter which filter out all the crap and leave you with something clean to go through your network. However, why then would we leave them at the perimeter? Network devices are only ever applications working inside a box. Why not make this security travel with each transaction, or at least build it into your apps, make it data-centric rather than network-centric...

UTM is the first step, AppGate have seen this already, Hoff over at Crossbeam also knows this, and is cashing in. F5, who I am a great fan of, have been breaking into the same space for a while, as have Juniper, Bluecoat, etc, etc.

Computers are becoming powerful enough to be basically a network in a box, but still want to connect to each other. It's becoming like the internet in the early seventies again, just a collection of connected points without concentrated private networks. Albeit there are a hell of a lot more of them, but the principle is the same.

In this scenario, the perimeter is dispersed or non-existent, so there's no way of telling where it is to protect it, and this is how it should be security should have as few variables as possible to ensure ubiquity and uniformity. This makes business easier, and now we have open standards for communicating, this is possible to do securely, unlike the 70s.

We still have to educate the users: security will one day boil down to best practices and learning how to be safe as the technology becomes reasonably standard across the board. We will see more platforms, frameworks for building security on like UNP, more standards, SOA, webservices, XML, until there are no longer any huge advances to be made or huge margins to be gained. This is long after the Semantic Web of course and way into the future.

The new billionaires will be the inventors of the next "next big thing", which will leave us all kicking ourselves that we hadn't thought of it of course, and the world will change again.

(Better than Hawking any day.)

And on the last day...

...he rested and saw that it was good. Yep, OK, I enjoyed it. InfoSec was a roaring success for me in fact, and I had people actually come up and tell me they'd read my blog. Even some quite clever people. Igor Drokov over at Security x.0 stopped to talk to me for quite a while and I felt humbled in the presence of such a large brain. Those Cambridge guys are pretty amazing.

I also met with every other vendor under the sun, pressed some flesh with the distis and resellers, saw some great new technologies, looked at some girls in short skirts and talked a hell of a lot. What more could a man ask for?

Well, I'll tell you what. I came home to find a newly delivered mail from my newest American buddy, Mike, over at PCI Compliance Demystified, from a geezer in the US wanting to write an article on PCI. So I've given him some stats and expect to see my name up in lights soon. I'll let you know where it appears, as it seems I have quite the fanbase now.

I expect to see that decrease now I've said that of course.

On the Second Day...

...I could barely get out of bed. It was only the thought of seeing all my chums again that willed me in today. Good God my back aches. I remember standing up at these things in days gone by and not needing to sit down every time someone came to talk to me. Mind you, all this was fields then... I digress.

So I went to see Secerno today, and their stuff really does seem to be as awesome as I thought, didn't get around to Centrify, but spent a good 40 minutes at the AppGate stand. This stuff is seriously good by the looks of things. A mature "deperimeterisation" technology they call it. I'm not 100% convinced of this yet, but they are heading in the right direction better than anyone else I've seen. Maybe I will expand on this at a later date. Depends if they want to partner or not I suppose... :) The power of blog.

In other news today: I had an email from my old friend Owen at QinetiQ (which is still a bloody silly name), and he actually had a bit of a rant. He agreed with all things blog, said that I was looking at the right technology at InfoSec, etc. but pointed out that I was wrong about firewalls and that some of them (the layer 7 application kind) are OK. Gah, rubbish! Firewalls are satan's (network) device and should be banned. Deperimeterisation is the way forwards, data-centric security will rule the earth as the Semantic Web takes it's hold over mankind, and I will be your natural leader. OK, this might not happen for another 20 years, but I'm certain that it will one day. They laughed at Einstein you know.

That is to say: my blog = my rules. :p

On the First Day of Infosec...

...my back aches and I'm losing my voice, and yet I feel strangely satisfied.

So, where's the big buzz this year? Strangely enough, it felt like it was all around. The first day is always quieter than the others, but this one seemed to be humming along very nicely. I walked around the whole show and saw some great things, Secerno and Centrify I will be examining more closely tomorrow. I caught up with some old friends, Ingrian, the Equip/Horizon crowd, F5, Bluecoat; made some new friends, Decru, Protegrity, SafeNet, and will hopefully catch up with Hoff at some point as I noticed he was absent from the Crossbeam stall today...

The real interest from the crowd seems to be split, on one side there is a lot of interest in application security, on the other hand the really big spenders are coming over to talk about compliance, and we couldn't be better placed.

So, if you've got deep pockets and want a data integrity PoC, come over to G130 and look at the fabulous Kinamik stand. I'm the tall one with the stripy tie and glasses invariably on my head.

I must also put in a quick hello to Mairtin (yes, that is spelt correctly, I checked) O'Sullivan from an unpronouncable place near Dublin, who came to see me especially to talk about PCI and told me he had read this blog. That's got to be worth a mention...

The 4-year Itch

InfoSec tomorrow, and I have to admit to a slight feeling of excitement. Maybe it's because I haven't been to one for a couple of years, maybe it's because I'm on one of the bigger stands this year, or maybe it's because I've got a lot of talking to do.

I'm fascinated to hear what all the buzz will be about this year, because as far as I'm concerned, the security industry in the UK has got a bit lost recently. When I was in distribution there was little interest in any of the really important security breakthroughs, but the load balancers and SEM/SIEMs were flying off the shelves. NAC was also just getting popular. Anyone in the US reading this will be scratching their heads now - I will repeat one of my many moans here - the UK is consistently around 4 years behind the US in terms of security, more in some areas.

I worked in encryption, with Ingrian for a few years, and for Vormetric for a year in the UK. There was a limited market for it, hence my move to distribution. There I again worked with Ingrian, and am delighted to report some uptake at last, but not without work. In the US, both of these companies are doing great things, and deservedly so. Vormetric in particular is an astoundingly good piece of technology which deserves to be much more widely used than it is. Maybe in 4 years time we will see a large take up in the UK?

Curiously enough some things seem to be working in parallel. There is a big buzz around UTM, but I don't think anyone really understands it, they just see it as a way to cut costs. And there's the rub. The difference in the 2 markets is that in the US they will install "belt and braces" security before the horse bolts bceause they will get sued if they don't and because they can. In the UK, we wait until it's well and truly broken, if we can't fix it for free, we try to do it on the cheap. And what's the average lifecycle of a piece of technology before it is superceded or needs a complete upgrade...? Around 4 years.