Last week's security vibes

It has been quite a while! Let me recap selected security news from vendors I’ve talked with in the past couple of weeks to get up to date with current events. In most cases I had to wait for their embargoes to lift – my apologies if I have announced anything early J!

Palo Alto Networks and VMware announce that next generationfirewalls from PAN will embrace VMW’s NSX to secure traffic between virtualmachines as well as between virtual data centers. I thought this was great as it allows vCenter to orchestrate application security policy both within and between perimeters. In the long run, with software defined networks, security policy will have to travel with the application to be enforced locally. This agreement nicely positions Palo Alto and VMware toadd much needed flexibility in securing applications as they evolve from physical to virtual to cloud environments. Love this one!

NetCitadel announced ThreatOptics to enhance an organization’s ability to respond to incidents. What I like about the vision is that instead of layering analytics on mountains of SIEM data, NetCitadel kicks off when a network sandbox such as FireEye or Palo Alto Networks WildFire reports an anomaly. ThreatOptics then reaches out to affected endpoints with a dissolvable agent to grab detailed host information that it can then combine with what the network sees to give security organizations better intelligence to prioritize and respond to incidents. I believe that launching investigations based on observed suspicious behavior is a concept with impact – it will be fun to watch NetCitadel run with it!

Mojave Networks, nee Clutch Mobile, is stepping beyond mobile device management to offer a cloud-based security service for mobile devices. This makes perfectly intuitive sense to me - as most of the action for mobile and tablet devices takes place in the cloud that’s where security should be! Dumping a lot of security apps onto your device can’t be the right approach with issues of battery life, compatibility with popular applications, and constant upgrades. I like where Mojave is going and the team they’ve assembled. I wish they would extend their focus beyond small and medium enterprises to address larger security concerns of larger enterprises, but the market will soon speak to that.

Adallom is a freshly launched company with a clever idea to protect SaaS applications. It is a tough problem as IT needs to protect the business, but does not need to get involved in personal use issues. The Adallom solution piggybacks on the identity process to audit cloud activity and implements heuristic profiles similar to those that have proven successful in detecting credit card fraud. The company still needs to execute, but they have a great idea and experienced leadership so I look for more from this exciting company as they move forward!

Prelert announced Anomaly Detective 3.0, a special Splunk application that, based on learning a machine’s and network’s normal behavior, promises to reduce a high volume of security alerts to an actionable level of incidents. It is an interesting approach to combat the flood of data and alerts that security teams now have to deal with. I like Splunk a lot (as do lots of others) partly because of the balance it strikes in delivering value to both IT and security operations. It looks like Prelert is going to stick to its security roots, but the Splunk bandwagon is a good one to hitch onto.

Happy to be blogging with Computerworld (again)!

Every now and then you get lucky enough to be able to correct an unfortunate decision. For some time I had enjoyed posting my thoughts, opinions and recommendations on Computerworld’s security blog, building up a nice following in the process.

Thanks to the kindness of Computerworld’s editorial team, who honestly already gets an amazing amount of work done, I have returned to the beat with weekly contributions. I am looking forward to the coming year and I hope to see you there!

The first posting talks about threat reports and I hope you enjoy it:

Are you drawing the right conclusions from your favorite security vendor’s 2013 threat report? Some do, but I talk with a lot of security executives that miss the opportunity to use these reports as stimulus to re-examine their security strategies. The importance of threat reports are what the trends of user activity mean to your security practices and not-so-much the details of individual threats.

Decision time! Choosing the right firewall analysis approach for you

I am hearing feedback that organizations are checking out Firewall Analysis vendors to save time satisfying firewall change requests and to increase the security quality of each change (e.g. reducing errors that create gaping holes or disrupt application services). These organizations get the operational efficiency benefits, but are unsure whether to prioritize application-oriented Firewall Analysis or threat path-oriented Firewall Analysis, to use terms from my recent Firewall Analysis Saves Time Keeping Application Paths Clear report.

The answer is very clear: firewalls are in place to secure access to applications. That is job 1. Period. You should be prioritizing your evaluations on application-oriented Firewall Analysis solutions because that is what your business most needs right now and in the coming years. Firewall changes are driven by the demands of users and applications – it is simply practical to align Firewall Analysis criteria to meet these demands.



You would think the application-oriented issue would be the thousands of applications organizations need to make accessible to a large mobile user community. And to a certain extent you would be right as users will feel the brunt of application service disruptions. Ironically enough, it is the back-end complexity of applications that causes the security headaches. Applications now consist of connected web servers, databases, application engines, load balancers, and gateways – many of which are transient virtual images, deployed in corporate data centers, or distributed throughout the cloud. Leveraging your understanding of the relationships of the entire application environment in maintenance of firewall rule sets is critical in creating effective rules and in avoiding creating over permissive access which could leave a security hole to critical resources undetected for far too long a time. Application-oriented Firewall Analysis will help you secure the entire application environment and save you considerable administrative time.

On the other hand, I am not a big fan of threat path analysis as part of a vulnerability management strategy. And I want to be. The premise is that you do not have to patch key vulnerabilities in servers if threats cannot reach those vulnerabilities, or must pass through an IPS in transit. It is a security form of alchemy, sounding obvious and beautiful until you think it through a little bit. No matter how many hops you analyze, attacks are going to defeat pattern-matching security filters and somehow reach a vulnerable server tucked away in the darkest corner of your data center. They always do. And now your threat path analysis is worthless. Can you imagine your CISO telling the board that vulnerability management of sensitive servers was given a low priority because a threat path analysis vendor told him/her that an attack could not reach those servers? Me neither and I have yet to talk with any enterprise security executive that thinks this is a valid approach. Threat path analysis can help you audit your network for security AV and IPS filters, or trace where an attack may have leapt to from an infected server, but will only be able to help you once or twice a year. For vulnerability management however, I don’t buy it and neither should you.

Just think about what your most common firewall related help desk tickets say. Probably “I cannot access my application” or “My application performance is terrible” top the list. You are probably not getting a lot of requests to leave serious vulnerabilities in critical servers un-patched. If you must go with threat path-oriented vendors, know that you will only use them once a year or so to make sure all network segments pass traffic through security filters. My advice to you is to start with a strategy of application-oriented Firewall Analysis that will protect your business, keep users happy, and save you time every single day.

Webinar: Achieving Continuous Diagnostics & Monitoring

Clear your calendar for tomorrow afternoon's ForeScout webinar based on the government's CDM initiative!

The federal government has created budget for agencies to step up to the challenge of continuous security. I refer to it as continuous compliance, but someone smarter than me saw the potential for a TLA (aka three letter acronym). It is an interesting topic and a good chance to talk about how the network is driving real-time vigilance of the infrastructure. I hope you can listen in at 2:00ET/11:00PT.

Tomorrow will also be the anniversary of Tiananmen Square's unknown rebel. The cyber-security metaphors are just too good to pass up. I start by thinking of the unknown rebel as a CSO :).

Firewall Analysis Saves Time Keeping Application Paths Clear report is out!

The Firewall Analysis Saves Time Keeping Application Paths Clear report is complete and available!



Please contact me for more info. The teaser is:

Firewalls rely on IT-defined rules in allowing authorized application traffic to flow unencumbered between data centers and users while preventing undesirable traffic from entering the corporate network. These rules, which can number in the thousands per firewall, prescribe allow/deny decisions based on sources, destinations, and the services provided. The more complex the network, the more complex the firewall rule sets, and the more likely IT will encounter disruptive side-effects when changing firewall rules to secure application access.

The primary reason to analyze firewall rule sets is to identify logic errors opening security gaps, violating compliance policies for segmenting regulated data, preventing subsequent rules from firing, or rules becoming obsolete due to changes in business services. This leads to business benefits in managing network complexity such as:

• Drive operational costs out of making changes to firewall rule sets by reducing errors, automating compliance reporting, and recommending effective rules based on application requirements.
• Accelerate application deployment cycle times by streamlining firewall change processes to a matter of hours.
• Enable an orderly evolution to application-centric security management for next generation firewalls as well as traditional deployed firewalls.
• Model the impact of new rules before a change is approved to protect against errors that could block application paths.
• Maintain a secure audit log of firewall rules changes to document all changes for compliance reporting.

Firewalls connect businesses to the Internet. It is the one security technology that truly enables a stronger business by securing application paths to users. The Ogren Group believes it is critically important for organizations to apply technology to help manage accuracy and instill a change process to control operating costs with increasing complexity in networks and firewall rule sets.

It is far from certain that firewall analysis will be more than a niche market with room for multiple vendors. Firewall analysis vendors are branching into application security motivated by next generation firewall concepts, enterprise security management to reduce operational costs, and threat assessment based on path analysis. The Ogren Group applauds AlgoSec, SolarWinds and Tufin for their vision and execution in Firewall Analysis.

In this report, the Ogren Group presents the features, life cycle, and market strategy of Firewall Analysis. The report concludes with recommendations for vendors and the enterprise buyers they covet.

Early Vibe: Skyhigh Networks

I was very impressed with this year’s RSA Conference – not only was the energy level of 24,000 attendees up over previous years, but I also witnessed more innovation on the exhibition floor than I had seen for a very long time. One of the companies I enjoyed talking with, thanks to a tip from my friend Rich B., was Skyhigh Networks. Skyhigh launched on the Monday of RSA so they get the prize for my earliest Early Vibe ever!

Skyhigh offers a subscription service based on firewall logs to identify cloud services accessed from within the network. Most companies have no visibility, and thus no control, over the cloud applications users access from within the corporate network. I find IT usually knows personal use of email, social sites, and data storage is happening, but IT is often stunned when they learn the magnitude of the usage. And of course, there are always the security benefits of detecting use of unauthorized applications, checking out security reputations of applications that are used for the first time, planning training needs for secure use of cloud apps, and prioritizing heavily used applications for renewal negotiations.

My understanding of how it works is firewall log data is delivered up through the cloud, where Skyhigh matches addresses with domains and applications within domains (e.g. granularity for Salesforce or Facebook apps), and security gets a lovely dashboard of cloud application usage patterns. Skyhigh has a cool idea to offer analysis of cloud applications and user behavior as a service that gives Skyhigh a ton of flexibility to deliver new security applications.

Network Access Control: A Strong Resurgence is Underway

Security analyst firm the Ogren Group today released its vendor market forecast and market analysis security report Network Access Control: A Strong Resurgence is Underway.

To buy Ogren Group Security Reports or reprint rights please send mail to eric@ogrengroup.com.

Analyst Comment

The ability to detect and characterize users and devices connecting to the network, and enforce security policies based on real-time assessments, is a huge benefit for enterprises requiring security and compliance for mobile users. The NAC roots of segmenting guests and unhealthy endpoints from sensitive data is fueling growth with BYOD and wireless initiatives along with demands for continuous endpoint compliance.

The NAC market has not only revived, but is experiencing a strong resurgence - the Ogren Group estimated the market for Network Access Control products and services was $392 million in 2012, and predicts it will grow at a 22% CAGR to $1,061 million by 2017. Cisco, ForeScout, and Juniper combined represent over 70% market share and are the clear leaders in the NAC market.



Security Report Summary

The Ogren Group interviewed major vendors and security officers at large organizations in examining the Network Access Control market. This Security Report presents the features, market strategy, future directions, and recommended vendors for NAC. In addition to Cisco, ForeScout, and Juniper, the Security Report also profiles
Aruba, Bradford, StillSecure, and TrustWave. The report structure is:

Executive Summary
Overview
Economic Drivers of NAC Resurgence
Technical Drivers of NAC Resurgence
Noteworthy NAC Features
Noteworthy NAC Weaknesses
Selected Vendor Profiles
Network Infrastructure Vendors
Software Infrastructure Vendors
Independent Vendors
Niche NAC Vendors
NAC Roadmap
Conclusions
Enterprise Recommendations
Vendor Recommendations
Directions and Predictions

Upcoming Ogren Group Research in 2013

Firewall Analysis: Keep Application Paths Clear
Endpoint Security Advances: Protect Un-trusted Systems
BYoD: Security Answers the Bell
Incident Response Strategies: Detect and Act!
Virtualization Impact on Security: Is It a Game Changer?
Spotlight on Threat Intelligence: Get a Head Start on Threats

Security Training? Seriously.

It is no secret that many CSO's acknowledge the inevitability of attacks penetrating security defenses. You are all challenged with enabling the user community to participate in security and to make healthy security decisions on their own. The continuous training of end-users on the latest security issues should be a fundamental element of every security strategy to ward off security incidents.

According to Wombat Security, 48% of organizations report difficulty in funding security training programs and 44% report difficulty encouraging employees to take security seriously. This is an unacceptable position in these days of mobile and cloud computing that places so much of the business beyond the protective reach of your IT and security teams.

Perhaps it is time for organizations to re-think their approach to security training. It is not a matter of sitting through an annual seminar lecture, or being forced to read policy documents and sign security pledges. CSOs love activating business users for a healthy business - integrating security training with employee education is consistent with that mission. With that in mind, here are three thoughts that may help you with a security training program.

1. Work with applications teams and human resources to embed security awareness into the business. Users are just not into security training for security's sake. For instance, you could allow cloud-based application training to include a few modules on mobile security. Users learn how to do their business better and improve their security awareness too!

2. Design metrics into the security training program. Your executive team will want to know how an investment in security training will help manage risk and drive the business - so build in measurements to help manage the program! For example, compare security trained and un-trained users on the ability to recognize phish messages, redirections to rogue websites, risky applications, etc. You should expect that trained users will be less apt to be duped by new threats.

3. Include a few security best practices that are designed for home use. Face it, most of your user base have families with a younger generation that uses apps that your employees know little about. Including security awareness tips designed for home appeal may provide additional incentive for your users to learn a bit more about security issues.

Finally, be careful about relying too heavily on “test moments”, where you capitalize on a security incident as justification to drive home security messages. While these are important, and you need to help users understand what they may have done more securely, you also want to keep your focus ahead of the curve and next attack.

Good luck!