Archive

Archive for November, 2006

Freddy Got Fingered…

November 30th, 2006 2 comments

FreddypianoFreddy Got Fingered is probably one of the most disgustingly funny movies I’ve ever seen.  It’s truly sick.  In the first 10 minutes, Chris Elliot Tom Green (thanks, Zach!) performs unnatural acts on a farm animal and plays a Brahms concerto on an electronic keyboard with pieces of meat strung from overhanging pulley systems that move up and down as he plays.

Weird.

What the hell does this have to do with what Martin McKeay wrote about my blog entry welcoming Richard Stiennon to the ranks of the UTM vendor pool?  Nothing, really.  Except for the fact that I got "fingered" (ew!) by Martin as he pegged my post for what I said it was — an un-objective "Welcome to the Jungle" message to Richard who in our last exchanges didn’t seem to believe in UTM. 

Now he does.  What a difference a day makes.

I started thinking about Richard’s comment about how in his new position he’s not going to become a "defender of the product" — somehow rising above it all and not getting dirty debating the "merits" because he’s the Chief Marketing Officer.  At first I dismissed his comments and blew him a kiss given how early in the game it is for him @ Fortinet, but I, like Martin, sure as hell hope that he’s not going to hide under a title because he doesn’t want to debate openly.

We’ve called each other out — sort of. 

I respect Richard’s opinions.  I don’t happen to agree with all of them and unfortunately I seem to be violating some unwritten rule that suggests it’s out of bounds to say so?  I guess that’s why I don’t consider myself in marketing.  Ptacek would call me on that one because everyone — including my plumber — he considers in marketing ;)

When Mr. S. was an analyst he thought fit to be able to debate and agree/disagree with anything I said.  Because he was "independent?"  Now that he’s not, he can’t?

Perhaps I missed the memo, but I think it’s a cop-out to essentially "take the fifth" when doing a 180.  I just don’t subscribe to the fact that there’s some secret code that suggests that when roles change so do opinions and the exposure that comes with articulating them.

If I went to work for Cisco tomorrow, based upon my comments and opinions in the past, I’d sure as hell expect that people would question me on it and expect to debate the "merits" one way or the other.  I’d also feel compelled to ‘splain.  But that’s just me.

Also, I’ll take any advice anyone has — whether the topic is fly fishing, chainsaw juggling or branding.  I’m an equal opportunity opinionist that expects to receive as much as I give. ;)

Enough.  This is getting to sound like I’m trying to pick on Richard.  I’m not.  Well, OK.  I am.  But that’s what all you people pay to see, right?

Rich — whaddya say we rent those inflatable Sumo suits @ RSA and do a true UTM grudge match!?  I expect that you’ll take Ken Xie’s place on Rothman’s UTM panel?

Hoff

IDS is dead, NAC doesn’t work…long live UTM? Welcome Back to the Vendor Cesspool, Mr. Stiennon…

November 28th, 2006 5 comments

Ids_dead
I smell blood.  This will be a very fun next couple of months.  Why?

In case you haven’t heard, Richard Stiennon has announced that after his provoking and inciteful rant (sorry, Mike) against Check Point, Ken Xie from Fortinet wooed him back to the darkside and he’s going to join them as their newly-titled Chief Marketing Officer.  Timing is everything, eh?

The esteemed Mr. Stiennon is a really smart guy and I am honestly looking forward to seeing how and what he does @ Fortinet.  It will be thought-provoking for sure.

So much for the niceties…Richard’s railed on me previously about how big honkin’ UTM boxes aren’t the answer to security but I reckon that’s going to change — or spin — now that he works for a vendor that sells (amongst mostly SMB/SME solutions) big honkin’ UTM boxes.

We really had a good time going at each other in regards to NAC and his Secure Network Fabric (SNF) positioning and it lead to a podcast debate on Martin McKeay’s blog, also.  I am eager to see how, or if, Fortinet’s strategy changes once Richard gets his hands on the positioning and messaging.

Fortinet really doesn’t compete in the "…high-end enterprise, carrier and managed service provider" space, but their ATCA-based chassis products are certainly positioned to play there.  He’s got his work cut out for him. 

I forecast that Fortinet’s high-end ATCA-based product line will be the soapbox from atop which Richard continues to evangelize his SNF strategy — but instead of "embedding" security in the switching fabric, it will be overlaid with big honkin’ UTM boxes, despite his prior arguments to the contrary.  I further prognosticate that we’ll see PR regarding relationships with switch vendors like what Shimmy @ StillSecure did with Extreme…

Either way, it’s going to be entertaining.

Congrats on the job, Richard.  At least I don’t have to listen to your "…I’d rather debate with independent analysts" comments anymore. ;)  Looking forward to our continued interaction.

Chris

Crossbeam To Exit Security Market — Will Re-focus On Selling Pet Supplies On-line

November 5th, 2006 1 comment

Ptacek
Firstly, I really like debating elements with Ptacek.  He’s a really, really smart guy.  Somewhat misguided, but a really, really smart guy.  I’m honored that he picks on me.  Really. 

He picked on Bejtlich the other day.  Given this association, I believe I have solved the Poincaré conjecture which has something to do with math, intractability and doughnuts.  Mmmmm.  Doughnuts.

Here, he mentions in response to my post regarding my Chicago presentation, that Cisco will crush Crossbeam.  Privately he gave me a date and time, but I told him that I wouldn’t repeat when because it might affect his Cisco stock value.

Secondly, I can only giggle about Thomas’ choice for his blog entry title ("Cisco can kill Crossbeam any time it wants…") relating how Cisco will assimilate us all…I remember that same Borg-like prediction about how Microsoft would crush the Linux movement and how no other OS would stand a chance.

I believe Thomas is still using a Mac today…

At any rate, I started with Crossbeam almost exactly a year ago.  The funny thing about crossing over from a security practitioner to working for a security vendor is that all your credibility goes out the window instantly.

I get this, it’s part of the game, but I refuse to bow to the notion that the last 15 years of my life and the credibility it has earned is erased by this singular event, so I go on assuming that my opinions count as they always have – like the paper they’re written on.

Almost always, I end up arguing with people who have either only been a vendor or an analyst and short of securing their home networks have never actually been a CISO of a company whose assets have monetary value with the word “billions” preceeding it.  I have.  I argue from that point and the beliefs that come from that perspective.  Yes, I am biased.  I was before I came to Crossbeam, too.

The one thing that makes it difficult to sort out addressing someone who is as long-winded as I am is figuring out which parts of the debate are religious, marketing, technical or dogma.

Thomas is obviously reacting to my post playing the role of Cisco’s VP of Marketing, despite his disclaimers to the opposite.  I will answer disguised as a cabaret dancer from Ohio.  I hope that’s not confusing.  If nothing I say makes sense, I’ll just ask you to rent the movie “Showgirls” and you’ll forget all about this security nonsense.

So I’ve read his retort to my post/presentation, and I’m going to respond to the things I think are worth responding to because a good chunk of his posting doesn’t really address my points – they defend Cisco’s misses.  Yet I digress…

Ptacek starts out all right, doing a good job of summarizing the sentiment of both my post and my presentation:

Chris’ argument has three salients:

  • Cisco’s Self-Defending Network Architecture (the successor to SAFE) is just marketecture.
  • Cisco hasn’t put its money where its mouth is on integration of security into its mainline platforms (the Cat and routers).
  • Security belongs at a “service layer”, virtualized over the entire network, not as point-deployed boxes (IPS) or embedded into the infrastructure (IPS blade).

I really could just stop here because I’ve yet to find anyone (besides Thomas) who would actually disagree with any of those points, so why continue? ;)

But, he did, so I will…

1.    Is SDNA “marketecture”? Of course it is. SDNA is code for “sole-source network security from Cisco”. Sniping at SDNA’s credibility is as silly as sniping at the Cisco SAFE architecture in 2001: absolutely nobody designs networks according to these “schemes”. SDNA is a “why we did it” story that is retrofit onto Cisco’s evolving product lines to make it seem like they have strong management and a real vision.

Roger that.  SDNA = marketing.  Being opportunistic marketing-wise = vision.  Check.

But Chris’ argument isn’t about SDNA. It’s about whether enterprises should sole-source from Cisco, with around $1b in security sales, or consider vendors like Crossbeam that post sales less than 8% of that.

That’s right, my argument is that you shouldn’t sole-source your security solutions from a single vendor who claims competency in 15+ categories of security without demonstrating it, ever, except with a checkbook.

Also, just to double-check, Thomas, in Cisco math, a $200,000 Cat6500 switch with two FWSM blades is still $200,000 of “security sales,” right?   Uh-huh.  How about those “negative margin” deals…

That’s a fine argument to make, but if you’re going to build it on Cisco’s inability to run a real playbook, you can’t cherry pick Cisco’s weakest messages. SDNA may be meaningless. NAC isn’t. Even if it doesn’t work yet, it’s actionable and it’s changed the way people think about securing their network, and when Cisco buys the company that can really deliver on it for large enterprises, NAC is going to cause Crossbeam huge headaches.

Cherry-pick their weakest message?  SDNA is their message, Thomas!   DVVM and Quad-play is dependent upon this underlying message that “security is the network.”  I didn’t make this up, Cisco did.

You just contradicted yourself hugely.  In the first paragraph you said that “…absolutely nobody designs networks according to these “schemes”” but somehow that’s affected the way in which folks secure their networks!?  You’re right…they take a look at the Cisco method and realize it doesn’t work and look for other solutions.

Also, I just love the “…you just wait until Cisco buys something that actually works” sentiment!

By the way, Crossbeam doesn’t have to fear when Cisco gets NAC working (which is the most hysterical comment you’ve made,) because we can simply get a best-of-breed partners’ NAC application running on our platforms…no cash, no development, no fuss.  In fact, we are already in the process of doing that.

Furthermore, when you say NAC, you mean CNAC.  But which CNAC are you referring to?  The one that didn’t completely pan-out (CSA) or the new-and-improved Clean Access?  You know, the same Clean Access that requires ANOTHER appliance to be added to the network to function and is purdy much a Cisco-only solution…

2.    If you’re an indie network security vendor with a pulse, the idea of Cisco embedding IPS and firewalls into every Cat switch and access router puts you in a cold sweat. Is Cisco full of shit about this plan? Reasonable people will disagree, but the answer will be “no”.

See, I don’t think they’re full of shit.  I just think they’re not a security company and aren’t executing on their vision in a manner consistent with the customers they serve outside of the SMB.  The Enterprise strategy is showing cracks and they are very distracted across an immense portfolio.  They’re trying to re-group on the convergence front, but there’s pressure there, too.  All the while, security plods on.

First, the existence proof: the ISR. Large enterprises buy them by the hundreds. It’s one of Cisco’s most successful products ever. And it’s a direct threat to the branch/satellite-office market that is the primary revenue multiplier for indie perimeter security vendors —- Crossbeam’s bread and butter.

The ISR is fantastic…and if you’re a branch/satellite-office company I’d suggest it’s a very good product – still only provides limited security functionality and that’s why Cisco sells ASA’s with them.

Also, if you’re suggesting that the SMB/Branch perimeter is Crossbeam’s “bread and butter” you are completely and absolutely incorrect.  90% of our revenue comes from Large enterprise data center consolidation and service provider/MSSP/mobile operator customers.  Your definition of the “perimeter” needs work as does your understanding of what we do…again.

Cisco does more than $10b a year in Cat switching alone; by revenue, their grip on that market is comparable to Microsoft’s lock on operating systems. All it takes for Cisco to launch completely integrated network security is a credible ASA blade for the Cat6k. How far out can that be? Enterprises already buy the Firewall Switch Module.

Actually, the ASA isn’t their answer to the aging FWSM, the ACE and VSA are…and it’s got a long way to go.   By the way, who said that I’m suggesting we’re out to crush Cisco?  Beating them where they do a lousy job is a very nice living by your own math above.  How far out?  You’ll have to ask them.

The 6500 series is old in the tooth and if you read Gartner’s recent 2006 MQ for Campus LAN, their darling Cisco takes some serious knocks.  That includes the security piece.  Gasp!

And finally there’s the obvious point to be made about NAC and Cisco Security Agent, the alien larvae Cisco is trying implant into host security. NAC is a lot of bad things, but “un-integrated” is not one of them.

You’re right, but you forget that "un-integrated (?)" does not equal “functional.”  You’re also a couple of months late on this argument already…please see above.  I think your a little out-of-date on where Cisco is with CNAC…please see the report above for a very interesting look at the Gartner report.

Basically, every indie vendor has a talking point about how Cisco should just stick to the connectivity that they’re good at. This stuff all sounds good at first, but c’mon. Cisco doesn’t own connectivity because they make the best routers and switches. To claim that their routing (perimeter) and switching (internal) real estate doesn’t give them a dominant position in security is to claim that the perimeter and internal networks aren’t implicated in security. Delusional.

A dominant position or an advantage in hocking their wares because there’s some box that might be a platform to deploy it someday or today in pieces?  I’d say the latter.  Where is my bottle of Zoloft, anyway?

I agree, they haven’t done it yet, but I’ll make a statement that’s sure to get me yelled at: as soon as Cisco decides it’s ready, it can end companies like Crossbeam, Checkpoint, and SourceFire within 18 months. Isn’t not doing that, and running security as a totally seperate business unit, one of the big mistakes they made in the 90s?

Oh, OK.  They haven’t because instead of feeding the hungry, bestowing Linksys DSL routers to everyone in Kentucky or donating to stop the killing in Darfur, they’ve instead decided to give  kindly by not destroying their competitors. 

Jesus, I had no idea!  Thanks for clearing that up.   

Security is now under Jayshree’s organization which is routing/switching, and I don’t believe it has ever been a separate unit.  It should be.  That way if it doesn’t pan out they can just scrap-heap it and say that it’s a feature, not a market.

3.  Does it make sense to deploy security uniformly across the whole network, defending secretary desktops the same way you defend iSCSI servers or server-agent management consoles? No. Security should be focused on assets.

Hey, that’s a great point.  I think I made it! Please tell me how they do that?

But exactly what does this have to do with network architecture? Read Chris’ slides and it seems to mean “the way to architect your network is to hang Cisco boxes off of a couple Crossbeams in your core”.

Not quite, but your extreme-isms are starting to have me think you should write for Al-Jazeera.   How about quoting what I actually talked about…you know, like build a fast, reliable, resilient and responsive network infrastructure and overlay security as a combination of security services which provides the absolute best-of-breed security in combination where you need it, when you need it and at a price tag where the risk justifies the cost.

But that’s what you meant, right? ;)

The points Thomas pins his venom on below are from a single slide in the preso which is basically a Letterman’s top-10 spoof.  Some of them are purposely meant to incite, others are humorous, some are leverage points for the rest of the discussion that the audience and I had.

I’ll respond to some of them because many of Thomas’ objections are out of context and some are just to silly to respond to.  If you really, really want a line-by-line, I’ll do it.  Y’all just let me know ;)

2.  When’s the last time a network guy could perform a byte-level forensic trace of a Botnet C&C channel or a security guy troubleshoot a nasty BGP route-reflector distribution problem?

I don’t know. You might try asking Dug Song at Arbor, Kirby Kuehl at Cisco, or any of the Team Cymru guys. When’s the last time a security guy bought a Cisco product? Hint: it happened 5 times while you read this sentence.

Ummmm…I was referring to the average security and network practitioner in a stove-piped Enterprise or service provider, not the rest of the crew from your Saturday afternoon flag-football squad ;)

These guys, like you, are not representative of the typical folks who have to actually use the stuff we’re talking about.

You know, customers.

  3.  Managing threats and vulnerabilities is not the same as managing risk; networks don’t understand the value of the data traversing it..how can they protect it accordingly?

Cisco is not an ethernet cable. “The network” is whatever your vendor says it is. In Crossbeam’s case, “the network” is Cisco and “security” is everything else, including Checkpoint and SourceFire, both of whom sell products that Cisco has pin-compatible substitutes for.

Do any of these companies “understand the data”? No, I agree, they don’t. Is “understanding the data” important? Then let’s suspend the conversation until Cisco buys Vontu and Crossbeam partners with Vericept.

Pin-compatible?   Label-compatible, perhaps.  I think this is exactly the divergence that’s at the crux of the debate here, as the “quality” of the individual security solutions on their own (appliance or embedded) versus how they work as part of an architecture is the issue.  That’s my point, but it’s not a bullet-in-a-list sort of answer.

Also, I don’t care about Cisco buying Vontu, but what makes you think that we’re not already talking (and haven’t been for some time) to an extrusion prevention/IP Leakage vendor like Vericept?   

Crossbeam doesn’t suffer from having to wait to acquire technology and then spend 18 months butchering it to get it to work within the existing platforms (or build yet another point-solution appliance.)  We do our research in advance and when the time is right – and the customers desire it – we bring a partner’s application(s) onto the platform.

   4.  Just because two things are branded with the same name doesn’t mean they can communicate or interoperate well; just ask my wife

How’s that SourceFire/Checkpoint CPMI integration coming then? You got ISS using Snort signatures yet, or vice versa? Does anyone do app-level integration well?

Nope, and we’re not going to.  Neither will Cisco because they have no reason to if the entire network — and all the security components within — is theirs.  In fact, it’s within their interests to not have this happen.  If it did, it would just make your arguments weaker.

I’m just dinging the message and the messenger.  Our “app-level integration” is approached from a different perspective that starts first with consolidation of functions, virtualization of transport, application and policy then with the capability to flexibly pass flows through combinations of these virtual security stacks managed by the discrete parties charged with their care.  Best of breed functions that can be added to in an open platform without the need for a bunch of point solutions.

In large networks, the people responsible for FW are different than those responsible for IDS, are different than those responsible for XML, etc.   They’re still very, very vertically-stovepiped.

We don’t need to boil the ocean and we don’t.  We still have work to do on providing the overall global view of how traffic moves and is affected through these stacks, but we’re not the one blowing smoke about how this supposedly all works today.

That would be your job ;)

6.  The dirty little secret of embedding security in the “network” is that it’s the same as doing it with point-appliances…a single vendor’s set of appliances

Yes, it’s true: if Cisco succeeds in embedding security into its mainline products, you are going to be using Cisco security products. Diversity and consumer choice are valid arguments against Cisco.

But there’s one way in which using embedded security demonstrably isn’t the same as using point products: you don’t have to deploy point products to do it.

I call bullshit.  If you look at the slides in my preso, I can count over 13 different “point solutions” that aren’t routers and switches which are today relied upon to deploy this supposed “embedded” security.  The only difference between Cisco’s approach to embedded security and the appliance model is that the “appliances” are all Cisco’s.

Just because they have a Cisco label on it doesn’t make it “embedded.”

  7.  Modeling the security of the self-defending network after the human immune system and suggesting that it’s the ultimate analog is a crappy idea; people die

      Yes. What I hate about Cisco’s solutions is that you have to let a few machines on your network get infected for them to generate antigens; also, when Cisco’s security features coagulate around injuries, YouTube gets really slow.

Puff, puff, pass.  Puff, puff, pass.  You’re f-in up the rotation…man!

Please point me to a single customer in the world who has a self-defending network that functions like this.  Oh, that’s right, it’s the marketecture that you referred to in your first point and forgot that it doesn’t, actually, exist.  If YouTube being slow was the biggest problem businesses had today, you wouldn’t be employed either, T.

   8.  Security solely by acquisition does not make you a security company… just like acquiring lots of security “stuff” does not make you secure

You sure this is a good argument to make for a company that delivers 99% of its security value prop through partnerships with other companies?

Let’s ask the mean question: using product space names and market position (ie, “the #5 IPS vendor”), name some of the companies Crossbeam has turned down as partners? Cisco’s kind of picky about what it buys, you know.

It’s absolutely the right argument to make.  I guarantee you that the model of being customer-driven to take the best-in-breed security solutions from true security vendors and integrate it into a delivery architecture that is designed to do this rather than being force-fed into a retro-fit, works.  Today.

Mrt

Oh, and #5 is a long way from #1, Mr. T.

"I pity the fool who mess wit Cisco.   Unnhnhnhnhh!  I want Balboa.  Sucka!"

Oh, I’d be more than glad to email you the list of 15-20 vendors over the last 6 months that we’ve said “no” to. 

You’re about to hit my threshold trip-limit on how much of our business model you claim inside knowledge to…especially since you’re batting zero at this point.

9.  Security in breadth is not the same thing as security in depth; “good enough” security is not good enough in the data center

What aspect of Cisco’s IPS is not “good enough” for the data center?

…the same one that loses to ISS, Sourcefire, and Enterasys every day.  Want to ask the same about DDoS?  I believe the answer there would be your own beloved Arbor.

People deploy Cisco’s solution usually in conjunction with other products or the same function.  I think I’ve said enough.

Did you run your original post through the Babelfish English → Cisco parser before you copy/pasted it here, or what?

10.  Securing everything, everywhere is not only unnecessary, it’s unachievable

It is if Cisco sells it at 10 points below cost in order to turn the entire network security market into a line-item feature for the Catalyst 6000.

So you admit that this is not about the efficacy of a solution but rather how much shit you have to give away for free to be called a market leader?

Actually, with the example above, Cisco now suggests you buy a completely separate 6509 into which you put all the security functions and turn it into a “security services switch” that is plugged into the “real” switching/routing fabric. 

Sound familiar?  It does to me.

I know it doesn’t sound that way, but I’m neither a fan of Cisco nor a skeptic about Chris. But his arguments don’t take Cisco seriously, and if we’re going to armchair quarterback the security industry, why be nice about that?

You’re right, it doesn’t.  I still love you, though. 

By the way, Lindstrom and I both looked at each other and laughed when we had lunch together at the show realizing that should you ever figure out we were in Chi-town and didn’t call you that you’d be grumpy.  (I had no idea you lived in Chicago so it was all Pete’s fault.)

/Hoff

Getting “defensive” about security strategy?

November 3rd, 2006 No comments

81152612s
Uncle Mikey thinks I’m backward and defensive.  He’s referring to my post last night about the yawns I continue to experience regarding Cisco’s approach to the "self-defending network."  I’ll make no bones that more and more security will make its way into the network…that wasn’t the point.  Just because it’s there, doesn’t mean it’s worth using or actually works.  That *is* my point.

Here’s his post:

Every time Chris Hoff writes something, I wonder if he’s back. It’s
been months since he’s consistently been involved in the conversation,
and I’ve missed his participation. This piece though strikes me as a
bit defensive and backwards looking. I guess Chris just had the
epiphany that Cisco’s "Self-Defending Network" is a marketecture. Of
course it is. And yes, it’s in Cisco’s best interest to have security
everywhere, OVER TIME. I understand that your business is to sell a
"virtualized best of breed security as a service layer" stuff, but to
think that the trend is not towards having security capabilities
embedded within the fabric of the network suffers from a bit of tunnel
vision. Maybe you don’t like Cisco’s plan to get customers there, but
they will get there. To be clear, I’m not talking about right now, this
is a path that we’ll follow for the next 5-7 years. But at that time,
it’ll be about how to most effectively MANAGE the embedded
capabilities. So your "virtualized service layer" morphs into a
management layer. But I suspect you already know that, but it’s more
fun to bang up Cisco and talk about arm bars.

So he’s right.  I am backward — more specifically contrarian. I am also "defensive" because I could give a shit if big is the new small, purple is the new black or men wearing lipstick is socially acceptable.  What *I* care about is solving security and survivability problems TODAY…that same marketecture that you call out is taking place over 5-7 years supposedly started 5-7 years ago according to John Chambers!

How many decades are you willing to wait just to say "I told you so" in regards to your prophetic exclamation that security will become more integrated into the network?    Convenience and cost aren’t all they’re cracked up to be.  Sometimes the stuff actually has to work!

It’s not like you have to be Ms. Cleo to see what Cisco’s doing, but you don’t have to pretend to be blind and accept that it’s the cure for world hunger, also.

This piece though strikes me as a
bit defensive and backwards looking. I guess Chris just had the
epiphany that Cisco’s "Self-Defending Network" is a marketecture. Of
course it is. And yes, it’s in Cisco’s best interest to have security
everywhere, OVER TIME. I understand that your business is to sell a
"virtualized best of breed security as a service layer" stuff, but to
think that the trend is not towards having security capabilities
embedded within the fabric of the network suffers from a bit of tunnel
vision.

No, I didn’t *just* have this epiphany, it’s been the bane of my (and almost everyone else I talk to) existence for years.  I didn’t say  that security isn’t trending into the network, Mike.  What I said is that it’s a flawed approach with an even more flawed  genesis.  Here’s a turets-inspired outburst for you:

You don’t need security everywhere, all the time.  The network will never have the intelligence to make decisions on content in context.  The balance of delivery versus security will ALWAYS swing to the former in Cisco’s world.  CISCO IS NOT A SECURITY COMPANY.

The entire corner piece for Cisco’s SDN strategy for the last few years has been on CSA — software running on damned host!  Like Stiennon says, relying on the health of the very end-point you’re trying to protect to ensure the basis of your network’s viability and survivability is freaking ludicrous.  NAC is important, but up until last year, that was it in terms of the self-defending network — leave it to the host.  Now you can send telemetry to build dynamic ACL’s.   There’s a giant step forward.

Oh, but network vendors are from venus and security folks will use MARS — is that it?

Slapping together a bunch of stuff from acquisition is security in breadth not security in depth.

Maybe you don’t like Cisco’s plan to get customers there, but
they will get there. To be clear, I’m not talking about right now, this
is a path that we’ll follow for the next 5-7 years. But at that time,
it’ll be about how to most effectively MANAGE the embedded
capabilities. So your "virtualized service layer" morphs into a
management layer. But I suspect you already know that, but it’s more
fun to bang up Cisco and talk about arm bars.

You know what, Mike?  Kindly define "there" for me.  Because if you define "there" as a cobbled together bunch of appliances, routers and switches trying to effect security dispositions across an infrastructure and security monoculture without being able to make decisions on content and context, then I totally agree with you.

Screw waiting for this stuff, Mike.  They are the biggest networking company on the planet and it’s already been 5 years.  They keep announcing strategies like they’re a special on aisle 7 and then putting them on the discount shelf when they don’t pan out.

Take AON for example.  I always used to joke it would take an EON for AON.  I’m right.  That whole thing was a crock of…and now it’s, um, moved sideways to be integrated into yet another "strategy" because architects are smart enough to detect a polished turd when they see one.

Cisco is not the answer to life, the universe and everything else.  People are NOT willing to bet their business, reputation and company’s health on another marketecture.  People also are fed up with a single vendor’s version of the truth.  That’s why there are 600+ vendors in the network security space.

Does Cisco have huge marketshare?  In networking, yes.  But over 70% of security dollars spent DO NOT GO TO CISCO.

Will Cisco "get there."  Sure.  I wonder, however, if "there" is where people really care about being.

I don’t.  My customers have problems they need solved today that overlay and work synergistically with very reliable, fast, available and robust network plumbing.  In the data center, protecting the things that matter most, good enough is NOT good enough.

At the SMB perimeter, it is.

I think, quite honestly, that you’re the one with the myopic lens — all you see is a freight train heading towards you not realizing all you have to do is jump tracks. 

All aboard!

Defending the Self-Defending Network

November 3rd, 2006 3 comments

Firewall_breach_jpg
I recently gave a session presentation at TechTarget’s Information Security Decisions show in Chicago.  The topic of my presentation was "Defending the Self-Defending Network with Virtualized Enterprise UTM."  They’re actually making a roaming seminar series out of it.

Must have been the shirts and iPods I gave away?

What’s the presentation summary?  Simple.  "Embedded" network security as proposed by Cisco is a pipe dream.  In fact, it’s nothing more than the aging appliance model with boxes NOT embedded into the routers and switches at all; they’re just a single vendor’s appliances disguised as "security enablers."

The "Self-Defending Network" is a marketecture.  It’s not feasbile, unreasonable, fiscally mis-aligned to (and unaware of) the value of the assets it protects and the worst example of risk management modeling; protecting everything, everywhere, all the time is stupid.

You ought to protect the things that matter most with the best defense possible, where needed, when needed and at a cost where the risk justifies the cost.  Box sprinkling security is so last Wednesday.

You should build a stable, resilient, fast and reliable network.  Stir in some basic "embedded" or appliancized security functionality as acceptable and then overlay virtualized best-of-breed security as a service layer.  See the post regarding SSOA (Security Service Oriented Architectures) below for the full picture.

On a more theatric note…

The wonderful marketing mavens who dreamed up the theme for my session chose football.  I grew up in New Zealand.  I know Rugby.  Moreover, what I really wanted to do was to build a theme around the sport I love most, Mixed Maritial Arts — a’la Ultimate Fighting Championship (UFC.) 

For some reason they thought that using terms such as "Kimora," "Arm bar," "tap-out by submission," and "rear naked choke" would have some sort of negative impact.  I think it’s the perfect model for a network security presentation…so did about 30 of the guys who came back to the booth to discuss the recent UFC match between Rich Franklin and "Spider" Silva…Mui Thai clinches and about 5 knees to the head…awesome!

At any rate, you’ll appreciate my lame attempts at football analogies then.

Here’s a link to the presentation if you’re interested.

Chris