Rational Survivability

Those of you who know me realize that no matter where I go, who I work for or who’s buying me drinks, I am going to passionately say what I believe at the expense of sometimes being perceived as a bit of a pot-stirrer. 

I’m far from being impartial on many topics — I don’t believe that anyone is truly impartial about anything —  but at the same time, I have an open mind and will gladly listen to points raised in response to anything I say.  I may not agree with it, but I’ll also tell you why. 

What I have zero patience for, however, is when I get twisted semantic marketing spin responses.  It makes me grumpy.  That’s probably why Rothman, Shimmy and I get along so well.

Some of you might remember grudge match #1 between me and Alex Niehaus, the former VP of Marketing for Astaro (coincidence?)  This might become grudge match #2.  People will undoubtedly roll their eyes and dismiss this as vendors sniping at one another.  So be it.  Please see paragraphs #1 and 2 above. 

My recent interchange with Richard Stiennon is an extension of arguments we’ve been having for a year or so from when Richard was still an independent analyst.  He is now employed as the Chief Marketing Officer at Fortinet. 

Our disagreements have intensified for what can only be described as obvious reasons, but I’m starting to get as purturbed as I did with Alex Neihaus when the marketing sewerage obfuscates the real issues with hand-waving and hyperbole. 

I called Richard out recently for what I believed to be complete doubletalk on his stance on UTM and he responded here in a comment.  Comments get buried so I want to bring this back up to the top of the stack for all to see.  Don’t mistake this as a personal attack against Richard, but a dissection of what Richard says.  I think it’s just gobbledygook.

To be honest, I think it took a lot of guts to respond, but his answer makes my head spin as much as Anna Nicole Smith in a cheesecake factory.  Yes, I know she’s dead, but she loved cheesecake and I’m pressed for an analogy.

The beauty of blogging is that the instant you say something, it becomes a record of "fact."  That can be good or bad depending upon what you say. 

I will begin to respond to Richard’s retort wherein he first summarily states:

Here is where I stand. I hate the huge bucket that UTM has become.  Absolutely every form of gateway security can be lumped in to this
category that IDC invented. We discussed this at RSA on the panel that
Mr. Rothman so graciously hosted.

I also assume that this means Richard hates the bit buckets that Firewall, IPS, NAC, VA/VM, and Patch Management (as examples) have become, too?   This trend is the natural by-product of marketers and strategists scrambling to find a place to hang their hat in a very crowded space.  So what.

UTM is about solving applied sets of business problems.  You can call it what you like, but the only reason marketeers either love or hate UTM usually depends upon where they sit in the rankings.  This intrigues me, Richard, because (as you mention further on) Fortinet pays to be a part of IDC’s UTM Tracker, and they rank Fortinet as #1 in at least one of the product price ranges, so someone at Fortinet seems to think UTM is a decent market to hang a shingle on.

Hate it or not, Fortinet is a UTM vendor, just like Crossbeam.  Both companies hang their shingles on this market because it’s established and tracked.

When trying to classify a market you
look for common traits and, even better, common buying patterns, to
help lump vendors or products in to a category. But for Crossbeam,
Fortinet, and Astaro to be lumped together has always struck me as a
sign that the UTM "market" was not going to work.

You’re right.  Lumping Crossbeam with Fortinet and Astaro is the wrong thing to do.  😉

Arguing the viability of a market which has tremendous coverage and validated presence seems a little odd.  Crafting a true strategy of differentiation as to how you’re different in that market is a good thing, however.

I much prefer the Gartner view (as I would) of Security Platforms.
These are devices that are able to apply security policies using a
bunch of different methods and they can loosely be thrown on to a grid…

So what you’re saying is that you like the nebulous and ill-defined blob that is Gartner’s view, don’t like IDC, but you’ll gladly pay for their services to declare you #1 in a market you don’t respect?

Now, yes, I did join a company that IDC considers to be a major UTM
player- leading in volume shipments in those parts of 2006 that they
are reporting. But, I was an independent analyst and I NEVER classified
Fortinet as a UTM play.

You mean besides when you said:

"By all accounts the so called UTM market is doing very well with players like Fortinet, Barracuda, Sonicwall, Astaro, and Watchguard, evidently seeing considerable success" 

Just in case you’re interested, you can find that quote here.   There are many, many other examples of you saying this, by the way.  Podcasts, blog entries, etc.

Also, are you suggesting that Fortinet does not consider itself a UTM player?  Someone better tell the Marketing department.  Look at one of your news pages on your website.  Say, this one, for example — 10 articles have UTM in the title and your own Mr. Akomoto (VP of Fortinet, Japan) says "The UTM market was pioneered by us," says Mr. Okamoto, the vice-president of Fortinet Japan. Mr. Okamoto explains how Fortinet created the UTM category, the initial
popularity of UTM solutions with SMBs…" 

Heck, in the 24 categories for the security
market that I maintained I did not even track UTMs. As I tracked
Fortinet over the years I considered them a security platform vendor
and one that just happened to be executing on my vision for the network
security space.

Yes, I understand how much you dislike IDC.  Can you kindly show reference to where you previously commented on how Fortinet was executing on your vision for Secure Network Fabric?  I can show you where you did for Crossbeam — it was at our Sales Meeting two years ago where you presented.  I can even upload the slide presentation if you like.

As you know Chris I have always been a big fan of Crossbeam and in
the interest of full disclosure, Crossbeam was a client while I was a
Gartner analyst and my second client when I launched my own firm. Great
people and a great product.

Richard, I’m not really looking for the renewal of your Crossbeam Fan Club membership…really.

Crossbeam is the security platform of
choice for running legacy security apps.

Oh, now it’s on!  I’m fixin’ to get "Old Testament" on you!

Just so we’re clear, ISV applications that run on Crossbeam such as XML gateways, web-application firewalls, database firewalls and next generation network converged security services such as session border controllers are all UTM "legacy applications!?" 

So besides an ASIC for AV, what "new" non-legacy apps does Fortinet bring to the table?  I mean now.  From the Fortinet homepage, please demonstrate which novel new applications that Firewall, IPS, VPN, Web filtering and Antispam represent?

It must suck to have to craft a story around boat-anchor ASICs that can’t extend past AV offload.  That means you have to rely on software and innovation in that space.  Cobbling together a bunch of "legacy" applications with a nice GUI doesn’t necessarily represent innovation and "next generation." 

Now let’s address the concept of running multiple security defenses
on one security platform. Let’s take three such functions, Firewalling,
VPN, and IPS. Thanks to Checkpoint, firewalls and VPN are frequently
bundled together. It has become the norm, although in the early days
these were separate boxes. Now, you can either take a Snort
implementation and bolt it on to your firewall in such a way that a
signature can trigger a temporary block command ala Checkpoint and a
bunch of other so called IPS devices or you can create a deep packet
inspection capable firewall that can apply policies like: No Worm
Traffic. To do the latter you have to start from scratch. You need new
technology and several vendors do this pretty well.

It’s clear you have a very deluded interesting perspective on security applications. The "innovation" that you’re suggesting differentiates what has classically been described as the natrual evolution of converging marketspaces.  That over-played Snort analogy is crap.  The old "signature" vs. "anomaly detection" argument paired with "deep packet inspection" is tired.  Fortinet doesn’t really do anything that anyone else can’t/doesn’t already do.  Except for violating GPL, that is.

I suppose now that Check Point has acquired NFR, their technology is crap, too?  Marcus would be proud.

So, given a new way to firewall (payload inspection instead of
stateful inspection) what enterprise would choose *not* to use IPS
capability in their firewall and use a separate device behind the
firewall? See the trouble? A legacy firewall is NO LONGER BEST OF
BREED! The best of breed firewall can do IPS.

Oh come on, Richard.  First of all, the answer to your question is that many, many large enterprises and service providers utilize a layered defense and place an IPS before or after their firewall.  Some have requirements for firewall/IDS/IPS pairs from different vendors.  Others require defense in depth and do not trust that the competence in a solutions provider that claims to "do it all."

Best of breed is what the customer defines as best of breed.  Just to be clear, would you consider Fortinet to be best of breed?

If you use a Crossbeam, by the way, it’s not a separate device and you’re not limited to just using the firewall or IPS in "front of" or "behind" one another.  You can virtualize placement wherever you desire.  Also, in many large enterprises, using IPS’s and firewalls from separate vendors is not only good practice but also required.

How does Fortinet accomplish that?

Your "payload inspection" is leveraging a bunch of OSS-based functionality paired with an ASIC that is used for AV — you know, signatures — with heuristics and a nice GUI.  Whilst the Cosine IP Fortinet acquired represents some very interesting technology for provisioning and such, it ain’t in your boxes.

You’re really trying to pick a fight with me about Check Point when you choose to also ignore the fact that we run up to 15 other applications such as SourceFire and ISS on the same platform?  We all know you dislike Check Point.  Get over it.

I have spent eight of the last 12 weeks on the road meeting our
large enterprise clients in the Americas, Asia, and EMEA. None of them
shop comparatively for UTM appliances. Every single customer was
shopping for firewall upgrades, SSL VPN, spam or virus filtering
inline, etc.

Really?  So since you don’t have separate products to address these (Fortinet sells UTM, afterall) that means you had nothing to offer them?  Convergence is driving UTM adoption.  You can call it what you want, but you’re whitewashing to prove a flawed theorem.

During the sales process they realize the benefit of
combined functionality that comes with the ability to process payloads
and invariably sign up for more than just a single security function.
Does that mean UTM is gaining traction in the enterprise? To me the
answer is no. It means that the enterprise is looking for advanced
security platforms that can deliver better security at lower capex and
opex.

…and what the heck is the difference between that and UTM, exactly?  People don’t buy IPS, they buy network level protection to defend against attack.  IPS is just the product catagory, as is UTM. 

I would lay off the Bourbon Chris. Try a snifter of my 16 yr old
Lagavulin that I picked up in London this Friday. It will help to
mellow you out.

I don’t like Scotch, Richard.  It leaves a bad taste in my mouth…sort of like your response 😉