Top IT Security Bloggers

Network World - Networking Nuggets and Security Snippets
  • White House Cybersecurity Coordinator Is Kind of Right – but Mostly Wrong

    Network World - Networking Nuggets and Security Snippets
    Poor Michael Daniel, the White House cybersecurity coordinator and the man who “leads the interagency development of national cybersecurity strategy and policy” is taking a beating in the press.  In a recent interview with federally-focused media outlet, GovInfoSecurity, Daniel defended his lack of security technology experience with the following statement: 
    "You don't have to be a coder in order to really do well in this position.  In fact, actually, I think being too down in the weeds at the technical level could actually be a little bit of a distraction.  You can get taken up and enamored with the very detailed aspects of some of the technical solutions and the real issue is looking at the broad strategic picture."To read this article in full or to leave a comment, please click here
  • Security pros speak out on SDN uses for network security

    Network World - Networking Nuggets and Security Snippets
    At this week’s VMworld shindig in San Francisco, many networking and security vendors will crow about software-defined security and software use cases for SDN. Some of this rhetoric will be nothing more than industry hype, while other banter may prove to be extremely useful in the near future. Yes, there are many interesting ways that SDN could work to enhance network security. That said, which SDN/network security use cases are really compelling and which could be considered second-tier? ESG research asked this specific question to security professionals working at enterprise organizations (i.e. more than 1,000 employees) as part of a recent network security research report (note:  I am an ESG employee). Here are the top 5 SDN use cases for network security:To read this article in full or to leave a comment, please click here
  • Virtual Security Remains Anathema to Many Organizations

    Network World - Networking Nuggets and Security Snippets
    Next week, the IT industry will gather in San Francisco to discuss all things cloud and virtualization at VMworld. The discussion will center on “software-defined data centers” which will quickly morph to “software-defined security” in my world (Writer’s note:  In my humble opinion, this is a meaningless marketing term and I don’t understand why an industry that should be focused on digital safety acts like its selling snake oil). So we are likely to hear about the latest virtual security widgets, VMware NSX, and OpenStack integration, virtual security orchestration, etc.This will make for fun and visionary discussions, but there’s one critical problem: while almost every enterprise has embraced server virtualization and many are playing with cloud platforms, lots of organizations continue to eschew or minimize the use of virtual security technologies – even though they’ve had years of experience with VMware, Hyper-V, KVM, Xen, etc. According to ESG research, 25% of enterprises use virtual security technologies “extensively,” while 49% use virtual security technologies “somewhat,” and the remaining 25% endure on the sidelines (note: I am an ESG employee). To read this article in full or to leave a comment, please click here
  • Figuring out FIDO (i.e. the Fast IDentity Online alliance and standard)

    Network World - Networking Nuggets and Security Snippets
    No one hates passwords more than I do and it seems like I’m asked to register for a new site each day.  For those of us in the know, this situation of “password sprawl” is even more frustrating because we really should have solved this problem years ago.  After all, Whit Diffie, Marty Hellman, and the RSA guys first came up with PKI back in the 1970s so you’d think that passwords would be dead and strong authentication would be ubiquitous by now!
    Thankfully, there may be hope on the horizon in the form of the FIDO alliance.  The group, composed on a who’s who of industry big shots like ARM, Bank of America, Discover Card, Google, Lenovo, MasterCard, Microsoft, PayPal, RSA, Samsung, and VISA, is “developing technical specifications that define an open, scalable, interoperable set of mechanisms that reduce the reliance of passwords to authenticate users.”  In other words, FIDO wants to introduce “trusted convenience” by making strong authentication easy to deploy and easy to use on the front-end (i.e. for users) and back-end (i.e. for IT). To read this article in full or to leave a comment, please click here
  • Enterprise Organizations Need Formal Incident Response Programs

    Network World - Networking Nuggets and Security Snippets
    I spent the early part of my IT career in the storage industry, mostly with EMC Corporation.  Back then, large storage subsystems were equated with IBM mainframe computers, with a heavy emphasis on the financial services market. 
    Given this market alignment, I became quite familiar with the concept of business continuity/disaster recovery (BC/DR) way back in the 1990s.  Techopedia defines BC/DR as follows:
    Business continuity and disaster recovery (BCDR or BC/DR) is a set of processes and techniques used to help an organization recover from a disaster and continue or resume routine business operations. It is a broad term that combines the roles and functions of IT and business in the aftermath of a disaster. To read this article in full or to leave a comment, please click here
  • My Final Impressions of Black Hat 2014

    Network World - Networking Nuggets and Security Snippets
    I attended Black Hat 2014 in Las Vegas last week and wanted to write a post while I’m still feeling the buzz of the event. Here are just a few of my takeaways:
    Black Hat = High Energy.  I attended Interop at the same venue (Mandalay Bay) for many years but I noticed that the event was getting stale and rather morose recently.  It was quite invigorating then to witness the high-energy security crowd at Black Hat in comparison.  There was lots of energy, great discourse, and plenty of knowledge transfer.  Yes, there was commercialism and Vegas schmaltz, but Black Hat is more of a community get together than your typical stale trade show – and way more lively than Interop post the late 1990s.
    Black Hat vs. RSA.  When I worked at EMC back in the late 1980s, one of the common sales mantras of the company was, “people who know how always work for people who know why.”  This was a “solution selling” message intended to get the sales team to focus on the “why” customers who own business processes, financial results, and budgets, rather than the “how” customers who twiddle bits and bytes.  With this analogy in mind, RSA is a “why” conference while Black Hat (and to some extent, (DEFCON) is a “how” conference.  With this explained, there is also a difference as cybersecurity is a hardcore “how” discipline that revolves around the folks who know how to twiddle bits and bytes or can detect when someone else has twiddled bits and bytes in a malicious way.  In my humble opinion, these two shows complement each other.  Yes, we need extremely competent CISOs who know business, IT, and security technology but we must also have security practitioners with deep technical skills, devotion, and passion.  RSA is focused on the former while Black Hat/DEFCON appeals to the latter. 
    Security vendors should be at Black Hat.  Many leading security vendors passed on Black Hat and allocated event budget dollars to RSA and shows like VMware instead.  I get this but would suggest that they find ways to spread event investments around so they can attend Black Hat 2015.  Why?  Black Hat attendees may not be budget holders but they are the actual people who influence technology decisions and make up the majority of the cybersecurity community at large.  These are the people who choose cybersecurity technologies that can meet technical requirements.   Creative security technology vendors can also approach Black Hat as a recruiting opportunity, not just a sales and marketing event. 
    I left Black Hat with even more cybersecurity concern.  I’m in the middle of this world all the time so I hear about lots more about the bad guys’ Tactics, Techniques, and Practices (TTPs) than most people do.  Even so, I spent the week hearing additional scary stories.  For example, Blue Coat labs reported on 660 million hosts with a 24 hour lifespan it calls “one-day wonders.”  As you can imagine, many of these hosts are malicious and their rapid lifespan files under the radar of signature-based security tools and threat intelligence.  I also learned more about the “Operation Emmantel,” (i.e. from Trend Micro) that changes DNS settings and installs SSL certificates on clients, intercepts legitimate One-time passwords (OTPs) and steals lots of money from online banking customers.  Black Hat chatter served as further evidence that our cyber-adversaries are not only highly-skilled, but way more organized than most people think. 
    Endpoint security is truly “in play.”  A few years ago, endpoint security meant antivirus software and a cozy oligopoly dominated by McAfee, Symantec, and Trend Micro (and to some extent, Kaspersky Lab and Sophos as well).  To use Las Vegas terminology, all bets are off with regard to endpoint security now.  With the rash of targeted attacks and successful security breaches over the past few years, enterprise organizations are questioning the value of AV and looking for layered endpoint defenses.  Given this market churn, Black Hat was an endpoint security nexus with upstarts like Bromium, Cisco, Crowdstrike, Digital Guardian (formerly Verdasys), Druva, FireEye, Guidance Software, IBM, Invincea, Palo Alto Networks, Raytheon Cyber Products, RSA, and Webroot ready to talk about “next-generation” endpoint security requirements and products.  While the incumbents have an advantage, endpoint security is becoming a wide-open market as evidenced by the crowd at Black Hat. 

    Black Hat is a great combination of Las Vegas shtick, hacker irreverence, and a serious cybersecurity focus.  Yup, it’s only a tradeshow but there is a serious undercurrent at Black Hat/DEFCON that is sorely missing from most IT events. To read this article in full or to leave a comment, please click here
  • Cloud Security Priorities and Synergies with Enterprise Security

    Network World - Networking Nuggets and Security Snippets
    According to ESG research, 63% of mid-market (i.e. 250 to 999 employees) and enterprise (i.e. more than 1,000 employees) are currently using Software-as-a Service (SaaS), 33% use Infrastructure-as-a-Service (IaaS), and 27% employ Platform-as-a-Service (PaaS) today (note: I am an ESG employee).  Additionally, 72% of all firms are increasing their spending on cloud computing initiatives this year.Wasn’t IT risk supposed to put the brakes on cloud computing deployment?  Security professionals are still quite concerned.  In a recent ESG research survey, infosec pros identified numerous cloud security risk areas as follows:
    33% of enterprise security professionals said: “a lack control over security operations directly related to IT resources used for internal purposes.”
    31% of enterprise security professionals said: “privacy concerns over sensitive and/or regulated data stored and/or processed by a cloud infrastructure provider.”
    29% of enterprise security professionals said: “lack of security visibility into cloud services infrastructure.”
    28% of enterprise security professionals said: “a security breach that compromises our cloud service providers’ infrastructure.”
    27% of enterprise security professionals said: “poor infosec practices at our cloud service provider(s).”

    These are clearly legitimate concerns (the kind that keep CISOs up at night!), yet it seems like the proverbial horse has left the barn on cloud computing.  Enterprise organizations may be proceeding with caution, but they are proceeding nonetheless. To read this article in full or to leave a comment, please click here
  • Anticipating Black Hat 2014

    Network World - Networking Nuggets and Security Snippets
    RSA 2014 seems like ancient history, and the 2015 event isn’t until next April.  No worries however, the industry is set to gather in the Las Vegas heat next week for cocktails, sushi bars, and oh yeah – Black Hat.Now, Black Hat is an interesting blend of constituents consisting of government gum shoes, Sand Hill Rd. Merlot-drinking VCs, cybersecurity business wonks, “beautiful mind” academics, and tattooed hackers – my kind of crowd! As such, we aren’t likely to hear much about NIST frameworks, GRC, or CISO strategies. Alternatively, I am looking forward to deep discussions on:
    Advanced malware tactics. Some of my favorite cybersecurity researchers will be in town to describe what they are seeing “in the wild.” These discussions are extremely informative and scary at the same time. This is where industry analysts like me learn about the latest evasion techniques, man-in-the-browser attacks, and whether mobile malware will really impact enterprise organizations. 
    The anatomy of various security breaches.  Breaches at organizations like the New York Times, Nordstrom, Target, and the Wall Street Journal receive lots of media attention, but the actual details of attacks like these are far too technical for business publications or media outlets like CNN and Fox News.  These “kill chain” details are exactly what we industry insiders crave as they provide play-by-play commentary about the cybersecurity cat-and-mouse game we live in.
    Threat intelligence.  All of the leading infosec vendors (i.e. Blue Coat, Cisco, Check Point, HP, IBM, Juniper, McAfee, RSA, Symantec, Trend Micro, Webroot etc.) have been offering threat intelligence for years, yet threat intelligence will be one of the major highlights at Black Hat.  Why?  Because not all security and/or threat intelligence is created equally.  Newer players like BitSight, Crowdstrike, iSight Partners, Norse, RiskIQ, and Vorstack are slicing and dicing threat intelligence and customizing it for specific industries and use cases.  Other vendors like Fortinet and Palo Alto Networks are actively sharing threat intelligence and encouraging other security insiders to join.  Finally, there is a global hue and cry for intelligence sharing that includes industry standards (i.e. CybOX, STIX, TAXII, etc.) and even pending legislation.  All of these things should create an interesting discourse. 
    Big data security analytics.  This is an area I follow closely that is changing on a daily basis.  It’s also an interesting community of vendors.  Some (i.e. 21CT, ISC8, Leidos, Lockheed-Martin, Norse, Palantir, Raytheon, etc.), come from the post 9/11 “total information access” world, while others (Click Security, HP, IBM, Lancope, LogRhythm, RSA, etc.) are firmly rooted in the infosec industry.  I look forward to a lively discussion about geeky topics like algorithms, machine learning, and visual analytics. 

    Las Vegas is simultaneously one of the most fun and banal places on earth, but next week it will become a hotbed of cybersecurity intrigue, intelligence, and brainpower.  It’s likely to be 115 degrees in the shade, but I can’t wait to get there. To read this article in full or to leave a comment, please click here
  • Cybersecurity Startup Gold Rush for Venture Capitalists

    Network World - Networking Nuggets and Security Snippets
    According to PrivCo, a financial data provider on privately-held companies, venture capital firms are poised to push $788 million into early stage cybersecurity startups this year.  This investment amounts to a 74% increase from last year’s $452 million (note:  see this article for more details).
    If you follow cybersecurity trends, it’s easy to understand why VCs fat cats are throwing money around.  For one thing, the threat landscape continues to become increasingly dangerous.  In fact, ESG research indicates that 57% of security professionals working at enterprise organizations (i.e. more than 1,000 employees) believe that the threat landscape is “significantly worse” or “somewhat worse” than it was 2 years ago (note: I am an ESG employee).  So large organizations clearly need help and there are rich rewards waiting for cybersecurity vendors that can come to their aid – after announcing better than expected financial results, Check Point and Fortinet shares are trading at or near a 52-week high.To read this article in full or to leave a comment, please click here
  • BYOA: Bring Your Own Authentication

    Network World - Networking Nuggets and Security Snippets
    Most people who uses IT or Internet application would agree that the current user name/password mode of authentication is cumbersome, ineffective, and obsolete.  According to ESG research, 55% of information security professionals working at enterprise organizations (i.e. more than 1,000 employees) believe that user/name password authentication should be completely eliminated or relegated to non-business critical applications only (note:  I am an ESG employee).Recognizing the foibles of user names and passwords, ESG research indicates that 57% of enterprise organizations use multi-factor authentication technologies.  Unfortunately, multi-factor authentication technology has been too expensive and complex to roll-out across enterprises or offer to on-line consumers.To read this article in full or to leave a comment, please click here
CSO Corporate Partners
  • f5
  • Webroot
  • Trend Micro
  • NetIQ
rhs_login_lockGet exclusive access to CSO, invitation only events, reports & analysis.
CSO Directory

Enterprise Virtualisation Security

Deep Security provides a comprehensive Server Security Platform giving organisations advanced protection for Physical, Virtual, and Cloud Servers.

Security Awareness Tip
Security ABC Guides

Warning: Tips for secure mobile holiday shopping

I’m dating myself, but I remember when holiday shopping involved pouring through ads in the Sunday paper, placing actual phone calls from tethered land lines to research product stock and availability, and actually driving places to pick things up. Now, holiday shoppers can do all of that from a smartphone or tablet in a few seconds, but there are some security pitfalls to be aware of.