Token Security Guy

RSA Conference: The New Modern Pentathlon

After last year's commentary on RSA Conference Personas I thought this year's "Sundance for Ugly People" should adopt a more sporting theme - "March Madness for the Truly Uncoordinated".

What's more, Hot on the heels of the Olympics I think it's high time that the Modern Pentathlon got an update - I mean come on...shooting, horseback riding, fencing, swimming and cross country running are hardly great examples of modernity now are they?

Funnily enough, the Modern Pentathlon is one of the few events we Brits usually get a medal at. Mostly because they were great skills for dominating lesser developed countries - a sport Brits were real "world beaters" at (literally) when the Modern Pentathlon was truly modern - but kept up as a more benevolent attitude to world affairs took hold.

Anyway, since times have changed I propose an updated RSA Conference Modern Pentathlon to be performed on the expo floor

1. Booth Bunny Boring - the basic aim of the game is to come up with the most banal and blatant chat up lines for the "hired help" at vendor booths. Examples include "Do you do many of these shows?" and "Wow, that super hero outfit really shows off your best assets". Points are awarded for banality, delivery style and exactly how far the victim's eyes roll up into the head
2. Booth Bunny Belligerence - a game of skill which involves deliberately mistaking a vendor employee for booth "hired help" and eliciting a huffy response as a result. This game of tactics involves careful choosing of victim; a victim who is seldom mistaken for "hired help" will be flattered, and one who is routinely mis-identified will have grown to accept and indeed embrace this elevated status. Choosing the middle ground here is key to getting a truly snarky comeback - points are awarded solely on the basis of the voracity of reaction.
3. Narcissistic Tweeting - slightly different rules here for vendors and everyone else. Vendors must Tweet enthusiastically about very minor conference announcements e.g. "Wow! Exciting News! <PRODUCT NAME> v7.3.2 out today!!! http://bit.ly/whogivesacrap". Points awarded on the basis of the delta between how much people within the confines of the 20x20 booth give a rats proverbial in contrast to the rest of the world. For everyone else, points awarded for the quality of the Re-Tweet including a cutting putdown that can still fit within 140 characters
4. Booth Baiting - usually a less challenging sport as the expo drags on into day three, this game simply involves annoying vendor personnel until threats of violence ensue. In-depth knowledge of the vendor's weaknesses, plus their top competitor's strengths, plus a truly arrogant attitude are extremely useful traits for success in Booth Baiting. Again, points are awarded for grace under pressure and stregth of reaction.
5. Booth Game Hogging - this endurance sport involves hogging the Wii Bowling, Rock Band or whatever other cheap trick the vendor is attempting to get semi-interested conference-goers to listen to their pitch and fill their lead database with badge-scans from anyone who will listen. Points are awarded for a combination of total time spent at a single booth playing the game, and quality of snarky comments aimed at any real prospects who eventually pry the controller out of your hands. Bonus points awarded for restraining orders taken out by vendor.

Anyway, happy Pentathlon-ing (or whatever the verb is) and remember to swing by the RSA booth

Putting the process back in "people, technology & process"

If you're anything like me, you're always trying to make your life more interesting, and trying to add that bit of value back into your organization (for purely selfless reasons of course). Here's a conclusion I've come to if you work for anything larger than a few-person company.

Whatever you're doing it ain't worth jack if it's not backed up by a process.

Here in vendor land, I can create the best presentations in the world, but they aren't worth jack if they're not backed up by a process to distribute and socialize them with customers, partners, sales folks or whomever. I can have the best ideas for new initiatives, but they aren't worth jack if there's no process for submitting, prioritizing and getting budget for those ideas (without those processes, the squeaky wheel gets the grease, and that sometimes works in my favor)

Same goes for security - you can never show how good a job you're doing it you haven't got a process that you can track and measure. Whether that process be around identifying threats, dealing with audit findings, dealing with incidents, managing identities and privileges, evaluating new business initiatives, reviewing new applications for security bugs, whatever. "But what about policy?" I hear you ask. Policy becomes that thing that only you refer to, without a process to distribute it and track who's working towards complying with it.

In the absence of a process, you get judged on those events that people hear about - and in security those events seldom work in your favor.

Yeah, yeah, yeah, we've all heard the spiel about people, process and technology, but you seldom get kudos for hiring new people, and you're seldom in a position to eliminate people voluntarily (and which of us really wants to do that anyway?). Implementing technology alone  - while interesting - seldom gets us where we want to be (because for technology - more often that not it ain't worth jack without a process to make the product work as it should). Besides, these days budget for technology is hard to come by.

So - process is where the likes of you and me can really make a difference. And what's awesome about processes, is that while everybody loves having a good process in place (don't laugh - if you've ever worked in a medium to large organization, the lack of a process can be the most frustrating thing on earth), few people really step back to look at what processes you can put in place to eliminate your frustrations. Even an attempt at formalizing and tracking the processes you're carrying out on a daily basis will make you look like a rock star.

So love your processes. Embrace them - it's a way to get on.

Enterprise GRC – now it gets deep

Now apart from being lazy and inquisitive, we humans are also generally pretty greedy and short sighted.

Now before I get comments about dissing humans, I’d like to point out that I am one, I married one, and both my children are humans. But I’m sure we’ll all admit that on occasions we are prone to taking short cuts. Now a good business, all being well, should outlast all of us. Well that’s the intention. So in order to increase the likelihood that it does, there are certain things a company needs to do to make sure the shortcuts and self-serving actions  each of us take don’t end up harming it in the long run.

A company needs an awareness of the world around it, the interdependencies of the moving parts that comprise it, the social and political environment in which it operates, and the rules by which it needs to abide.

Wow. That’s pretty deep. But no matter what the issue, at the end of the day, it comes back to the same 5 things a company needs. A company needs:

1.    A policy that reflects its goals, and make sure people know about it

2.    A way to carry out that policy

3.    A way to make sure that policy is being carried out

4.    A way to find out how well the policy is working

5.    A way to deal with the times when the policy’s not being effective

Whether the issue be around lending to uncreditworthy people, bribing foreign government officials or using carcinogens in its products, these steps still hold. Now no one tool is ever going to meet the needs across every issue, but companies use Archer for a surprising array of GRC use cases, and its flexibility to adapt to different issues is astounding.

But what does this have to do with IT security, I hear you ask? Well, when you present a business case for an IT security tool, remember that all the goals, risks and rules that you use to present a business case to an executive – you’re in competition for budget with issues that face similar challenges, but you’ve likely never considered.

The world of GRC can be both fascinating and mind-numbingly boring at the same time. But my former colleagues Chris McClean of Forrester and Michael Rasmussen of Corporate Integrity do a great job of about this space – I’d recommend you check them out.

IT is just the rest of the world in 1’s and 0’s

Being a security guy first, an IT guy second, and an employee third (“human” comes a distant 7th behind Yorkshireman, Red Sox Fan and Massachusetts resident) , we IT Security types sometimes forget that most of the problems we face have strange parallels elsewhere in our companies.

For example, companies have goals, rules and risks around:

• Where their facilities are and how they run them
• Whom they employ
  
• Which companies they buy things from, sell things to, and partner with
  

Again, in each of these cases, to make sure they do things in the company’s best interests they need to:

1.      Have a policy that reflects their goals and make sure people know about it

2.      Have a way to carry out the policy

3.      Have a way to make sure the policy is being carried out

4.      Have a way to find out how well the policy is working

5.      Have a way to deal with the times the policy’s not being effective.

Many of Archer’s customers use Archer way beyond the realms of IT, from tracking health and safety issues, to HR issues, to vendor management and supply chain issues. This operational risk management and compliance is what many start to call Enterprise GRC. But it extends way beyond that, as we’ll talk about in the next post.

GRC makes up for this geek’s limitations

If you think about it rationally, technology’s little more than a bunch of risks.

I mean, think about the average IT project. You pump a whole load of money into changing something that works *reasonably* well today, in the hope that it will work incrementally better tomorrow, with little guarantee of success.

Problem is that humans are lazy by nature – and will move heaven and earth to find an easier, less labor intensive way to get stuff done. They’re also inquisitive by nature, and will go to great lengths to make their own existences that little bit more interesting. For example, being a self- confessed geek, I will gladly spend 4 hours writing an Excel macro that will save me 2 hours in copying and pasting – *and* I’ll be able to justify that to myself as time well spent.

We’re also hopelessly optimistic too – there are a few technological breakthroughs that have made our lives immeasurably better. I’m thinking the PC, e-mail, the iPod, and the bread maker here. Most other technology projects aren’t quite so spectacular – and we rarely consider the downsides new technologies can bring. For example, my local supermarket recently had to resort to looking at and estimating the value of each shopping cart full of groceries when their fancy point of sale system went South.

So, we need to find a good way to save ourselves  - and that’s where GRC comes in. When we set goals, evaluate risks and create rules in the cold light of day, we become much less likely to get drawn into expensive folly. However, it’s not enough to go through these academic activities when the mood takes us…as I said in the last post, we need to:

1.      Have a policy that reflects our goals and make sure people know about it

2.      Have a way to carry out the policy

3.      Have a way to make sure the policy is being carried out

4.      Have a way to find out how well the policy is working

5.      Have a way to deal with the times the policy’s not being effective.

Across IT we need to make sure that we’re not doing things like spending time on a wonderful new Enterprise Service Bus when we have no real need for it, but at the same time have no DR plan for our website where 90% of our orders come in. Or flouting US Federal laws by not considering our visually impaired customers when we implement our new whizz-bang online ordering system (there are more reasons than just regulations why that’s a bad idea but we’ll come to those in a later post).

Also, we need to make sure we’re spending the right proportion of our budget on security – too little and we’re placing our company at risk of falling foul of the auditors, or being embarrassed in the Sunday papers. Too much, and we end up either simply throwing away money, or stopping the company adapting to change.

Archer helps our customers establish those goals and rules across IT in the cold light of day – from portfolio management to business continuity – and  keep track of them as risks and business requirements change. Archer also helps customers define processes for deal with the times when things go astray, whether the reason behind that issue is security related or from elsewhere in the IT environment.

GRC summed up in 5 steps

However which way you look at this, GRC can be summed up in 5 simple steps. No matter what the area, you need to:

1.      Have a policy that reflects your goals and make sure people know about it

2.      Have a way to carry out the policy

3.      Have a way to make sure the policy is being carried out

4.      Have a way to find out how well the policy is working

5.      Have a way to deal with the times the policy’s not being effective.

Many aspects of IT (and of business for that matter) fall into one or more of these 5 steps. To be honest, most of them fall under step 2…carrying out the policy, but over the years we’ve increased the number and diversity of tools and processes that carry out the rest of these steps.

Now I’m a security guy – so let’s think of this in security terms for a moment.  In the early days of security, goals were simple – “stop the bad guys”. And they still are to a certain extent.

So we developed a bunch of tools that did precisely that…firewalls, antivirus are great examples. As computers started getting used more, the requirements became more complex, and sometimes conflicting, especially when security and performance butted up against each other. Bad guys worked out how to make their stuff not quite as obvious any more – so we had to develop more formal policies that mapped our goals to what we did. Also, what constituted “bad stuff” changed rapidly, as did technologies and the way people use, so we had to better keep tabs on what was going on and adapt what we were doing.

Over time, things have gotten more and more complex, and we’ve needed more and more stuff to carry out policy, and keep tabs on what’s going on. Also, the people who pay for this stuff, i.e. management, have had the audacity to start asking probing questions about where their money’s going. And don’t get me started on types of things we’re now being *required* to do from a security perspective by governments, partners and customers.

So, risks have gotten much more complex, our goals aren’t just about “stopping the bad guys” any more - add “keeping the auditor at bay”, and “singing for your supper” to that list – and the rules we need to play by have exploded.

Enter tools that will track all of these steps. Over 150  leading organizations are using Archer to set and communicate security policy, and show why the policy is in place from a regulatory standpoint. They’re also using Archer to define processes to carry verify and visualize that policy’s being carried out properly, and deal with those instances where things aren’t as they should be, like when a security incident happens, or an audit deficiency gets called out.

 In the next post we’ll talk about how these principles extend beyond security and into the wider realm of IT

Why Moonraker was a GRC failure

Whenever I’ve read about GRC, it’s been a high falutin’ conversation about the “taxonomy of risk”, or some complex explanation of regulations and IT governance, but I’m going to try reduce this down to some simple terms

So let’s throw Websters/Oxford English Dictionary out the window for the moment, and start to think of what these words mean in practice:

• Governance – what are our goals, and are we doing what we our goals say we should be doing?
• Compliance – what are the rules, and are we playing by them?
• Risk – what are the bad things that might happen, and how do they compare to the good things that might happen?

So a while ago, some bright spark figured out that these things are intertwined, since your goals should always be within the rules, and take into account the risks. And hence the term GRC was born.

As an example, let’s think back a complete failure of GRC - no not Enron, or WorldCom – but to the 1979 James Bond movie Moonraker

In that movie, Drax Industries  had a pretty explicitly goal stated of “world domination by the use of force”…and herein lies the problem:

• From a compliance perspective, it was a non-starter, since there are multitudes of rules that say you’re not allowed to do that.

• From a risk perspective no matter how good his henchmen were it was always pretty unlikely, especially with James Bond and MI5 to contend with. And nobody can say this was an unforeseen risk – “We’ve been expecting you Meester Bond” are not the words of somebody who hasn’t considered the downside. And after they failed nobody would do business with them – so the risks kinda outweighed the potential rewards in this instance

• And from a  governance point of view, the failures were legion. For a start, the goals were ridiculous, and not in Hugo Drax’s best interests. At a more granular level, putting James Bond in a centrifuge is neither the quickest nor most cost effective way to eliminate him – and somebody should’ve spotted that. And maverick defections such as those by Jaws certainly did not work in the favor of the organization.

A few simple checks and balances would have identified these problems at an early stage, and Drax Industries would’ve set themselves more modest goals like “to be the second largest wholesale tomato grower in Northern Iowa by 1982”. And Bond would’ve been at the receiving end of a 9mm round about 5 minutes into the movie.

Now in today’s climate, where technologies, public opinion, and political whim and fancy change so quickly, it’s sometimes hard to keep track of how governance, risk and compliance intertwine.

I mean, think about Amazon  - they used to sell books…they’re now also a major provider of cloud computing services. They also tried their hand at being a wine distributor, but in such a regulated industry that’s kinda tough to pull off. And as they’ve evolved, they’ve always had to balance what their goals are, what the risks associated with those goals are, and how to play within the rules. Not easy for an international, diversified company – but they’ve managed it. Now I don’t know much about Amazon’s GRC program, but by good luck or good management it’s been a GRC triumph.

In the next few posts, we’ll talk a little bit about GRC, what Archer does for RSA and EMC, and how that relates to James Bond

Token Security Guy is now Token GRC Guy...well, kinda

After a lengthy absence, there's been some stuff going on here at RSA that's got the creative juices a-flowing again!

Many of you might have seen yesterday's coverage of RSA buying Archer Technologies. I for one am *really* excited about this - and I mean genuinely excited...not that feigned "office excitement" when you're convincing yourself to do things you'd rather not do (e.g. "I'm really excited about this all-day planning exercise!")

From a nuts and bolts security standpoint, I reckon it's got the potential to set EMC apart as the leaders in security management.We can start raising the conversation around security management away from just managing settings and rules and towards the hard stuff - helping security folks understand what's been done, what needs doing and why they're doing it.

Don't get me wrong, I know managing 15 different consoles is time consuming and labor intensive, but if we don't do a better job at highlighting and dealing with the problems we come across, we're never going to get the investment to solve the technical issues that underlie them.

Archer's going to help us:

• Display policies more intuitively, and more explicitly make the link between what the policy is and why the policy is in place
• Display data around how well the policies are working in a diverse environment
• Create more robust processes around how to deal with issues, like audit findings or security incidents

There's a slew of other stuff its going to let us do in the wider GRC space, but I think a layman's explanation of what GRC does would help to lay out exactly how it would help, and I'll be covering that in the next few posts.

Token Security Guy is a media whore

So conference season is truly well and done with. My blog update frequency has been, quite frankly, abject. I'm kinda struggling to balance the real work/shameless self promotion/travel/booth duty/rest of my life type balance.

However, I've been doing some interesting stuff. A few weeks ago I was on another panel with other SIEM vendors around where the industry is and where it's going. For those who are interested there's a recording posted here. I'm no stranger to public speaking, but I can honestly say those panels are the most nerve wracking and exhausting experiences - although people tell me they're reasonably interesting to listen to, unless of course all the vendors just agree with each other.

I got roped into a fun project to promote RSA's SharePoint solution on YouTube. Think I'll stick to the online "audio only" panels in the future!

Also, I spent a week at the Cisco Live conference, got to meet up with some cool people, including Stu Miniman and Chris Hoff - yes I know I live within 20 miles of each of them but sometimes you need to meet up on the other side of the country. Highlight of the conference had to be the after-show party though. How's this for a line up?

Flock of Seagulls
Sugar Hill Gang
Tone Loc
Howard Jones
Bangles
Tears For Fears
Devo
B-52's

...all MC'd by Martha Quinn! Quite the show I can tell you

SIEM Gartner Magic Quadrant: RSA enVision on top again!

OK - shameless product plug again, but Gartner released their SIEM Magic Quadrant today, and RSA enVision came out pretty darned well. Our "completeness of vision" placed very strongly, and we came out on top for "ability to execute". That's the 6th year running where we've come out in the leader quadrant, and the third where we've come out as the leader overall.

That's because we've got an unrivalled customer base of companies both large and small, who are finding the real problems with deploying SIEM in a true production situation. They're collaborating on our Intelligence Community, and sharing information about the good, bad and ugly of a SIEM deployment, and we're building that feedback into our product every day, from better rule content, to easier manageability to continuous user interface improvements.

The SIEM space is a tough one, and its good to come out on top of a pretty large heap!