Through the looking glass....

NWW story on SANS log management survey...what am I missing?

Do you know that kids game Telephone?  I am wondering if maybe I am like the last person to have a secret whispered in my ear, and missed somethig that is key to the story below making sense to me?

Network World's Ellen Messmer reports on a recent SANS survey and report that reveals security folks aren't spending enough time looking at logs.  

Says Ellen:

"According to the SANS Analyst Program survey on log and event management, "Sorting through the Noise," 22% of respondents use a security information and event manager (SIEM) to collect and analyze data, while 58% use log-management systems, and the remainder rely on other means. Most respondents said one of the main reasons to collect logs is for the purpose of regulatory compliance, though 9% discounted the importance of that."

So...if I got that right than 80% of respondents are using some sort of automation to manage device logs.  That's good, right? 

Those system's don't run themselves - they require a person to manage them. I would think (hope) that that person, being tasked with minding these systems would have some sort of baseline familiarity with the logs under management, right?  If not initially, then over time?

According to Ellen: "...the SANS report emphasized that automated tools cannot be viewed as a complete substitute for the people who are log analysts who develop a "sixth sense" about traffic anomalies and security because they spend some time every day looking at log data."

Well...duh!  But...didn't the whole SIEM to automate log management because there were to many devices, too many logs, and way too much data in all those logs for anyone person or team of people to analyze manually?

The SANS report points out that "SIEM-type tools, including log management tools with analysis and reporting options, will help organize and identify patterns and activities that are generally recognized as indicators of problems. Yet, 58% of organizations are not anywhere close to that level of automation."

Wait a minute- what about the 80% SANS said ARE using a SIEM or Log Manager?

Maybe I am misunderstanding something in either the report (which I did not read though) or the article (which I did),  but I think what SANS is saying - and this makes total sense -is that you still need a person - preferably, a smart person - making sense of the information being presented by security automation tools (in this case SIEM tools). 

Of course the folks managing these tools need enough familiarity with logs and log data to know how to properly leverage the automation SIEMS offer - as in how to tune it, what trends to look for (in general, for compliance, and specific to your organization), or how to recognize a real anomaly from a false positive. But if the whole point of them buying these tools was to deal with the overwhelming volume of information in the logs, how much more time do they need to spend on the logs? If anything, shouldn't they spend that time learning the ins and outs of the SIEM?

Yes?   No?  if not, what am I missing?

New Post by Michael Hamelin of Tufin on the Tufin Blog... http://www.tufin.com/blog/ . The article he references in his post is http://soa.sys-con.com/node/2266270 .

The Solitude of Connection...

About eight years ago, my friend Bob Garza and I were a trendy Sushi place in San Jose.   We were sitting in the bar area waiting for a table, and adjacent to us were a couple of young Asian guys.  They were dressed to impress, but we couldn't see their faces, because they were tractor-beamed to their phones, which were firmly anchored in their laps.  Had their fingers not been in constant motion, we would have assumed they were looking for something on the floor. 

Bob yelled over at them, asked them if they were texting each other, and we all had a good laugh.  Back then, especially in the heart of Silicon Valley, they were the epitome of the Web 2.0 geek stereotype.  If they weren't students, they likely worked at a well funded start-up with a really goofy name and no employees older than 30.

Today, that scenario is normal - it's the rule, not the exception.  For sure, we are just beginning to understand how having all your Facebook friends, Twitter followers and other assorted friends, family and strangers at your fingertips impacts not just how we communicate, but how we form and manage relationships.  I know of several books on the subject, and those are just the ones I know about.  This New York Times article  does a great job at dissecting the forces driving today's smartphone fueled, Borg-like,140-characters-or-less, SocialWeb Zeitgeist.

So does this picture, which accompanied the article. 

 

 

How many times a day do you see this?  How many times a day is this you?

 

Quote of the week (well, actually from last week): from Mary Ann Davidson on the Oracle blog:

"an unfortunate concomitant of Doing Something is that often the cure is worse than the ailment."

Deep, right?

She is talking about (among other things) the paradox that occurs when IT folks scramble to meet regulatory requirements that, all too often, end up doing more harm than good.

Doesn't that dynamic that sound all too familiar? Not just in IT but in life. I wish there was an automated solution that could eliminate that highly inefficient process!

Full post is at https://blogs.oracle.com/maryanndavidson/entry/pain_comes_instantly1

Security Bistro - Vendor-as-Publisher done right

My friend and former client, Aimee Rhodes, is vice president of Marketing at Corero Networks, an IPS vendor some might remember as Top Layer Networks.  She's a brilliant Marketeer, and Corero is lucky to have her.  Corero’s new blog, Security Bistro, is just one case in point.

Security Bistro is not designed to be a corporate blog where everything maps back to the primary business of the vendor.  Neither is it a showcase for the vendor's resident security guru, which, even if the guru has free rein to blog about whatever they want, all blog content implicitly links back to the vendor because everyone knows that's where the guru works. 

Its aspirations are more along the lines of ThreatPost, a dedicated news outlet funded by Kaspersky Labs, but Threatpost has three full time journalists on staff and is more of a traditional news outlet.  Security Bistro aims to be an online salon, of sorts; it’s geared to foster conversations (which makes us PR folks salivate:-), and features analysis from three well known and respected personalities from the IT security press/blogosphere.

The only way it will work is if we support it, and the kick-off posts are varied and interesting. I won't deny that one of its launch posts, written by Network World mainstay Linda Musthaler, about the findings a recent firewall management survey conducted by my client Tufin Technologies, added extra warm fuzzies.  But Tufin gets a ton of blog coverage.   I’m not posting this as a public thank you, I'm writing this because I want Security Bistro to be all it’s setting out to be.  As a dedicated, neutral and self-guided infosec forum, it offers the (infosec) PR community an opportunity to add a lot of value.  We can pitch ideas that might not fly in anywhere else, not to mention drive the conversation via comments.

A few years back I tried an experiment with Tom Foremski of Silicon Valley Watcher.  We wanted to launch a sister site called Silicon Valley Minute, featuring 60 second videos of vendor CEO's.  The premise was that they had a minute to explain what their company did.  Our strategy was that we would rely on PR firms to pitch their client CEO's, giving us a powerful channel and ensuring we would have a viable queue of companies to feature. 

Despite our best-laid plans, Silicon Valley Minute didn't make it, and what remains online is not even close to what I had envisioned (another story for another time).  But Security Bistro has the same opportunity to leverage the best of what the PR community has to offer.  Any smart PR person will immediately get what an asset the site can be for their clients and for them. 

So go check out the site – I particularly liked Richard Steinnon’s post of LinkedIn scammers.  I’ll be interested to see how the site fares over time – if it successful, it is sure to be copied, which means that product vendors can in fact be publishers, which gives the whole notion of citizen journalism a big boost. 

Nice job Aimee!

Security Bistro blogger and Corero's Director of Research, Neil Roiter, also deserves a shout out.  On Neil's watch, the site is sure to stick to its editorial knitting.

You can also follow SecurityBistro on Twitter - @securitybistro

Online privacy - civil liberty or oxymoron?

Yah, I know, I am spamming my Facebook and Twitter pages with content I just published,but so it goes, until I remember to title my blog posts before publishing them.

Live and learn, right? 

Perhaps the only good thing about making an embarrassing mistake in public is that it facilitates what experts at Wombat Security call a 'teachable moment'....and what is a teachable moment, you ask? 

Ah...fodder for another post, coming in triplicate to my blog, Facebook and Twitter pages shorty...

Until then...below is a slightly revised version of my original, untitled post,

The latest on DigiNotar hack...however you chose to interpret the information, or whatever you make of how it was done, given that the Google webmail of as many as 300,000 Iranians *may* have been intercepted, it's fair to say that nothing online is really private these days: http://bit.ly/negcxJ,

Note:I am making an assumption that the 300,000 accounts belong to "average" Gmail users, or in this case, average Iranian Gmail users, who, if they are anything like their U.S. counterparts, may not take great pains to secure their email communications. 

When I talk to my friends about how easy it is for their email to be compromised, I often hear that they don't care, or that they doubt anyone really cares enough about them to snoop. 

Famous last words. 

Net/net: If you want to keep your private business private, don't talk about it over email...

DefCon Kids - what does that tell ya?

I'm not sure whether I think Defcon Kids  is really cool or really scary - hacking fundamentals for kids as young as eight, assuming they are accompanied by a parent. 

Let's say they learn some mad skillz - with the way case law is evolving around what consititues illegal behavior in cyberspace, those parents better be willing to sign on to the implications of any future bad behavior!  Check out the Rolling Stone article here.

So, all my friends that were kiddie hackers chatting each other up on ICQ from their Commodores are younger than I am.  Now they are sending their kids to DefCon?

Wow....Talk about through the looking glass...

It's been along time since I've rock and rolled....

 It's been a long time since I rock-and-rolled
 It's been a long time since I did the Stroll
 let me get it back, let me get it back, let me get it back
 baby, where I come from
 It's been a long time, been a long time
 Been a long lonely, lonely, lonely, lonely, lonely time

Well, it really has been a long time  - since November 2010, to be exact - since I have published a post, if you want to call my last post a post.   My tendency to over think what i want to say has resulted in analysis paralysis - and it's taken longer than anticipated to "get it back,"  whatever the hell the "it" is.

it hasn't been lonely though  - that much is for damn sure!   As for the reason I have been out of the blogging mix for so long, let me introduce you to my seven-month-old (on Friday) son, Raphael Eduardo Safran Nau. We call him Rafe, or Raffi.

Yah, he really is that cute, and I'm not saying that just because I'm his mom, or he's my first.  He is a ton of fun, but I have yet to win the lottery and so....back in to the mix I go.  

I will say this much - having a kid has definitely shifted my notions of security.  it has also emphasized the fact that the most sophisticated, robust technology in the world is only as good as the people using it. So much of innovation in informaton securty is tied to automation, and all too often vendors are loathe to promote the impact of that out of concern that they may eventually automate their customers out of a job that we soften the message to those that need to hear it the loudest.

There might be some validity to doing that, but my guess is that companies will never be willing to invest in the level of automation they need to get ahead of the curve - they will always be playing catch up.  And we are a long way from automating knowledge workers out of existence.  Behind every security management dashboard there is a person (or persons) drawing conclusions, making decsions, or at least trying to do something with the data in front of them.  If any one vendor can offer such radical automation as to threaten their job, well then, they should be talking to that person's boss, and not that person, right?  I know, easy for me to say, I'm armchair quarterbacking it, but the bottom line is that infosec (like most of IT) is still about people (first and foremost), process and technology.  You can choose to address each component seperately but they do not operate in a vacuum. 

The best technology will only be as effective as the "worst" user - and conversely, a savvy security guy (or gal) can make the best of medicore technology.  At the end of the day, corporate security people are tasked with securing information assets from other people (bad guys or other prying eyes), for other people (bosses, customers, etc), and rely on other people (vendors, consultants, other staff)  to make sure it gets done right.  Sometimes I think as an industry we focus too much on technology and not enough on people or process, or how technology supports people and their processes.  And by the way, vendors are people too....

But I digress.  With as much as has been going on this recently - Wikileaks,  Anonymous, Lulzsec, all the ensuing havoc, it has been a surprisingly quiet summer for my clients, who have been doing some interesting things.  Of course I am way behind on getting the word out on my blog about what some of those cool things are, but stay tuned

One of the good things about having your own blog is that when no one  else is covering your clients you can.  Rather than just shill for them, I would like to point to some of the (public) conversations they are having, which hopefully will be of some sort of interest to whatever readers I have left:-).  So please check back soon for a deeper dive, but until then check out http://www.tufin.com/blog, http://www.identropy.com, and http://www.wombatsecurity.com. 

Cheers,

Liz

So much for a dramatic (re) entrance...

Well, today I wrote this nifty little post explaining my extended online silence (what. me quiet??)

Until I finish editing it, you'll have to make due with a pointer to this  article in InfoWorld on common sense tips to avoid a breach.  What is so great about them is that they are focused on things people can do, as opposed to buying technology.  If I have a theme or focus for the rest of 2011, it's people. When it comes to information security, or any securty, really, people are and will always be the weakest link - that is, until we are subjugated to a life in the Matrix by the very technology we created to serve us (who me, paranoid?).

Until then....Happy reading....

This is priceless - from the Liquidmatrix Security Digest...
FUD, from the belly of the beast...

http://www.liquidmatrix.org/blog/2010/11/13/fud-marketing-fail/comment-page-1/#comment-73954