My Final Impressions of Black Hat 2014

I attended Black Hat 2014 in Las Vegas last week and wanted to write a post while I’m still feeling the buzz of the event. Here are just a few of my take-aways:

  1. Black Hat = High Energy. I attended Interop at the same venue (Mandalay Bay) for many years but I noticed that the event was getting stale and rather morose recently. It was quite invigorating then to witness the high-energy security crowd at Black Hat in comparison. There was lots of energy, great discourse, and plenty of knowledge transfer. Yes, there was commercialism and Vegas schmaltz, but Black Hat is more of a community get together than your typical stale trade show – and way more lively than Interop post the late 1990s.
  2. Black Hat vs. RSA. When I worked at EMC back in the late 1980s, one of the common sales mantras of the company was, “people who know how always work for people who know why.” This was a “solution selling” message intended to get the sales team to focus on the “why” customers who own business processes, financial results, and budgets, rather than the “how” customers who twiddle bits and bytes. With this analogy in mind, RSA is a “why” conference while Black Hat (and to some extent, (DEFCON) is a “how” conference. With this explained, there is also a difference as cybersecurity is a hardcore “how” discipline that revolves around the folks who know how to twiddle bits and bytes or can detect when someone else has twiddled bits and bytes in a malicious way. In my humble opinion, these two shows complement each other. Yes, we need extremely competent CISOs who know business, IT, and security technology but we must also have security practitioners with deep technical skills, devotion, and passion. RSA is focused on the former while Black Hat/DEFCON appeals to the latter.
  3. Security vendors should be at Black Hat. Many leading security vendors passed on Black Hat and allocated event budget dollars to RSA and shows like VMware instead. I get this but would suggest that they find ways to spread event investments around so they can attend Black Hat 2015. Why? Black Hat attendees may not be budget holders but they are the actual people who influence technology decisions and make up the majority of the cybersecurity community at large. These are the people who choose cybersecurity technologies that can meet technical requirements. Creative security technology vendors can also approach Black Hat as a recruiting opportunity, not just a sales and marketing event.
  4. I left Black Hat with even more cybersecurity concern. I’m in the middle of this world all the time so I hear lots more about the bad guys’ Tactics, Techniques, and Practices (TTPs) than most people do. Even so, I spent the week hearing additional scary stories. For example, Blue Coat labs reported on 660 million hosts with a 24 hour lifespan it calls “one-day wonders.” As you can imagine, many of these hosts are malicious and their rapid lifespan files under the radar of signature-based security tools and threat intelligence. I also learned more about the “Operation Emmantel,” (i.e., from Trend Micro) that changes DNS settings and installs SSL certificates on clients, intercepts legitimate One-time passwords (OTPs) and steals lots of money from online banking customers. Black Hat chatter served as further evidence that our cyber-adversaries are not only highly-skilled, but way more organized than most people think.
  5. Endpoint security is truly “in play.” A few years ago, endpoint security meant antivirus software and a cozy oligopoly dominated by McAfee, Symantec, and Trend Micro (and to some extent, Kaspersky Lab and Sophos as well). To use Las Vegas terminology, all bets are off with regard to endpoint security now. With the rash of targeted attacks and successful security breaches over the past few years, enterprise organizations are questioning the value of AV and looking for layered endpoint defenses. Given this market churn, Black Hat was an endpoint security nexus with upstarts like Bromium, Cisco, Crowdstrike, Digital Guardian (formerly Verdasys), Druva, FireEye, Guidance Software, IBM, Invincea, Palo Alto Networks, Raytheon Cyber Products, RSA, and Webroot ready to talk about “next-generation” endpoint security requirements and products. While the incumbents have an advantage, endpoint security is becoming a wide-open market as evidenced by the crowd at Black Hat.

Black Hat is a great combination of Las Vegas shtick, hacker irreverence, and a serious cybersecurity focus. Yup, it’s only a tradeshow but there is a serious undercurrent at Black Hat/DEFCON that is sorely missing from most IT events.

Topics: IBM Cybersecurity Palo Alto Networks Cisco Information and Risk Management FireEye Security and Privacy Guidance Software Crowdstrike bromium RSA Invincea Digital Guardian Webroot

Antivirus Software Is Not Quite Dead Yet

In a Wall Street Journal article published earlier this week, Symantec SVP Brian Dye, is quoted as saying that “antivirus is dead.” Dye goes on to proclaim that “we (Symantec) don’t think of antivirus as a moneymaker in any way.”

I beg your pardon, Brian? Isn’t Symantec the market leader? Just what are you saying? In lieu of specific answers to these questions, the blogosphere and Twitter have become a grapevine of rumors – about Symantec, AV, etc. Panic and wild predictions abound. Dogs and cats living together in the streets . . .

Topics: End-User Computing Palo Alto Networks Cisco Information and Risk Management Sourcefire FireEye McAfee Security and Privacy Security endpoint security Malwarebytes Kaspersky Triumfant Guidance Software Crowdstrike trend micro Symantec RSA Security Cylance Bit9 Carbon Black Anti-malware

Enterprise Organizations Identify Incident Detection Weaknesses

In the past, many large organizations spent about 70% of their security budgets on prevention and the remaining 30% on incident detection and response. Prevention is still important but given the insidious threat landscape, enterprises must assume that they will be breached. This means that they need the right processes, skills, and security analytics to detect and respond to security incidents effectively, efficiently, and in a timely manner.

Topics: IBM Cisco Information and Risk Management Security and Privacy Security Booz Allen Hamilton ForeScout Guidance Software Leidos Blue Coat Fidelis LexisNexis Bit9 CSC Anti-malware

The Pressing Need to Improve Endpoint Visibility for Information Security

In a recent ESG research project, 315 security professionals working at enterprise organizations (i.e., more than 1,000 employees) were asked to identify their organizations’ endpoint security monitoring weaknesses. Thirty percent said they were unsure about, “applications installed on each device,” 19% had difficulty monitoring “downloads/execution of suspicious code,” 12% struggled when tracking, “suspicious/malicious network activity,” and 11% had a hard time tracking “current patch levels.”

Why is it so difficult to monitor endpoint activities? An old saying comes to mind: “Water, water, everywhere but not a drop to drink.” There are records about endpoints all over the place – asset databases, CMDBs, network monitoring tools, vulnerability scanners, patch management tools, etc. – but when security analysts need up-to-the-minute information for critical remediation activities, they have to scramble around through a myriad of management systems to retrieve it.

Topics: Information and Risk Management Sourcefire McAfee Security and Privacy Security endpoint security big data security analytics Bradford Networks Mandiant ForeScout Guidance Software bromium Invincea Great Bay Software RSA Security

Which Security Vendors Have an Advantage with Integrated Network and Host-based Security?

Suppose that President Obama scheduled a visit to New York for an event in Time Square. Now what if the Secret Service deployed two teams responsible for security; one to secure the Avenues running north and south (i.e. Broadway, 7th Ave., etc.), and another to do the same for the streets running east and west (i.e., 49th St., 48th St., etc.)? Further, what if these teams operated independently with little coordination and communications and different chains of command?

Topics: IBM Network Security Check Point Cisco Information and Risk Management Sourcefire FireEye HP McAfee Security and Privacy Security endpoint security Guidance Software trend micro Symantec Blue Coat antivirus Anti-malware APT

First Impressions of the RSA Conference 2013

After much anticipation, the 2013 RSA Conference has come and gone. I have a number of topics to blog about starting with my positive impressions of the show:

Topics: IBM Check Point Fortinet Cisco Information and Risk Management Sourcefire FireEye McAfee Security and Privacy Security LogRhythm incident detection Guidance Software trend micro incident response RSA Security Anti-malware Damballa Splunk

Guidance Software Buys CaseCentral

Guidance Software announced its acquisition of SaaS review provider CaseCentral today. Let's look to the happy couple's future. Now that they've found love, what are they gonna do with it? Existing synergies The companies' recent roadmaps seem to have been on similar courses.

Topics: Enterprise Software Guidance Software software-as-a-service (SaaS) e-Discovery