ESG Blogs

This week, EMC released RecoverPoint for VMs (RP4VM). For storage administrators, RecoverPoint has long been seen as the seamless synchronous/asynchronous storage replication of choice for EMC storage, to deliver higher levels of resiliency for enterprise workloads. But for virtualization administrators, it was part of the “magic” that made the storage under the hypervisor surprisingly durable – or perhaps not even recognized at all.

With the RP4VM release, enterprise-grade storage replication is now in the hands of the VMware Administrator (vAdmin). RP4VM is made up of three core components:

• A virtual appliance for replicating to another appliance on a different host
• An I/O splitter that captures disk I/O from the hypervisor, and weans a copy for the appliance
• A vCenter plug-in for management

Poor Michael Daniel. The White House cybersecurity coordinator and the man who “leads the interagency development of national cybersecurity strategy and policy” is taking a beating in the press. In a recent interview with federally-focused media outlet, GovInfoSecurity, Daniel defended his lack of security technology experience with the following statement:

"You don't have to be a coder in order to really do well in this position. In fact, actually, I think being too down in the weeds at the technical level could actually be a little bit of a distraction. You can get taken up and enamored with the very detailed aspects of some of the technical solutions and the real issue is looking at the broad strategic picture."

At this week’s VMworld shin dig in San Francisco, many networking and security vendors will crow about software-defined security and software use cases for SDN. Some of this rhetoric will be nothing more than industry hype while other banter may prove to be extremely useful in the near future.

Yes, there are many interesting ways that SDN could work to enhance network security. That said, which SDN/network security use cases are really compelling and which could be considered second-tier? ESG research asked this specific question to security professionals working at enterprise organizations (i.e., more than 1,000 employees) as part of a recent ESG research report, Network Security Trends in the Era of Cloud and Mobile Computing. Here are the top 5 SDN use cases for network security:

• 28% want to use SDN to help them selectively block malicious traffic to endpoints while still allowing normal traffic flows. In this case, SDN would be tied into malware detection appliances like those from Cisco, FireEye, Fortinet, Palo Alto Networks, or Trend Micro.
• 28% want to use SDN to improve network security policy auditing and conflict detection/resolution. Here, SDN could be used to aggregate and manage network segmentation, for example.
• 23% want to use SDN to centralize network security service policy and configuration management. Similar to the use case above but in this case, SDN could be used to align network security policy with server virtualization (i.e., vCenter, MS System Center), cloud (i.e. AWS, OpenStack, etc.), or orchestration platforms (i.e., Chef, Puppet, etc.).
• 23% want to use SDN to automate network security remediation tasks. Think “self-defending networks” here. Based upon the latest threat intelligence, a firewall/SDN controller combination could generate new firewall rules on the fly. Firms like Norse, Vorstack, or Webroot could act as the security intelligence brains tied into SDN in this use case.
• 23% want to use SDN to implement more granular network segmentation for network security. Think micro-segmentation where specific users, sessions, or flows could communicate across a point-to-point VPN. For example, HyTrust works with Intel TXT to offer fine-grained segmentation aligning workloads with particular servers and trust zones.

In my time with ESG Lab, I have seen and tested numerous virtual desktop solutions and reference architectures. It’s common knowledge that virtualizing end-user computing environments can present the most challenging workloads an infrastructure must support. Users have become accustomed to the performance of flash drives in their business and personal computers, making delivery of an exceptional user experience–essential to the success of desktop virtualization–even more challenging. If you can’t deliver performance equal to or better than what users already have, you’ve already lost.

Next week, the IT industry will gather in San Francisco to discuss all things cloud and virtualization at VMworld. The discussion will center on “software-defined data centers” which will quickly morph to “software-defined security” in my world (Writer’s note: In my humble opinion, this is a meaningless marketing term and I don’t understand why an industry that should be focused on digital safety acts like it's selling snake oil). So we are likely to hear about the latest virtual security widgets, VMware NSX and OpenStack integration, virtual security orchestration, etc.

This will make for fun and visionary discussions but there’s one critical problem: While almost every enterprise has embraced server virtualization and many are playing with cloud platforms, lots of organizations continue to eschew or minimize the use of virtual security technologies – even though they’ve had years of experience with VMware, Hyper-V, KVM, Xen, etc. According to ESG research, 25% of enterprises use virtual security technologies extensively, while 49% use virtual security technologies somewhat, and the remaining 25% endure on the sidelines (Source: ESG Research Report, Network Security Trends in the Era of Cloud and Mobile Computing, August 2014).

There is a famous hamburger chain that used to tout, “You can have it your way,” whereby instead of getting your burger fully-loaded (with all the fixin’s), you could choose whether you wanted pickles, tomatoes, or anything else.

For the last two decades, CommVault has been offering a fully-loaded data protection solution that encompassed backup, archiving, replication, snapshots, etc. Over the course of time, and based on customer feedback, it continually added features – just like the burger chains that now add bacon, steak-sauce, grilled onions instead of fresh, etc. The challenge was and is that not everyone wants their burger fully-loaded, nor their data protection solution fully-featured.

Everyone who has spent any time looking at the world of big data will have by now familiarized themselves with the 5 "V"s of Volume, Velocity, Variety, Veracity, and Value, and these are no doubt good descriptors of the new requirements. There is however another secret V to consider, well, ok, it's really more of an L, but cock your head 45 degrees to the right and it'll start to look a bit like a V anyway.

While IBM has always been known for some great technologies across the IT board, it's not every day that one chats to IBM storage executives about its market leadership. But right now, good old Big Blue is doing remarkably well in the all-flash battleground. To try to figure out a little bit of the how and why, I spoke to both Michael Kuhn and Kevin Powell while at the recent Flash Memory Summit. I asked Mike to talk about how he sees the general market situation - in addition to IBM's recent success - while Kevin talked more about the elements behind that sales improvements...both from an overall storage portfolio perspective as well as some details about the latest update to the IBM V840 (which was announced at the Summit). The results are in this 5 minute video:

No one hates passwords more than I do and it seems like I’m asked to register for a new site each day. For those of us in the know, this situation of “password sprawl” is even more frustrating because we really should have solved this problem years ago. After all, Whit Diffie, Marty Hellman, and the RSA guys first came up with PKI back in the 1970s so you’d think that passwords would be dead and strong authentication would be ubiquitous by now!

Thankfully, there may be hope on the horizon in the form of the FIDO alliance. The group, composed on a who’s who of industry big shots like ARM, Bank of America, Discover Card, Google, Lenovo, MasterCard, Microsoft, PayPal, RSA, Samsung, and VISA, is “developing technical specifications that define an open, scalable, interoperable set of mechanisms that reduce the reliance of passwords to authenticate users.” In other words, FIDO wants to introduce “trusted convenience” by making strong authentication easy to deploy and easy to use on the front-end (i.e., for users) and back-end (i.e., for IT).

If you haven’t already checked them out, ESG recently started delivering ESG “Video Capsules” – video wisdom in 140 seconds or less – www.esg-global.com/esg-video-capsules.

One of the more recent ESG Video Capsules, “Backup Is No Longer Enough,” discusses the fact that IT organizations of all sizes struggle to achieve the SLAs that their business units require, if their only recovery solution is a traditional backup solution. In fact, when looking at core platforms like server virtualization systems (VMware & Hyper-V), less than 10% of folks are only protecting their VMs with backups; the rest are using a combination of snapshots and replication to supplement their backup mechanisms – a strategy which is consistent with the Data Protection Spectrum that I often discuss.

When evaluating potential storage vendors and solutions, one method I have seen quite often is the feature compare. You might be familiar with this process. A listing of all a products features and functionality listed side by side against the competing alternatives is created. Typically the offering with the most check marks is deemed the best and then, budget willing, it finds itself inside your data center.

Everyone should archive, as a means of data management – because storage (both primary and secondary) are growing faster than storage budgets, so you can’t keep doing what you have been doing. Here is a video on the simple math of archiving/grooming your data.

I spent the early part of my IT career in the storage industry, mostly with EMC Corporation. Back then, large storage subsystems were equated with IBM mainframe computers, with a heavy emphasis on the financial services market.

Not backup-as-a-service, but just cloud storage that could be used to supplement a backup. Sure, there are a lot of STaaS (storage-as-a-service) folks that will give you a small amount of capacity to try their platform, knowing full well that you are going to want more and be willing to pay for it.

Last week saw the annual Flash Memory Summit taking place in Santa Clara. As one glanced out from the convention center it was possible to hear the screams of delight from the Great America theme park next door and the hush of anticipation from the new Levi's Stadium - also a new neighbor - where the 49ers NFL team will now play. "Delight" and "anticipation" have long also been the watchwords around flash in the commercial storage world....what is clear this year is that the general market balance is definitely shifting to delight rather than anticipation.

As summer starts to wind down and our family begins to look forward to another school year, I find myself reflecting on old friends, and thinking about new ones. Seems to me there are at least three categories of friends:

I attended Black Hat 2014 in Las Vegas last week and wanted to write a post while I’m still feeling the buzz of the event. Here are just a few of my take-aways:

1. Black Hat = High Energy. I attended Interop at the same venue (Mandalay Bay) for many years but I noticed that the event was getting stale and rather morose recently. It was quite invigorating then to witness the high-energy security crowd at Black Hat in comparison. There was lots of energy, great discourse, and plenty of knowledge transfer. Yes, there was commercialism and Vegas schmaltz, but Black Hat is more of a community get together than your typical stale trade show – and way more lively than Interop post the late 1990s.
2. Black Hat vs. RSA. When I worked at EMC back in the late 1980s, one of the common sales mantras of the company was, “people who know how always work for people who know why.” This was a “solution selling” message intended to get the sales team to focus on the “why” customers who own business processes, financial results, and budgets, rather than the “how” customers who twiddle bits and bytes. With this analogy in mind, RSA is a “why” conference while Black Hat (and to some extent, (DEFCON) is a “how” conference. With this explained, there is also a difference as cybersecurity is a hardcore “how” discipline that revolves around the folks who know how to twiddle bits and bytes or can detect when someone else has twiddled bits and bytes in a malicious way. In my humble opinion, these two shows complement each other. Yes, we need extremely competent CISOs who know business, IT, and security technology but we must also have security practitioners with deep technical skills, devotion, and passion. RSA is focused on the former while Black Hat/DEFCON appeals to the latter.
3. Security vendors should be at Black Hat. Many leading security vendors passed on Black Hat and allocated event budget dollars to RSA and shows like VMware instead. I get this but would suggest that they find ways to spread event investments around so they can attend Black Hat 2015. Why? Black Hat attendees may not be budget holders but they are the actual people who influence technology decisions and make up the majority of the cybersecurity community at large. These are the people who choose cybersecurity technologies that can meet technical requirements. Creative security technology vendors can also approach Black Hat as a recruiting opportunity, not just a sales and marketing event.
4. I left Black Hat with even more cybersecurity concern. I’m in the middle of this world all the time so I hear lots more about the bad guys’ Tactics, Techniques, and Practices (TTPs) than most people do. Even so, I spent the week hearing additional scary stories. For example, Blue Coat labs reported on 660 million hosts with a 24 hour lifespan it calls “one-day wonders.” As you can imagine, many of these hosts are malicious and their rapid lifespan files under the radar of signature-based security tools and threat intelligence. I also learned more about the “Operation Emmantel,” (i.e., from Trend Micro) that changes DNS settings and installs SSL certificates on clients, intercepts legitimate One-time passwords (OTPs) and steals lots of money from online banking customers. Black Hat chatter served as further evidence that our cyber-adversaries are not only highly-skilled, but way more organized than most people think.
5. Endpoint security is truly “in play.” A few years ago, endpoint security meant antivirus software and a cozy oligopoly dominated by McAfee, Symantec, and Trend Micro (and to some extent, Kaspersky Lab and Sophos as well). To use Las Vegas terminology, all bets are off with regard to endpoint security now. With the rash of targeted attacks and successful security breaches over the past few years, enterprise organizations are questioning the value of AV and looking for layered endpoint defenses. Given this market churn, Black Hat was an endpoint security nexus with upstarts like Bromium, Cisco, Crowdstrike, Digital Guardian (formerly Verdasys), Druva, FireEye, Guidance Software, IBM, Invincea, Palo Alto Networks, Raytheon Cyber Products, RSA, and Webroot ready to talk about “next-generation” endpoint security requirements and products. While the incumbents have an advantage, endpoint security is becoming a wide-open market as evidenced by the crowd at Black Hat.

Black Hat is a great combination of Las Vegas shtick, hacker irreverence, and a serious cybersecurity focus. Yup, it’s only a tradeshow but there is a serious undercurrent at Black Hat/DEFCON that is sorely missing from most IT events.

Here at ESG, we just put the finishing moves on our new Enterprise Database Trends in a Big Data World report, be sure to ask for it by name at your local newsstand if you aren’t already getting home delivery of all our research. This piece of work is part two of a grand trilogy (thrill-ogy?) in our data management research calendar along with the earlier Enterprise Data Analytics Trends and the upcoming Enterprise Big Data, Business Intelligence, and Analytics Trends reports.

The current installment looks at the pressures on existing databases, the practical science of database management, how organizations are re-thinking their strategies and technology selections, and the challenging dynamics of the discipline.

For the past few years, the big data protection trend in virtual environments was simply to ensure reliable backups (and restores) of VMs. That alone hasn’t always been easy, but with the newer Data Protection APIs from VMware (VADP), that is becoming table-stakes – and the real differentiation coming from the agility to restore (speed and granularity), as well as manageability and integration.

And while there is certainly still a lot of room for many vendors to improve in those areas, the industry overall needs to move past the original question of “Can I back up your VM?” and even past “How quick can I restore your VM?”

This will be my 9^th year in a row attending VMworld! The event always proves to be a great display of end-user passion that is driving towards new innovation and IT vendors displaying their latest products, solutions, and services. I recently asked the ESG team attending the event if there was anything they planned to track closely or questions that they hoped to get the answers to and here is what they shared:

According to ESG research, 63% of mid-market (i.e., 250 to 999 employees) and enterprise (i.e., more than 1,000 employees) are currently using software-as-a service (SaaS), 33% use infrastructure-as-a-service (IaaS), and 27% employ platform-as-a-service (PaaS) today. Additionally, 72% of all firms are increasing their spending on cloud computing initiatives this year. (Source: ESG Research Report, 2014 IT Spending Intentions Survey, February 2014.)

RSA 2014 seems like ancient history and the 2015 event isn’t until next April. No worries, however, the industry is set to gather in the Las Vegas heat next week for cocktails, sushi bars, and oh yeah – Black Hat.

Now Black Hat is an interesting blend of constituents consisting of government gumshoes, Sand Hill Rd. Merlot drinking VCs, cybersecurity business wonks, “beautiful mind” academics, and tattooed hackers – my kind of crowd! As such, we aren’t likely to hear much about NIST frameworks, GRC, or CISO strategies. Alternatively, I am looking forward to deep discussions on:

• Advanced malware tactics. Some of my favorite cybersecurity researchers will be in town to describe what they are seeing “in the wild.” These discussions are extremely informative and scary at the same time. This is where industry analysts like me learn about the latest evasion techniques, man-in-the-browser attacks, and whether mobile malware will really impact enterprise organizations.
• The anatomy of various security breaches. Breaches at organizations like the New York Times, Nordstrom, Target, and the Wall Street Journal receive lots of media attention, but the actual details of attacks like these are far too technical for business publications or media outlets like CNN and Fox News. These “kill chain” details are exactly what we industry insiders crave as they provide play-by-play commentary about the cybersecurity cat-and-mouse game we live in.
• Threat intelligence. All of the leading infosec vendors (i.e., Blue Coat, Cisco, Check Point, HP, IBM, Juniper, McAfee, RSA, Symantec, Trend Micro, Webroot, etc.) have been offering threat intelligence for years, yet threat intelligence will be one of the major highlights at Black Hat. Why? Because not all security and/or threat intelligence is created equally. Newer players like BitSight, Crowdstrike, iSight Partners, Norse, RiskIQ, and Vorstack are slicing and dicing threat intelligence and customizing it for specific industries and use cases. Other vendors like Fortinet and Palo Alto Networks are actively sharing threat intelligence and encouraging other security insiders to join. Finally, there is a global hue and cry for intelligence sharing that includes industry standards (i.e. CybOX, STIX, TAXII, etc.) and even pending legislation. All of these things should create an interesting discourse.
• Big data security analytics. This is an area I follow closely that is changing on a daily basis. It’s also an interesting community of vendors. Some (i.e., 21CT, ISC8, Leidos, Lockheed-Martin, Norse, Palantir, Raytheon, etc.), come from the post 9/11 “total information access” world, while others (Click Security, HP, IBM, Lancope, LogRhythm, RSA, etc.) are firmly rooted in the infosec industry. I look forward to a lively discussion about geeky topics like algorithms, machine learning, and visual analytics.