1 Raindrop

What's Happiness Got to Do With It?

Gartner's own John Pescatore has issued a 12 world post:

The best security program is at the business with the happiest customers.

Happiness? Really? That's the measure of program effectiveness? I would see those 12 words and raise them one word (13 if you're scoring at home):

There's a fine line between happy customers and playing piano in a bordello.

I mean the people running hedge funds and derivative books at AIG, Lehman and friends had lots of happy customers for the last decade!

To me the happy customer is a classic IT copout "we just did what the "business" asked". Like we're just a bystander or something. Its our job to create business value and be business like. We should seek to empower out customers, not make them happy. 

Please understand I am not that guy who says IT security has to be the "bad cops" who deny everything the business wants to do. Just saying it is our job to raise the bar where we can. Raising the bar does not always create super happy customers in the short run, but it does empower companies.

Unfortunately, playing piano in the bordello is what a lot of security groups do and even big analyst firms. The path of least resistance ain't always the way. Here is an example. I was at a client many years ago, they wanted to build a big Identity Management solution, so of course they wrote a big RFI got responses from Sun, IBM, Oracle and friends. The bids were in the $3-5 million range. Pretty big projects for an Infosec team. So what do you do? Call up a big analyst firm and get some advice, right?

A week goes by and we get an audience with the "guru" from the Big Analyst Firm. The client has pretty detailed requirements, what systems they want to connect to, what use cases they are looking to solve for,  and so on. We anxiously await the knowledge the analyst is about to transfer to us. His response was as follows - "what kind of shop are you? IBM shop? Oracle shop?" "Ummm...we are a huge company we have everything." "Well if you are more of a IBM shop you should go with them. If you are more of a Oracle shop you should go with them." That was the extent of a 30 minute conversation. True story.

Of course, the one value proposition of the Big Analyst Firms is that they supposedly can tell you what everyone else is supposedly doing. There is some value in this I grant you. And it does make for happy customers because even when you force your customers to change, you can say "Well geez, I know its hard but the Big Analyst Firm says that everyone is doing it." But is this security improvement?

Back in 2004, I went to a great security conference, it was Information Security Decisions (they are back in Chicago next week). It was in Chicago, downtown on the river. Tom Davern even took us all out on a boat for lunch one day. Anyway, there was one truly great talk there. It wasn't Fred Cohen debating Gary McGraw on application security which was outstanding (in which Fred uttered the memorable line "I agree with Gary everywhere he agrees with me." (Gary won the debate, his best line - "We know how to win the software security war, but we don't know how to manage the peace" still the problem today actually)) It wasn't Pete Lindstrom showing his security metrics framework (which is still a great starting point). it wasn't Dan Geer's fireside chat.

The truly great talk, though, was by the now departed Robert Garigue. It was called "Its the End of the CISO as I Know It, (And I Feel Fine)." The whole end to end talk was wonderful, there are several things in there that I still use every single day like the separate security models for Infostructure and Infrastructure but the point I want to talk about is the CISO role.

Garigue talked about the two most prevalent CISO models - the jester and the bad cop. The jester CISO

Sees a lot
Can tell the king he has no clothes
Can tell the king he really is ugly
Does not get killed by the king
Nice to have around but…how much security improvement comes from this ?

The jester has happy customers! At least for awhile.

Again I grant you bad cop is not the way to go either (and while this already long post could read harsh on John Pescatore's pithy summary, I give him a lot of points for saying that security needs to be customer conscious).

We have all seen bad cop CISOs who

Changes happened faster that he was able to move
Did not read the signs
Good intentions went unfulfilled
A brutal way to ending a promising career
Sad to have around but…how much security improvement comes from this ?

Obviously these models of CISOs are not solving our information security problems. Instead Dr. Garigue points us to Charlemagne as a better model

King of the Franks and Holy Roman Emperor; conqueror of the Lombards and Saxons (742-814) - reunited much of Europe after the Dark Ages.

He set up other schools, opening them to peasant boys as well as nobles. Charlemagne never stopped studying. He brought an English monk, Alcuin, and other scholars to his court - encouraging the development of a standard script.

He set up money standards to encourage commerce, tried to build a Rhine-Danube canal, and urged better farming methods. He especially worked to spread education and Christianity in every class of people.

He relied on Counts, Margraves and Missi Domini to help him.

Margraves - Guard the frontier districts of the empire. Margraves retained, within their own jurisdictions, the authority of dukes in the feudal arm of the empire.

Missi Domini - Messengers of the King.

This is the way forward! Find software security champions in the architecture and development groups,help them understand the real security issues. They will find solutions you have not thought of. Same for DBAs, same for business analysts even. Its all about beating the bushes, education, and decentralizing security services. Specifically, he points out this important mandate for IT security

Knowledge of risky things is of strategic value

How to know today tomorrow’s unknown ?
How to structure information security processes in an organization so as to identify and address the NEXT categories of risks ?

To me this is our mandate and measure of effectiveness. Empower our customers, educate, and create business value. If I am a CISO  I don't want 20 people reporting to me who do firewall ruleset changes. I want one champion in 20 different groups - development teams, architects, DBAs, business analysts.

A concrete example, infosec can continue to go along with the herd and follow the "what everyone else is doing architecture" meanwhile developers are connecting every single thing in your business to the Web. I have been doing integration and new technology projects for a long time, and let me tell you - Change does not always create happy customers in the short run. But the chart below shows that information security is maybe more concerned with not causing waves rather than adapting.

How long can developers evolve, connect everything and security people not change anything? Herb Stein said, "things that can't go on forever, don't. "At some point these chickens are coming home to roost, there is a yawning gap between rapidly evolution connecting the enterprise and the 13 year old and counting security architecture that "Everyone else is using" and when those chicken come home to roost you may not have happy customers then. Here is my 12 words:

The best security program is at the business with sustainable competitive advantage.

NBA Preview and Flashback

NBA starts today, it is always good to have something to look forward to once the weather gets cold in Minnie. I follow two teams. The Celtics who have a decent chance at repeating as champs. KG and Pierce should be back in full force, hopefully Ray Allen holds up. Perkins and Rondo may get a little better with experience. Biggest loss is Posey and we will miss him a lot more than people think. A real glue guy, defense, passing, rebounding, makes the smart plays and as a middleware guy myself I can relate. He will make CP3 even more dangerous.

The other team I follow is the Timberwolves. I think they will be pretty good this year. Al Jefferson is a beast down low. Only four players averaged 20 and 10 last year and he is one. He is the best big man in the post after Duncan. Getting Love and Miller for OJ Mayo was a smart deal by McHale. I think McCants can be a decent instant offense 6th man. Would be good to see Foye step up this year. Weakness looks to be defense

*Flashback* 

I am biased but I think the 1980s was the most fun time to watch NBA. Everyone talks about Bird and Magic, but there were a lot of great players back then. Here is my all underrated 1980s team (no Celtics included due to conflict of interest and unobjectivity)

C: Moses Malone - beast of a big man, immovable force under the hoop with fantastic foot work for a big man. It is too bad he was traded by Portland because he and Bill Walton would have been the best big man combo of all time.   

PF: Bobby Jones - great defender, good rebounder, good passer for a big man. Typical Tar Heel -fundamentally sound. He would be the James Posey of this team. (Runner up: Calvin Natt)

SF: Bernard King - what a renaissance. Watch his moves on youtube, he was not that tall like say Alex English but he could go in the lane and score on anybody. Jordan of course is an all around better player but I think King was a better scorer and that is saying something. The playoffs when he was putting up 50 and 60 a night he was a terrifying force. 

SG: Andrew Toney - they called him the Boston strangler and as Celtics fan there was no one I was more afraid of. Its a real shame his career got cut short. (Runner up: George Gervin)  

PG: Tiny Archibald - Ok, one Celtic, but he is seriously underrated - would go flying into the lane, disappear in the trees, Tiny would fly out the bottom of the pile, and the ball would pop out the top and drop in. Probably the last great player to come out of NYC. (Runner up: Mo Cheeks)

Sixth Man - World B. Free - no doubt about this one, he was great as a sixth man. And this guy was plain fun to watch. He would bomb it from 30 feet, when he was on he was a force. He would kick his leg into the defender when he was shooting a j to draw the foul. (Runner up: Michael Cooper)

**

Update: Several people have emailed me (apparently it is hard to comment on a blog from a crackberry) that I am off base saying Mo Malone is underrated. So I ask you - name a better Center from the 80s? Kareem? Please. 7 rebs a game, little to no defense. Great taste in jazz though. Artis GIlmore? the human erector set? I don't think so. Dan Issel? great jumpshot, average everything else. 

Plus Moses' had one of the best quotes in NBA history saying the Sixers would go through the playoffs fo', fo', fo', winning four straight in each round. The actually went five games in the conference finals and their championship rings say "fo', fi', fo'"

Update II: In a new media beats old media story, I forgot to mention that the "big" Twin Cities newspapers have not one single decent basketball writer. The best Twin Cities hoops writer by far is Britt Robson who writes/blogs for the free Rake mag. he used to be at City Pages.

Interestingly enough, City Pages had the best food writer as well Dara Moskowitz. She is now at Minnesota Monthly.

It is funny to see the big papers like Washington Post going after these hyper-local strategies to fend off their demise. The answer is right in front of their face. The free weeklies - Boston Phoenix, Village Voice, etc. Every city has them. Look what is in there. There is usually one or two really good writers who go n levels deep and geek out on something lots of people care about - like basketball, restaurants, movies, etc. 

Secure the Heritage

Good post by Scott Stender on using the SDL on legacy code (ht Andy), it is always refreshing to see security pros talk about real world tradeoffs. I would also add the following:

1. What most people call "legacy" systems should be called "heritage" systems. Legacy has a negative connotation. Most places I go, the "legacy" is the reason why people get paid and what actually runs the business. I think its more respectful to call them heritage systems a la Krafzig, Banke, and Slama.

2. Most heritage systems have almost no security mechanisms whatsoever. They were designed for benign environments. Most mainframes have no encryption. You talk to a mainframe over MQ Series, yet MQ Series literally has no access control. This is the transactional backbone of 499 of the fortune 500 we are talking about. You still with me? Good. So writing security requirements is important, but you are not going to have anywhere near the security architecture capabilities that you are used to.

3. So one *big* thing to consider with heritage is - don't connect your heritage to hostile environments at all, use an ESB to connect indirectly and/or replicate out to data caches. So the heritage publishes data and subscribes to data, but is not in any way connected to a world it was never designed to deal with. Of course this doesn't always work either, but it is something to consider. The starting point should not be - "how do I connect the heritage to the web?" the starting point should be "how do I share resources and functionality on my heritage with the web", again, often you do have to connect but sometimes not.

 

Whenever I read something from iSec it is generally thought provoking because they have worked on a lot of interesting stuff. How do we get these folks to blog more?

What Happens When Everything is Connected?

We built out the web before software security was even in its infancy. The Web was almost ten years old before McGraw/Viega, Howard/Leblanc, and van Wyk/Graff's ideas started to take hold in the industry, plus we built out the whole web without an identity layer. And now we are eating the bitter back end of all these things

On the flip side, most of your stuff is not connected, we each own about 8,000 things, but only 5 of them are connected to the web. That is a big margin of safety for the offline world, but it is shrinking every day.

Now we are starting to see projects like this

 

“Goal: connect everything

step 1: connect rabbits
step 2: connect everything else”

So I guess my question is - are we going to connect the next 7,995 things that we each own to the web using the same old, same old - proliferating more poor security design? Or alternatively how do we SAML enable the rabbit in step 1?

Integrated Security

Tom Barnett on what the big consulting companies are doing:

Now we're into a world where asking companies to pay you millions for a massive PPT slide deck that says, "This is your company now and this is what your company should look like tomorrow," is simply a non-starter. So while the tech-heavy firms like Accenture and Cap Gemini do well at the bottom and the high-end starts like the Monitor Group do well at the top of the pyramid, a lot of mid-range, standard cookie-cutter management consulting firms are seeing their market decline. Everyone wants the super-integrated solution now that combines compliance, security, systems-integration, performance metrics—and they want it delivered in a service-oriented architecture that frees companies up to evolve in ways commensurate with globalization's many demands and opportunities.

I see efforts in all the compliance, security, systems-integration, performance metrics, and SOA rabbit holes. I don't see very much unification. In my swamp - SOA security. I do see a lot of starter efforts where companies build out services, but forget the security -  and then either an auditor comes asks "so how are you doing authN and authZ for your web services" or a security event happens, or a diligent director comes along and asks variant of the auditor question. Then some things start to happen, usually a purchase of a XML gateway, but Data Power, Vordel and Cisco can't help you if its just shelfware.

Integration is inherently difficult and messy. Information security groups need to get good at engaging with development and architecture in a proactive way to deiver these security services to the system. I call it "playing offense", infosec spends most of its time defending against bad guys, and that is ok, it is a huge part of infosec's job, but sometimes you need to go on offense and raise the bar. Make the bad guys' job harder, build security in.

Learning Mode

Great quote from Barron's interview this w/e from Jeremy Grantham: 

Q. Do you think we will learn anything from all of this turmoil? 

JG. We will learn an enormous amount in a very short time, quite a bit in the medium term and absolutely nothing in the long term. That would be the historical precedent.

Any security pro has seen a case where once a security event happens, there is a lot of collaboration, decision making and action. Motivated organizations can be very impressive, what is hard is to marshal these responses in advance, and of course this is about the biggest hurdle to building security in. If we are going to move infosec faster than glacial we need to educate

OWASP Twin Cities Mini-Conference

Next week, there will be an OWASP Mini-Conference right here in the Twin Cities. I am sorry that I will have to miss it, but the lineup is great - Brian Chess, Jeff WIlliams, RIchard Stallman and a number of others. Brian and Jeff are both very engaging presenters. I am curious to hear what Stallman says, I am not sure I have heard of him being associated with OWASP or security work in general before, and I have read any number of his comments that seem to directly oppose security mechanisms. In any case it promises to be worth the price of admission.

I have spoken at a number of local OWASP conferences, and you can always see that the good ones are the result of a lot of hard work by a small group of people. Bob Sullivan really brought the Minnesota chapter through its adolescence very nicely, building a good base, and now Kuai Hinojosa is doing some phenomenal work growing the chapter. Kuai has serious networking skills, I would love to see Kuai, James McGovern and other successful OWASP leaders put together a Top 10 list for how grow a chapter. These are things I don't know the first thing how to do, but you can sure see the results. I am pretty sure a lot of other OWASP leaders could benefit from these guys' insights.

Hey Kids, How About a Little More Innovation?

Tim O'Reilly's piece in the LA Times has a lot of people talking:

He is urging young entrepreneurs and engineers to stop making some of  the sillier software that lets Facebook users throw virtual sheep at  their friends or download virtual beer on iPhones, and instead start  making a real difference in the world.

He says it's not just the right thing to do, but also the smart thing  to do -- especially as the credit crunch spreads to Silicon Valley,  venture financing becomes scarce and start-ups have to retrench.

When this grizzled, 54-year-old tech-industry veteran talks, Silicon  Valley tends to listen, if only to argue with him.

This is actually about the 6th time I have heard this this year. I have to say I pretty much agree on the face of it. But I wonder if its not so much a generational question as its that computers are just not as challenging as they used to be. Writing PERL shopping carts and online editors were a challenge in 1995, not so much any more. Maybe the issue is that "kids" of today who want to work on enabling technologies and do real innovation have migrated off to biotechs and nanotechs. 

We still have a lot of problems to solve in computers, so don't get me wrong we can use help from the next generation. But you get the sense the industry is maturing and not this wide open greenfield like biotech and nanotech or early dotcom days. There are a lot of cool things going on, but a lot of it seems like incremental upgrades. Important yes, but earth shattering, not so much. Take for example, Infinera, very cool stuff but its your classic, "we don't make X, we just make X work better." product.  I am not complaining - as an engineer, I like reliability. As a security person, I need better security tools. As a digital citizen, I want things to work better. But you know all of us making better brakes, better airbags, and better seat belts, is not going to be as exciting as the building the first car. What was the last computer technology that was mind blowingly innovative to you?

Web services talk at OWASP

The video from my OWASP AppSec Conference talk on OWASP Top Ten for  Web services  is online here.

OWASP is consistently the most interesting and practical security conference, its probably the closest thing we have to a true software security conference. Sure, we could use a few more builders, but I still think its the best we have right now.

Innovators, Imitators and Idiots

Charlie Rose interviews Warren Buffett:

Charlie Rose:  
And so when you look at where we are going, there seems to be two issues that are apparent to me at least, risk and leverage.  We just lost sight of risk and leverage of what was appropriate?

Warren Buffett:  
Yeah.  Again, because it pays off for a while.  You know, you can lose leverage, and it's the only way a smart guy can go broke.  If you owe money, you can't pay them out.  You just pay for everything, you do smart things, you eventually get very rich.  If you do smart things and use leverage and do one wrong thing along the way, it could wipe you out, because anything times zero is zero.  But it's reinforcing when the people around you are doing it successfully, you're doing it successfully, and it's a lot like Cinderella at the ball.  I mean you know at midnight everything is going to turn to pumpkins and mice; right?  But if the evening goes along, I mean, you know, the guys look better all the time, the music sounds better, it's more and more fun, you think why the hell should I leave at quarter of 12.  I'll leave at two minutes to 12.  But the trouble is, there are no clocks on the wall.  And everybody thinks they're going to leave at two minutes to 12.

Its effectively the job of leadership to know when to take the punch bowl away and to have the credibility to do this. This is also the risk-reward balance that infosec must try to strike, part of the answer is differentiating risk and uncertainty. As our current financial situation shows, its a hard thing to pull off

Charlie Rose:  
And should wise people have known better?

Warren Buffett:  
People should always know better.

Charlie Rose:  
Yeah.

Warren Buffett:  
I mean people -- people don't get -- they don't get smarter about things that get as basic as greed and you can't stand to see your neighbor getting rich.  You know you're smarter than he is, and he's doing these things, you know, and he's getting rich, and your spouse is getting unhappy with you because you aren't doing -- pretty soon you start doing it.  And so you get what I call the natural progression, the three Is.  The innovators, the imitators, and the idiots.  And that's what happens.  Everybody just kind of goes along.  And you look kind of silly if you disagree.  I mean, you know, you could have these crazy Internet valuations in the late 1990s, but they prove themselves out in the market.  The next day they were selling for more than they were the day before, and people said, you know, you're crazy if you don't get in on this.  So it's very human.  Now, with housing it's something even more dramatic than that, because most people aspire to own their own home.  And if you really think that houses prices are going to go up next year and the year after, you feel if I don't buy it this year, I'm going to have to buy it next year.  That's not true of an Internet stock.  But it's true of a home.  And when somebody makes it very easy for you to do it by saying you don't really have to put up my money, you can lie about your income a little, or we'll give you 100 percent mortgage, you're going to do it, because everybody that's done it has been proven right.  You have what they call social tools, and, you know, you're going to feel like an idiot if you didn't do it, because the house cost more.

And this is why its hard to pull off. There is a lot of human emotion and envy (*). I think the point Buffett raises about innovators, imitators and idiots is a useful one for infosec. We see all kinds of new projects and technologies that have risks and rewards associated with them, its helpful to categorize these under innovation (high risk but possible game changer), imitators (so called best practices), and idiots (sheep mode - blind risk acceptance). We can get some traction here to use these concepts to understand what to do when assessing say the architectural and oeprational risk of a system.

Finally, we should always spend some time to consider infosec decisions in a broader long term economic context and this is also true of our current financial crisis

Warren Buffett:  
Oh, I think confidence will come back.  I will tell you this.  This country is going -- be living better ten years from now than it is now.  It will be living better in 20 years from now than ten years from now.  The ingredients that made this country, you know, the miracle of the world -- I mean we had a seven for one improvement in the average American standard of living in the 20th century.  Now, we had the great depression, we had two world wars, we had the flu epidemic.  You know, we had oil shock.  You know, we had all these terrible things happen.  But something about the American system unleashed more and of a potential to human beings over that hundred years so that we had a seven for one improvement in -- there's never been any -- I mean, you have centuries where if you've got a 1 percent improvement, then it's something.  So we've got a great system.  And we've got more productive capacity now than we ever have.  The American worker is more productive than he's ever been.  We've got more people to do it.  We've got all the ingredients for a sensational future.  It's just that right now the athlete's on the floor.  But we -- this is a super athlete.

Again, we want to look at risk events in a broader, long term context. In Buffett's words its - "be fearful when others are greedy and greedy when others are fearful." As the world panics and Jim Cramer is melting down on TV, Buffett is quietly writing checks with both hands, buying $3B of GE, $5B of Goldman, $6.5 of Wrigley/Mars and so on. Uncertainty is one thing, it could be 6 months it could be 5 years until this thing turns around, but risk is another - you hedge your risk with price and long term advantages, i.e. moats. People will still eat candy in a bad economy.

* Buffett's partner Charlie Munger calls envy the stupidest of the seven deadly sins, because only you feel bad, there is an upside to all the others. He said you can pay someone on Wall St $2 million a year and they will be perfectly happy until they find out someone across the hall is making $2.1 million and then they will be miserable. Which is an insane way tolive.