1 Raindrop

Standards Are Half the Battle

I have a paper at IANS that's on Cloud Identity Management Standards. One of the main points is to communicate the need to understand the limitations of standards. Standards like SAML, Oauth, OpenIDConnect have helped enterprises make a lot of progress on security issues in recent years, but there are no silver bullets and this is just another example of that. CSA and other industry guidance is replete with pointers to interesting standards that can help enterprises on the journey to the Cloud, but its equally important to know the gaps of what the standard is not doing for you.

I like the scene in The Untouchables when they are preparing the ambush Al Capone's gang at the Canadian border. The Canadian Mountie (1) says: 

 

When they're on the road and have given the signal, we will engage from the Canadian side of the bridge. Thus taking them by surprise from the rear. And surprise, as you very well know, Mr Ness, is half the battle.

Ness: Surprise is half the battle. Many things are half the battle. Losing is half the battle. Let's think about what is all the battle.

The cocktail napkin for Cloud Identity usually starts with something like this

And standards give us a good start at half the battle but if we zoom out a bit further, gaps start to emerge

And its these gaps that enterprises need to focus on, including

• Governing the security protocols and standards - how policies are developed, where are they enforced, and how are they updated and managed?
• How is the protocol integrated into authZ code and processes?
• What level of visibility does the logging and monitoring have?
• How is the client storage and sandbox protected?
• How is the token scoped and what limits are in place around replay and theft?

This isn't a complete set obviously, but its showing that looking at the wider view - how the standard fits into the system as a whole - beyond just the standard is critical at the system level

**

1. Robin- You guys are the world's leader in hand gun violence;your health care system is bankrupt and your country is deeply divided on almost every important issue.

 
[pause] 

Ted - Your cops are called 'mounties'.

 

Price is What You Pay, Value is What You Get

The analyst firm RedMonk in general and Stephen O'Grady in particular do a lot of great analysis on software, open source and other tech issues. A recent post on the Microsoft Surface has some good examples of the firm's push the envelope thinking, in a nutshell software is waning and hardware is waxing. 

However, the data framework used to justify the core point (however valid it is or not, we'll see) does not stand the test. Price reflects what investors are willing to pay, but value reflects the earnings and quality of the company. This point is important enough that it bears repeating, for one thing conflating price and value is a big part of what led to the 2008 horror show.

Stephen leads off with: "On December 24th, 1999 Microsoft was trading at $58.719 a share. In the decade plus since, it has generally traded for approximately half that valuation. As I write this, a single share of MSFT can be had for $30.90." 

That sounds pretty bad, but let's go inside the numbers. Think back to 1999. Pets.com raised $82.5 Million for its IPO, never mind that a) pet food is mostly sold at a loss for stores who want you to come into visit their stores and buy other stuff and b) its pretty heavy and hard to move around and shipping costs unlike say books. Their shares went up to $14 and oh by the way, the next year they were bankrupt. Mr. Market was at his manic-depressive best,  the valuations in 1999 were certifiably insane. 

But, please don't take it from me, listen to Scott McNealy talking about his own company's ludicrously priced stock during the dotcom era

"But two years ago we were selling at 10 times revenues when we were at $64. At 10 times revenues, to give you a 10-year payback, I have to pay you 100% of revenues for 10 straight years in dividends. That assumes I can get that by my shareholders. That assumes I have zero cost of goods sold, which is very hard for a computer company. That assumes zero expenses, which is really hard with 39,000 employees. That assumes I pay no taxes, which is very hard. And that assumes you pay no taxes on your dividends, which is kind of illegal. And that assumes that with zero Ramp;D for the next 10 years, I can maintain the current revenue run rate. Now, having done that, would any of you like to buy my stock at $64? Do you realize how ridiculous those basic assumptions are? You don't need any transparency. You don't need any footnotes. What were you thinking?

Anyone buying Sun for $64 or Microsoft for $58 was making a "well maybe these trees really can grow to the sky" bet. So the starting poitn metric of $58/share for Microsoft is flawed, we all know what happened, dotcoms dotbombed. But Microsoft unlike dear departed Sun, survived and as we will see, its business thrived.

What about now? Well these days many stocks are pretty darn cheap, the simplest metric is Price/Earnings ratio (P/E) to show cheapness. And using this metric we find that large, blue chips like Walmart, Johnson and Johnson, Procter and Gamble and yes Microsoft are quite cheap.

	P/E	Dividend
Procter & Gamble	18	3.8%
Johnson & Johnson	18	3.7
Walmart	15	2.4
Microsoft	11	2.6
S&P 500	15	2.1

Compared to the S&P 500 market average none of these global franchises require paying a premium price, and they all pay a higher dividend than the market average. So analyzing a companies' prospects based on stock price does not say much about the company, it just tells you what investors are willing to pay.In 2008, the flawed use of the Value at Risk metric (among others) conspired to bring many large financial institutions because they assumed that price an value were the same thing. However, we can see that Microsoft (and Sun and Pets.com for that matter) all experienced irrational pricing on the upside in 1999, and you can look at the table above and ask - is Microsoft irrationally priced on the downside today?

Its selling a big discount to the market - 11 P/E versus 15 P/E, so to buy a $1 worth of Microsoft's future earnings, you are getting a double digit discount over buying a $1 worth of the market's earnings. Also, this is not a just a paper gains exercise, Microsoft is returning cash to its shareholders. 

Microsoft begun paying a dividend (and probably led the way for Cisco, Apple and others), their dividend is 2.6% currently ~30% higher than the market average. They've returned over $3.25B in cash to their shareholders via dividend, and raised it every year since inception in 2003. The 2003 dividend was $0.08/share, its now $0.72/share - 9x increase through all the bubbles and turbulence - that's not fake growth that's a sign of a healthy business. And dividends matter way more than people think, in fact they are responsible for the majority of returns to the long term shareholder.

What we have really seen with Microsoft and other Blue Chips is P/E compression, Microsoft's P/E was 50(!) in 1999 and today it is 11, the price reflects investor sentiment not reality (remember these are the same people who put the "rational price" of hundreds of millions on Pets.com).

In 2002, MSFT had $28B in top line revenue, this year they are on track for $73B that's real growth. ~3x growth through two downturns while retaining earnings quality. The core metrics show Microsoft with a very healthy core  business - the key measures of quality are knock the cover off the ball great: current Net Profit Margins at 31%, Return on Equity at 40% and these have held up high standards over this whole period whilst the price fluctuates up and down based on Mr. Market's manic dperessive swings. This does not debunk the Innovator's Dilemma/Disruptive Innovation parts of Stephen O'Grady's analysis, but it does show that once you look inside the numbers that currently the core engine is thriving across the board.

So in a nuthsell, you can look at Microsoft's stock as overvalued in 1999 and undervalued today, this does not tell us anything about the strength of Microsoft's business, it only tells about what investor's emotions and sentiment.

Why might this happen? Who knows. Markets overreact on the upside and the downside, sometimes they are even right, but only modeling academics believe in Efficient Market Theory. The old joke rings true - two Wall Street economists are walking down the street. One sees a $20 bill on the ground. The other says - don't both picking it up if it was a real $20 bill someone would have picked it up by now. Dotcom stocks were clearly overvalued in 1999, whether Microsoft is undervalued and a $20 bill waiting to be picked up today, is an exercise left to the reader.

In the late 90s dotcom stocks as a group were overvalued, today blue chip companies as a group are undervalued. Microsoft is one of the few to be a member of both groups. But there is one other to have made the leap, Oracle. In the dotcom era, Oracle traded as high as $45/share, today its $27, is that a failed business? Much like Microsoft, the earnings show that they are successful. In 2002 Oracle's P/E was over 29 and today its 14, like Microsoft they started paying a dividend, like Microsoft they have strong Return on Equity (24%), margins (24%) and their revenue has more than tripled over the decade from $9.6B in 2002 to $35B today.

So this P/E compression is less about the specific businesses and more about Wall Street fashion trends, though the academics tell us otherwise, Wall Street mainly operates on greed and fear.Fixating on price as an indicator is to miss the point, in Buffett's words - markets are there to serve us not guide us. Its the earnings that count.

Finally, the main point of Stephen O'Grady's article and points on hardware waxing and software waning are very interesting, I don't have a strong opinion on this right now, but as with most of his analysis its a pretty compelling analysis, and btw you can even use the HIGH quality core business earnings numbers from Microsoft to specifically make the disruptive innovation point.

Loser Stories

Software development is about making things work, what infosec brings to the table is to account for what happen when things don't work as planned. Years ago software security was mostly scanning apps right before they shipped, but most enterprise SDLCs have got better over the years about building at least some security into the process further upstream. This has improved the access control, defensive programming and other key bits in the security of many systems. Still Richard Bejtlich's question is relevant

Q: What happens when you try to prevent an attack by professionals?

A: You lose. So, fast detection & response is best refuge.

You have to assume that the adversaries are as skilled or more so than your teams, and that they will find a way. This means that User stories that say what the system is supposed to do on behalf of the user are not enough by themselves, we need Loser stories to account for loss of data, failing access control and other misuse scenarios. As Richard mentions, this leads to building and integrating more effective detection systems to identify malice or at least to give the response team a vital data source. Other requirements may be derived, including 

• Following the Golden Rule of Dependency management - Own your own repository
• Scoping data and tokens - based on use, time and privilege
• Finer grained, dynamic authorization - use freshest, most specific data for authZ rules
• Attack surface reduction - limit failure points
• Asynchronous messaging with protected stores - designed to fail
• "Limp mode" - designed to limp, resiliency when things go awry, Netflix's recent example of staying up when Amazon east coast went down

What drives the SDLC is answering the question - "what do we want the system do on behalf of the user"?Whereas following the question "how does the system fail and what do we want the system to do next?" leads infosec in the direction of building more survivable systems. You can not assume that protection always works, failure and loss are inevitable in any system, but the mission must survive.

Survey Says - Security Spending Going Up, Up, Up

The Index of CyberSecurity is one of the only instances of the use of the word cyber that doesn't make me immediately want to rip my own flesh off. Its somewhat similar to the economic measure - Purchasing Manager's Index in that it gathers data from the people with their hands on the wheel. Since the PMI shows the demand side, its interesting that the monthly question this month addressed the demand side for ICS, asking 

"Given the current threat environment, the relative ease of obtaining funding and resourcing in the recent past for cyber security threats from your organization's senior leadership has:" 

This is not a new trend, security spend has increased more than almost anything else in IT over the last decade. Don't believe me? Try to swing a dead cat and not hit a Security Conference. Here is the thing though, will these dollars be invesed well? Or will they just be spent on the shiniest, silverbulletist, golfiest, and boothbabiest security gee gaw that's close at hand? This matters! I know about the Red Queen, and I know there is a lot of catchup to be played, but we have to start investing wisely. 

Its one thing to say that attackers are getting better all the time (true) and its valid to say that organizational change that benefits security is hard, but at the same time if the budget dollars creates malinvestment, well that one is on our industry. Don't ask Gartner what others are spending -  Find your moat and defend it.

So we have people's attention, as in execs. Almost not a day goes by without a "cybersecurity" story in the FT or WSJ, this is what execs read (those who do) and the message is getting through. There is a lot of catch up to be played, the spending is going up, but what about quality? Is it sustainable security that we are building or malinvestment wasteful spend? 

Passive Aggressive SDLC - When Yes Means No

After years of trying, Infosec has made some headway inserting some basic security disciplines into enterprise SDLC. Sometimes its checklists, or threat models, and often its more toooling than process. When I work on Security in SDLC, I like to start by analyzing how does the SDLC actually work. Not how the managers think/say it works, but follow the code from ideation to development to deployment.  These initial processes before coding end up being interesting from a security architecture standpoint because its too late to re-do your identity and access management strategy once the project is underway.

The SDLC as it actually runs is different from what managers say the SDLC is. Of course, the SDLC that security people experience is at yet one more remove from this, so a big initial challenege is finding where and how security can play an effective role in the real SDLC.

The real SDLC these days means quite a bit of outsroucing which introduces another curveball (or maybe seven curveballs). One of the big problems with the outsourced model is when the outsourced dev group agrees with your security requirements. I repeat - one of the big problems with the outsourced model is when the outsourced dev group agrees with your security requirements.

Most security functions amount to medium or large impacts on the overall codebase in terms of complexity and cost (also these are the two main drivers the outsourcer cares about). Many outsourcer business analysts hold meetings to gather requirements, but what they actually gather is feature lists that are not synthesized into what is practically achievable. So in the initial phase the outsourcer says "yes we can do that" to everything. But then, often too late in the process, the response comes back with - "do we really need to do this?", "this is hard", and so on. This is a situation to avoid. First off, regular check ins and involvement in daily scrums are necessary and what security people should be listening for is not - yes we can, but no this is too hard or how do we actually do this.

The marker of initial success in security in the SDLC is not getting a security function on a laundry list of features but rather getting to the friction and pushback earlier in the process. The earlier the tradeoff process starts the better the tradeoffs will be. So the goal is to get past the yes and get to the No as fast as possible. If you can achieve this then you still have time to turn some of the Nos into Maybes or even Yes, turning the initial friction into something positive.