Security Profile

One of the first times I came about Andy was when I made a mistake. A huge one. And although the mistake was not about Andy, he reacted like a mad dog and told me exactly what he thought of me. In his own words:

“You are one cold hearted fellow.”

 

He got my attention right away! Then, since only a short time after that, he told me:

 

“Kai, I think you are confused.”

 

And these two episodes shows very well who Andy is; straight to the point; fearless if he thinks you are wrong, dishonest or evil; stands up for his friends and the weak. Andy speaks his mind, and I just love that!

 

In our later discussions and comments, it is pretty clear that Andy and I are much closer in our view of the world than at first glance. And the very fact that Andy accepted this Profiling of him tells a bit of him (no, not only that he is attracted to attention!).

 

He is able to walk the talk.

 

Andy’s blog was also noted as one of the most influential security blogs 2007 by IT-security. And true to himself, Andy is incredibly humble about it all (I know I would kick and scream and yell high and long if I was on such a list). But, equally true to him – he was the first commenter on the post – so I am not the only one running a searchbot for my name!

 

Unlike some of the previous Security Profiles, Andy is not able to identify the time he opened his eyes to security;

 

“I'm not sure I can pinpoint any one event. It just happened over time. As I learned more about computers and networks I saw things that people did that put the company at risk. It was also a time when the big name viruses were running rampant.

 

It amazed me how they worked and why they were successful on some systems and networks and why others kept them at bay. I started reading more about security and it really grabbed my interest. So I started focusing my career in that direction.”

 

Andy has a technological background like many security people I know. And he is focused on user awareness and training;

 

“Information Security is about much more than just technology and even about more than protecting your data and network. It is about changing the way people think. A program that focuses on technology will fail, just as one that focuses solely on people will fail. It takes a well balanced combination of focus on both.“

 

And have you found that balance yet?

 

“We know that technology will work to a certain level and then we can either ignore people and throw more technology at the problem; or we can strive to teach people how to be safe. When we are successful at training our employees then everybody wins. They work safer and smarter and when they go home they also live safer and smarter. “

 

Do you have any examples of how to approach this?

 

“We have to get across to them that security is about more than surfing the web and checking email in a safe manner. It's about who they interact with online, on the phone and in person. It's about learning when and where to talk about business related matters. On the phone while riding on a crowded bus isn't the time to do so.”

 

 

Business and management focus

 

On is LinkedIn profile, you can read that Andy is a CISSP. He is pursuing a CISM, and would like a PMP. It is safe to assume that Andy is not only the IT-security geek, but also a managerial guy. His interest in Project management gives that away pretty fast.

 

Andy, what is the impact security has on business?

 

“Security touches EVERY part of a business. If done properly it can really be an enabler but if done improperly it can cause major problems.

Since it does affect everything it's hard to narrow down the Key impacts. They vary from business to business and industry to industry. What is key is finding out what is needed and what works for your particular situation.

 

It is time to kick in the challenges! So let us hear what Andy considers challenges in the security sector!

 

• The first challenge is knowing what to do with security.
  Too many companies look at security as being the "necessary evil". They have security staff because it is required but they don't know how to really use them. They lack a plan for how to integrate security into the overall business plan. So therefore they throw technology at a problem without really considering the impact. Will it work as planned? Will it cause more problems than it solves? Will it be something that we have the time and expertise to maintain? What else do we currently have in use that may serve the same purpose? All of these need to be answered when looking at a security problem.
• The second challenge is developing a good User Awareness Program.
  Most of the ones out there are dull and boring. They also are "cookie cutter" one size fits all solutions. They don't take into account different learning styles and they don't give you good relevant information in a format that you can use throughout the year. Getting something every quarter isn't enough. It needs to come out at least monthly and it needs to be able to be delivered in a variety of formats. PDF, MP3, Video, email, etc...
• The third problem qualified security staff.
  There are too many people who really don't know what they are doing. They look for "best practices" and then that is what they do. Another of my pet peeves is the whole concept of best practices. Again, what works for you may not work for me. Companies need to hire and/or train their staff so that they understand security and how to make security work in their environment. You may be a great Cisco firewall engineer but if you don't know how to think outside of the sample configs that Cisco provides then you aren't the one I want managing my firewall.

 

Andy started blogging because he wanted to have a place to express his thoughts and opinions on security.

 

“Hopefully someone else will gain something from what I have to say.”

 

Andy, there is a hole bunch of people out there – including myself – who gain quite a lot from what you are saying!

Thank you for the profile!

 

Andy’s blog

 

Rob Newby is in a therapeutic mood, and is writing a 7 part story of how he came to IS. First part is ready! 

Read all about the juicy details you did not get in Rob Newby's Security Profile! 

It is impossible to be interested in Information security without noticing Richard Bejtlich. He is a successful blogger, author of two books, and co-author of a third. Many have also had the chance to have Richard as a trainer and teacher. And even more have him as an inspiration.

Richard is the Director of Incident Response for General Electric. Before he joined GE, he ran the TaoSecurity LLC – an Information Security consultancy based in the US. His CV includes many other interesting and impressive employers too.

 

Richard has a background as military intelligence officer, but that is not where he got his interest in information security. It was merely a natural extension. You see, Richard got a Timex Sinclair (ZX80) when he was 8 years old. This sounds like some other people I know. And Richard used BASIC to create Boba Fett. Graphically, of course. And some of us understand that achievement just too well!

So what happened if you where lucky enough to have Boba Fett show up on your screen? Boba would ask you a question (written). “Do you want to see me wave?” You could say yes or no. To Boba it made no difference – he would wave anyway. The reason?

R: “I didn't spend all day rendering that character to not have him wave!”

The ZX was replaced by a Commodore 64, and Richard discovered what a wonderful tool they where to create and edit papers. After his Harvard graduation and his US Air Force intelligence service, he set out to defend enterprises and teach his peers to do the same.

Richard Bejtlich is a very analytic guy. He does not mind telling you what he believes is the truth. As when I ask him about the impact IS has on business, Richard says:

R: "I don't think information security has any real impact on business. On the contrary, business has much more of an impact on information security. No IS department exists to serve its own ends. If it does, it won't last long.

Businesses exist to make money; other organizations exist to meet whatever their goal is. No one exists to "be secure" (which isn't possible, anyway). As a result the history of IS is littered with decisions by business leaders that weakened security infavor of revenue or simply convenience. Nothing changes until a severe, visible, financial- or life-damaging incident occurs."

This is almost as hearing myself speaking, Richard. Perhaps I have spent too much time on your blog…

One of the things that amazes me with Richard Bejtlich is his attention to details. You see it in his blog, you see it in his comments. You see it in his books.

R: “In my first book I defined risk as the probability of suffering harm or loss. I defined security as the process of maintaining an acceptable level of perceived risk.

Digital security applies that concept to information resources, where threats exploit vulnerabilities in assets to violate confidentiality, integrity, or availability via disclosure, alteration, or denial.“

What should a security professional do to improve security?

R: “The role of the security professional is

1) to make it more difficult for information users and resources to do expose themselves to attackers (paraphrasing Nitesh Dhanjani),

2) to increase the amount of time it takes for the threat to accomplish his objective, and

3) to detect and respond as efficiently and effectively as possible when intrusions happen.”

Richard, I have asked all the Security Profiles to comment on the largest challenges in 2007. What are your thoughts on the threats?

R: “The biggest challenge facing all organizations is visibility. A few months ago I wrote a blog post pleading for the creation of Enterprise Visibility Architects.

It's fashionable to talk about "building security in." I say we should "build visibility in" because "security" will never be achieved. It would be an incredible first step to simply know when we are being compromised, because it's going to happen no matter what preventative measures we take."

Thank you kindly, Richard!

To catch up on Richard, visit his blog!

He is the author of the following books:

The Tao of Network security

Extrusion Detection

And co-author of Real Digital forensics

This profile is of a lovely lady. And being a professional blogger – making her living out of blogging – she stands out as well. Arieanna Schweber takes care of the Laptop Security blog on behalf of Absolute Software.

I first noticed her when I read some of the stories at her blog. They where to-the-point, relevant and obviously not targeting a very technical audience. This blog did stand out amongst the Security Bloggers.

Arieanna is a marketing consultant and professional blogger (blogaholics.ca). Background includes a bachelor of Business Administration from Simon Fraser University, and then she landed a marketing specialist job. There, she helped start a blog, and from then on – she was caught.

She says:

“After some months, I decided to pursue this area as my career. This was almost three years ago. Right now, I write a number of personal blogs, and also work with a new media network called b5media (b5media.com) where I am an Editor. I decide on strategy in my specific area (Entertainment), hire and train new writers, and work on building community. Currently I manage approximately 60 sites in this way. “

60 blogs. Wow. Fulltime work, no question!

She has become a known resource in the blogging field, giving speeches at conferences and also consulting.

A: “I help companies understand how to leverage blogs for community building, and what specifically to do. In some cases, I will take on a contract to write the blog. “

Arieanna came to blogging about security from a contract perspective. Through this work, she as developed an interest in the topic. This sounds like at least a few security pros I know!

A: “For me, it's about simplification. If I can't understand it, it is not accessible information. I think that this is one of the barriers to effective security policies. “

Oh yes, I see that point. Unfortunately, too many security pros use the complete opposite strategy – obscure, make things hard to understand, confuse. How do you go about?

A: “So, my aim is always to simplify. To remove language that is unnecessarily technical. To sum things up into bullet points, whenever possible. I want to make the information accessible to anyone, regardless of their backgrounds. It is not just IT Security professionals who need to know about security - people in all ranks of business, government or the education field need resources as well. To understand and make decisions, or to be responsible employees. “

But without a strong IT background, how will you succeed?

A: “I am not an expert in IT. I could never set up security for a company. My experience and my knowledge are not about the technical aspects of password security or encryption technology or anything of the sort. And I think, to most people, this information is not really needed. It is not actionable information. It does not provide an example of what to do, or what not to do, to be secure.

I also try to provide resources that are complimentary to security; for example, talking about education technology in general. Providing information on changing technologies and policies that affect educators.

Since Arieanna offers a different view and background, she may offer insights and points of view that we normally do not see in the Security world.

A: “I believe that information security is primarily a simple concept, made more difficult and convoluted than it needs to be. I believe that companies need to understand the threats, identify solutions, set up a simple policy, and enforce training. My key belief is that the security policy is one of the most valuable assets a company can develop. “

We can all fully agree with that. But are policies enough?

A: “Based on the reports of the past several months, it's clear that most data breaches are not caused by hackers or malicious attacks. They are caused by mistakes that could have been avoided. In many cases, data is not protected. Employees are not trained on the importance of protecting data, or how to do so. Data devices are not properly secured. Companies simply are not aware of what data they have, where it is, and who has access to it. This is dangerous, and can all be avoided. “

How can we go about to reduce or remove this ignorance?

A: “Unfortunately, what seems to come about is not just complacency, but confusion. Although there are some amazing IT & Security professionals, there are also many grey areas. Governments make mistakes - despite strong security departments & consulting firms. Areas are being overlooked. I think a lack of education is a part of this - but I believe that information is not as accessible as it should be to help companies shore up. “

So knowledge is important. How can we help educating the crowd?

A: “Businesses must be aware of many facets of IS, at all levels. C-levels need to understand its importance, to allocate resources. IT security must keep on top of its data as well as technology. Employees need to understand their role. And shareholders & stakeholders need to feel confident these things are taken care of. “

Can we have a bullet point list? J

A: Sure - companies must be aware of:

· being compliant with data breach / privacy laws

· identifying weaknesses, on an ongoing basis

· finding technical solutions

· universally implementing said solutions

· limiting collection of, and access to, confidential information

· tracking data & equipment

· training employees

I think the areas where companies seem to falter are: staying on top of new threats, universally applying security technology, and training. “

One of the challenges many security and CIOs have is how to get the attention from the management – to get the required attention and budgets. How can they get the required attention?

A: “Poor IS is dangerous. It can lead to data breaches, and significant fiscal loss in damages and in consumer confidence. I think the media is making it more and more clear that IS is not cutting it for many companies, and that the outcome is quite a costly one. IS will, and is, be given a higher priority, but I think that companies will continue to falter in certain areas. I think it will take many more data breaches to compel companies to tighten up the gaps in their policies.

In particular, when it comes to these issues and the Absolute blog, I try to write about the "people" component of security policies, to highlight the importance of not just technology, but also training. I see this as an overlooked area in IS. “

What makes training so important?

A: “In many cases, the technologies are simple. Encryption. Laptop recovery software. Things people can understand and do. But if not universally applied, and if not reinforced with employee training, much of this effort can go to waste. The products and services to make your data secure exist - Absolute Software being a provider of some of the solutions. These companies make things easy on the technology side. I guess it's my interest to back that up with other resources. “

Arieanna, all the Security profiles are asked this question: In your opinion, what are the three main challenges businesses meet regarding IS in 2007?

A: “

1. Securing off-site data devices. Knowing what information leaves the office, and on what device.
2. Training. Shoring up the "people" problem.
3. Limiting information. Companies need to cut back on the personal information they collect, where they store it, and who has access to it. But it is an issue that only scales with the size of the company, and will prove difficult for many. “

Thank you kindly, Arieanna! It has been a true pleasure.

You can contact Arieanna at these resources:

Arieanna Schweber
Arieanna@blogaholics.ca

The Laptop Security blog: http://blog.absolute.com

As you have seen, and will continue to see, I am quite busy these days. The impact on my blog is direct, and the number of posts does go down. I will do my best to post at least 2, but target 4 posts per week.

I am currently working on the next security profile. This time, I have had the pleasure to profile Arieanna Schweber - a professional blogger (in the sense she is actually making a living of blogging). Why she is a security profile, I hear you say. Well, those of you familiar with Absolute Software, must have seen the Laptop Security blog they maintain.

And the author is non other than Arieanna. Her answers, background and insights are different. And to the point. And valuable. Do not miss this next security profile!

I hope to finish the profile during the week. Stay tuned :)

In the blogosphere there are a few bloggers who stand out. Amongst security bloggers, one of my absolute favorites are Dr. Anton Chuvakin. He is extremely knowledgeable, and he dares have his saying. He is also one of the bloggers in the security space that has the highest production rate I believe.

Anton is also the co-author of the book Security Warrior.

Anton came to security after reading the book Maximum Security by Anonymous. It was an awakening, and Anton knew what to do in his life. He claims he still do not know who wrote the book.

For Anton, Information Security is not obvious, even if it sounds like it: A: information security is about two thing: "securing" and "information", not only fighting hackers, fixing vulns, blocking attacks, protecting networks, deploying appliance, configuring firewalls, etc.

Nowadays, information pretty much makes the world go round and the missing of security is to protect information C-I-A: confidentiality (of course, for confidential info), integrity and availability for legitimate use. Yes, there are various extensions to the CIA formula, but it does describe the picture adequately for our purposes.

On key impacts IS has on business, Anton says:

A: In short: IS protects business information.

That is why it is called IS - "information security." As far as the impact of security on business, it might be dramatic and negative or dramatic and positive or none.

What determines the above choice is how well you understand the risks you face. If you have no idea what risks you face and then you go and buy a lot of security gear and use it to block random things, you are guaranteed a negative impact.

And if you know the top risks, you invest in security wisely and thus allow the business to, well, "do business." :-)

Anton is the evangelist at LogLogic. As such, he has hands on knowledge on the challenges business meet regarding information security.

A: Regulatory challenges: more new regulations, more details on the existing regulations, more bad regulations, the whole pile :-) It will have sometimes good and sometimes bad impact on security.

Commercialized, professional hacking (this has been beaten to death, so - no more comments)

Data governance (and, especially, identity information governance): who can access data, who does, who has the data, what do they do with it, etc. This will be growing in importance for at least a few years.

You can read more about Anton at his website.

Anton has his Security Warrior blog.

He is the evangelist at LogLogic.

His book is available at Amazon!

And the book PCI Compliance is available at Amazon as well!

 

A while back I came across my next Security Profile. He is from Estonia. He is not afraid of taking even the Estonian Security Police heads on. And he covers a lot of topics including security.

 

Jaanus Kase is a fun read combined with great insights. He also lets you in on a different cultural background – different from us who grew up in the west.

A former Skype marketing guy, Jaanus is speaking freely on topics of his interest.

 

On explaining what Information security is in his point of view, he is hard to stop.

 

Jaanus came into the information security area by working at a security product vendor (Cybernetica - www.cyber.ee). Later he moved on to a company focusing on ID-cards and digital signatures (Sertifitseerimiskeskus - www.sk.ee). His background is diverse, and adds to his wide definition of the topic.

 

 

On defining

 

K: Jaanus, how do you define Information Security (IS)?

 

JK: IS is actually a pretty simple thing. And yet it is very important, as we must all deal with it as individuals and employees, whether we want it or not. It used to be very simple in the Middle Ages -- you stayed at a village and had a limited circle of people to interact with. Whereas these days, information is increasingly digital, be it your bank data, your health records or confidential work data. And information can be moved globally at an instant. So it's important to be conscious about what and where you post or store.

Regarding the meaning of IS, the classic definition continues to work very well. IS is defined as a mixture of confidentiality, integrity and availability. Confidentiality means that secret information should remain secret and the information owner should define who can access it and who can't. Integrity means that information shouldn't be changed by unauthorized parties. And availability means that information should be available to those who need it at all times according to the access policy of the specific info.

 

Global impact

K: Do you have any examples of how this impacts business?

JK: This may sound like an academic discussion, but recent events of the world and Estonia have driven the message home to many people in the world. We were targeted by an organized cyberattack in April and May.

 

Discussion continues about how exactly it was organized and what is its long-term and political impact, but from a technical perspective, it was definitely an IS event. For example, bank systems were targeted, rendering card payments in retail stores suddenly unavailable for a short period during the business day.

 

I believe this event suddenly made a lot of people both in Estonia and elsewhere yet again realize that we live in a networked world where the threats are very different from what they used to be. It used to be so that you could see and touch the enemy and could physically attack and destroy him in a conflict, if we talk about war. Now conflicts are more virtual and asymmetric.

 

 

Age of information security

 

K: This sounds like war?

 

JK: This sounds a lot like the rationale about "war on terror" and it's indeed all kind of the same thing.

So IS these days has an all-encompassing global impact and yet is able to reach every individual in different ways. So if we say that we live in an information age, you could also call it the age of information security.

IS has the same impact as, for example, physical security. It is understandable for most businesses that they need to lock their doors and windows and maybe maintain on-site manned security and CCTV surveillance and such, and maintain proper policies and procedures.

 

It's a bit less obvious about IS policy and procedures, but from business perspective, it's exactly the same thing. In both physical and IS, there are many different measures you can take to protect your assets, and they have wildly different prices.

 

So it becomes a simple question about cost-benefit analysis to determine the appropriate thing to do. And it's not only limited to businesses -- the same kind of analysis applies to every individual when securing their homes and online records.

 

Psycology in attacks

 

K: What challenges do you see emerging?

 

JK: One challenge is that cybercrime definitely continues to be active, and continues to go towards "social engineering" type of things, and not only pure technical attacks. When the IT industry was younger, it was often effective to do online attacks to businesses and try to e.g steal credit card information by cracking the servers.

 

By now, the cyberdefenses have become pretty good and it is more effective for attackers to try to subvert their way in to end users' computers with the help of what's generally called "malware" (the differences between types of malware continue to blur).

 

This may be needed to get access to resources in that particular business, or it may be an operation to extend criminal botnets. And it becomes harder and harder to distinguish "good" and "bad" contacts in case of e.g. email -- the phishing mails have become really really good.

 

 

Converging technology

 

JK: Another challenge has to do with "convergence" and with technologies like VoIP. Not one particular VoIP product, just the concept in general. It used to be so that in a company, your IP network, phone network and CCTV networks were all separate and redundant. This meant that even if one went down, others remained up, and they didn't interfere with each other.

 

But these days, there is a trend to move everything to IP (wired or wireless). This makes a lot of sense as it makes e.g the physical setups simpler and provides great cost advantages, but it also means that a whole new class of risks and threats are introduced that businesses now need to understand and manage.

 

Thank you Jaanus for sharing your valuable insights with us! 

 

You meet Jaanus at his blog: http://www.jaanuskase.com/

I believe you will enjoy it!

The next Security Profile is a guy from the Baltics. His background include Skype, as well as the ID-industry.

What I like about Jaanus is the stuff he covers on his blog - it is not only security - he covers a lot from politics, to humor to security. 

The profile will be posted tomorrow. Meanwhile, consider getting acquainted with Jaanus at his blog! 

In the blog IT Security – the view from here, Rob Newby has proven his place among the great security bloggers out there. You may not always agree with Rob, but you soon realize he never puts forward a notion without making sure he knows what he is talking about.

Rob can make you tear your hair off your head, he can make you angry. (Rob does not realize it, though. Which is good IMO – he says what he has to say, regardless of the reaction. You just have to admire that).

He makes you nod in agreement, and roll on the floor with laughter. Myself, I particularly enjoy his analytical mind.

And as a true British bulldog, he is not afraid of attacking. Like when he hit the WSJ.

So Rob and I had a nice chat on MSN the other day. It was like English tea, but without the tea. And no scones either. He is a great resource for the security community, with deep knowledge, interest and most of all – his passion for making things right.

Rob told me he is a lover of crosswords. He still does the Daily Telegraph crossword everyday whilst living on the Costa Brava. I guess that is where he picks up all the fancy language then.

Add to that a degree in Physics – nuclear physics:

R: Any work in science is incredibly interesting, but can be quite limiting. I worked in a medical environment, where the budgets are small, the experiments expensive. So you learn to model experiments, use computers, often very old kit, and get the results you need by some method or other. I spent 6 months in a lab trying to detect gamma-ray photons with a reverse biased diode before discovering that NASA had done it and published the results in the IEEE magazine.

K: Sounds a bit frustrating, if you ask me.

His studies took him to IT.

R: I learnt a lot about problem solving, especially with technical equipment, troubleshooting, and how to automate boring tasks through programming. I realized I preferred the computing side to the pure physics after a while.

K: Guess what.

No.

He did get his degree. But that was it for Rob. He knew his interest was within IT. As he say:

R: It was no loss to physics I assure you.

K: He continues:

R: After University I got my first job in IT, on a helpdesk at an Investment Bank. We dealt with traders all day, "my printer doesn't work, FIX IT NOW!".

"Yes sir, is it plugged in?". Phone slams down. Etc.
I left after too much abuse from people with limited intellectual capacity.

K: He moved on quickly to different positions, finally ending up in Spain. His love is with encryption, but at present he is trying his hand with data integrity at a start up in Barcelona.

One thing I like with Rob is his true interest in the topic. Once he starts, well, need I say more?

R: Information Security as a concept is exactly what it says, the security of information. The future of security is in the data itself, but of course this means making sure authentication is strong and access controls work properly.

The data needs securing with proper confidentiality and integrity controls, and we need to be able to access it instantly, with complete visibility and easy management.

It's a tall order, but it's being solved already by the big names.

K: He explains:

R: IS as regards business is made up of 4 important facets:

i. Protection

ii. Policy

iii. Awareness

iv. Evolution

These factors loosely relate to how my generation has typically learnt about security. I think the most effective security practitioners tend to start as technical support/engineers, working mainly on technical issues based around protection on the network.

Without some form of protection, usually technical controls, a policy is only as effective as the strongest link, i.e. those who abide by the letter of the law.

The protection needs to be there for the weak links, those who deliberately or accidentally break the rules and need putting back in line.

Technical controls rarely solve policy issues, but without them, the policy is useless.

K: How does your blog fit into the picture?

R: I'm really encouraged by the number of other bloggers out there contributing to the awareness effort now, even if a lot of it isn't spot on (including my own), at least people are discussing it. That's the most important part of IS for me, discussion and evolution.

K: You seemed to be frustrated in not getting out to blog about BlackHat this year, what did you miss?

R: Events like the recent BlackHat and DefCon, although they are now being touted as "sell outs" because they are full of vendors, are important because information on attacks is being disseminated.

I was interested to see that much of the content at this year's shows was not new attacks, but new ways of using attacks to create problems. We aren't keeping up technically with the bad guys, even though there seem to be a million vendors trying to find a space.

We desperately need to evolve, but we're already trying to squeeze money from a market that is drying up because we're not moving fast enough.

K: So what impact does that have on business from an IS perspective?

R: Any discussion of IS impacts on business would not be complete without at least a mention of risk. To properly understand risk can take a lifetime, and I am by no means an expert.

One of my absolute favourites in the blogging community is Alex Hutton over at Risk Analysis, he's put me right on more than one occasion and he's not afraid to speak his mind. This is what security needs, rather than standing on soapboxes and shouting about what's right, quiet questioning and flexible beliefs.

The only problem with IS being based solely on risk is that the introduction of a new security product or process into a corporation is founded in finance. The balance of this is being slowly tipped by the introduction of regulations and laws which apply a higher level of risk for breaches.

This is driving security as a business at present, and therefore the evolution of security products, which I explained already as being crucial to the whole security process. Unless regulations are focused in the same areas as the attacks, security will not evolve evenly. The only way these regulations can address the attacks properly is by evolution, which can only take place with proper debate and awareness.

K: So do you think solutions and standards will evolve at the same rate? What are the market trends?

I think businesses will have a continuing battle trying to decide which vendors to invest in. Security is converging, the big vendors like CA, Symantec have their own proprietary systems, and now Microsoft and Google are in on the act, there is added complexity, not to mention money being thrown into the issue.

I can foresee a lot more standards being introduced so that security systems can all talk to each other in a similar way.

SOA is taking us in that direction. I think we will see open source become more popular because of it's use of SOA, and consultants in this area should do well.

As the larger companies take over this will probably be a route many existing security practitioners decide is more interesting.

As I implied previously, GRC (governance risk and compliance) will become big business, because it will be a big driver.

There are new regulations being introduced all the time, SOX and PCI DSS in the US, this year we will see MiFID in the UK and Europe. Again, I can see compliance consultants making big business here as a result.

Something that is interesting me a lot at present is The Long Tail and the security problems it poses. I’ve been discussing it for the last week with Mark Curphey and Jon Robinson (also of the SBN) and I’m still no clearer. Mark has something up his sleeve, but isn’t revealing it.

We will be using many more individualized processes out to many more customers, with customized products and therefore customized security on an individual level. This will come down to data security at the end of the day instead of trying to apply everything at the network level.

We need to see how users adapt to creating their own Web 2.0 before we can start to secure it however, and at the moment there are a lot of holes. This is somewhere where I think the large companies like MS and Google will make their security solutions, as it is difficult for the smaller companies to make a difference here now.

Thank you Rob!

Visit IT-security – the view from here

Over the time, I have learned to enjoy and like the next blogger on Security Profile. His wit, his way with words and his direct approach has created reactions around the blog-sphere.

I know I for one have cried, yelled, laughed and nodded (not all at the same time, though) over the time I have enjoyed his blog.

Who is he? Well, you’ll have to stay tuned a couple of more days to get his security profile.

But I can guarantee you – you know his blog!