7 ms·

CISO budgets are exploding at large companies; in '98 most of these companies didn't even have a CISO. Firewalls have proven to be ineffective and companies ar

by ig1 12y ago

CISO budgets are exploding at large companies; in '98 most of these companies didn't even have a CISO. Firewalls have proven to be ineffective and companies are willing to pay for solutions that are more effective. Attackers have also gotten a lot more professional and sophisticated. There's certainly been plenty of billion dollar security companies been built outside of the firewall space in recent years (FireEye, Varonis, Lifelock, Trusteer, Cloudflare, etc) and there's undoubtedly going to be many more. Security also has played out in mobile the way you suggested can't happen. Companies like Lookout and BYOD management companies are well on the way to building billion dollar businesses in spaces traditionally controlled by entrenched vendors enabled by the shift to mobile. (incidentally the security section was written by Scott Weiss who founded IronPort and later ran Cisco's Security Technology Group; so not someone unfamiliar with the security space)

tptacek 12y ago
FireEye is the firm I alluded to in my comment. Varonis, Lifelock, Trusteer, and Cloudflare aren't reactions to deperimeterization and the declining effectiveness of firewalls. (Ironically, Cloudflare is if anything a cause of the declining effectiveness of firewalls, not a solution). Also: my argument isn't that it's impossible to build a billion dollar security company! It's that the dynamics of doing so aren't isomorphic to those of other startups. I think you missed the point of my comparison to mobile, which was not that there wouldn't be viable mobile security products, but rather than shifts in technology produce explosive returns for things like adtech and video, but tend not to do that for security. Lookout is I think the closest you come to an example of a breakout success for security, amidst the most important shift in computing since the personal computer, one that has minted a bigger number of larger successes outside security. The STG has been beating the drum on post-firewall broad-scale deployment of security technology (= more blue pizza boxes) since Jayshree Ulal started it a decade ago. Have you read a lot of Jericho Forum stuff? If you found Weiss' piece interesting, I think you'd find Jericho especially interesting. Maybe even lucrative. ;) (Voted you back up)
- walterbell 12y ago
  What do you think of software like Bromium, Qubes, etc. which creates enclaves within endpoints?
  - tptacek 12y ago
    Very cool and very difficult to operationalize. If I was a VC, I would (cruelly) sum them up as "features of Citrix". Also, if you want to sell an enterprise security team a security product, saying that it reduces the need for stuff like Citrix would be a pretty good pitch.
  - m0nastic 12y ago
    I've worked implementing both, and Bromium is basically as good of a solution to this problem as you're going to get, in the sense that it requires the least modification of user behavior (the user's Windows machine mostly behaves like a normal one). Even Bromium was pretty upfront about the use case for their product though (high-value targets like executives who travel to China). They were very honest about it being overkill for an entire enterprise. I think securing endpoints is basically a lost cause though (I'm happy to consider that a minority opinion however). My company spent many years trying to get TPM's to be the solution to this problem, and I'm pretty sure that ship has now sailed; with the only 2 sectors of the industry that are continuing to grow being completely unsuited to TPMs (virtualization and mobile). I think we'll eventually realize that much like networks, devices have to assumed to be untrustworthy, and we have to route accordingly.
    - walterbell 12y ago
      > the only 2 sectors of the industry that are continuing to grow being completely unsuited to TPMs (virtualization and mobile) A counterpoint is that mobile platforms often have some form of secure enclave, but sadly not standardized. Even AMD's low cost x86 CPUs are adding an ARM coprocessor, which could in theory be used for functionality similar to TPM, DRM, or AMT. Some of those are more useful than others. On the Intel side, SGX will add more enclave options, and complexity, but hopefully will be open and well documented.
beat 12y ago
In '96 or so, I went to my first Internet security conference. The attendees were a motley crew - junior programmers like myself, schoolteachers, old-school sysops, etc. Lots of us worked for companies that wanted unfettered access to this new Internet thing, but it had to be absolutely secure - and of course, it can't cost anything! There was hardly such thing as a network security professional then. Things have changed a lot.

by ig1 12y ago

tptacek 12y ago

FireEye is the firm I alluded to in my comment. Varonis, Lifelock, Trusteer, and Cloudflare aren't reactions to deperimeterization and the declining effectiveness of firewalls. (Ironically, Cloudflare is if anything a cause of the declining effectiveness of firewalls, not a solution). Also: my argument isn't that it's impossible to build a billion dollar security company! It's that the dynamics of doing so aren't isomorphic to those of other startups. I think you missed the point of my comparison to mobile, which was not that there wouldn't be viable mobile security products, but rather than shifts in technology produce explosive returns for things like adtech and video, but tend not to do that for security. Lookout is I think the closest you come to an example of a breakout success for security, amidst the most important shift in computing since the personal computer, one that has minted a bigger number of larger successes outside security. The STG has been beating the drum on post-firewall broad-scale deployment of security technology (= more blue pizza boxes) since Jayshree Ulal started it a decade ago. Have you read a lot of Jericho Forum stuff? If you found Weiss' piece interesting, I think you'd find Jericho especially interesting. Maybe even lucrative. ;) (Voted you back up)

walterbell 12y ago
What do you think of software like Bromium, Qubes, etc. which creates enclaves within endpoints?
- tptacek 12y ago
  Very cool and very difficult to operationalize. If I was a VC, I would (cruelly) sum them up as "features of Citrix". Also, if you want to sell an enterprise security team a security product, saying that it reduces the need for stuff like Citrix would be a pretty good pitch.
- m0nastic 12y ago
  I've worked implementing both, and Bromium is basically as good of a solution to this problem as you're going to get, in the sense that it requires the least modification of user behavior (the user's Windows machine mostly behaves like a normal one). Even Bromium was pretty upfront about the use case for their product though (high-value targets like executives who travel to China). They were very honest about it being overkill for an entire enterprise. I think securing endpoints is basically a lost cause though (I'm happy to consider that a minority opinion however). My company spent many years trying to get TPM's to be the solution to this problem, and I'm pretty sure that ship has now sailed; with the only 2 sectors of the industry that are continuing to grow being completely unsuited to TPMs (virtualization and mobile). I think we'll eventually realize that much like networks, devices have to assumed to be untrustworthy, and we have to route accordingly.
  - walterbell 12y ago
    > the only 2 sectors of the industry that are continuing to grow being completely unsuited to TPMs (virtualization and mobile) A counterpoint is that mobile platforms often have some form of secure enclave, but sadly not standardized. Even AMD's low cost x86 CPUs are adding an ARM coprocessor, which could in theory be used for functionality similar to TPM, DRM, or AMT. Some of those are more useful than others. On the Intel side, SGX will add more enclave options, and complexity, but hopefully will be open and well documented.

beat 12y ago

In '96 or so, I went to my first Internet security conference. The attendees were a motley crew - junior programmers like myself, schoolteachers, old-school sysops, etc. Lots of us worked for companies that wanted unfettered access to this new Internet thing, but it had to be absolutely secure - and of course, it can't cost anything! There was hardly such thing as a network security professional then. Things have changed a lot.