Scanning with Canning: Catching The Wave of Emerging Security Trends

Nurturing Strong Partnerships, EBT style

For emerging companies, building and nurturing strong partnerships is critical to your success. Start-ups, VCs, and business development executives are invited to this one-day symposium, hosted by Microsoft’s Emerging Business Team (EBT) to learn how to maximize opportunities, build strategic initiatives, and develop a successful partner engagement with Microsoft. For more information about EBT, go to http://www.microsoft.com/startups

Tuesday, November 29, 2005
8:00 am - 4:30 pm
Microsoft Silicon Valley Campus, Building 1, Mountain View, CA

Keeping an eye on insider misbehavior

As part of my Job with the Emerging Business Team I get to work with cool innovative start-ups. Oakley Networks is a very interesting company based in Salt Lake City, UT working on keeping an eye on insider misbehavior.

“According to Gartner, 70% of security incidents that incur actual losses are inside jobs, making the insider threat arguably the most critical threat facing the enterprise.”

Oakley’s roots were in information web-site behavior patterns & analysis, and recent past three years assurance solution provider to the Department of Defense. Oakley is now focused on securing extremely large enterprises (many of them more than 30,000 desktops) against the leakage of vital data before it leaves the company network.  As you can imagine this type of technology is prefect for SOX, HIPPA, GLB, IP, HR compliance, vendor collusion, insider trading and profanity filtering utilizing a customable rules base engine tailored to your commercial enterprise policies.

The simplest way to understand what this product does is; capture all keystrokes and text input into ‘any’ application and the ability to scan those strokes against the ‘corporate policy’ rules based engine. When a policy is violated, an alert is sent to SureView™ monitor for TiVo like playback – no matter the application form. Additionally, it captures the editing aspects of authoring; like the insertion & deletion of text; I.e. composition of web-based e-mail messages containing intellectual property and then subsequently deleting content upon reflection of better judgment. No matter, Oakley has already captured the before and after intentions, busted! – Pretty cool stuff.

This innovative patent-pending technology enables companies to secure and sift vast volumes of communications without being overwhelmed with data while introducing and enforcing enterprise wide security policies. Again, whether inadvertent misuse, well-intentioned abuse or malicious exploit only, SureView alerts security personnel upon the violation of those policies, replays a unique pre-encryption or post-encryption video replay of the violation for investigation.

Oakley Networks is a leader in the “Insider Threat Management” space serving the commercial and government sector. Additionally, the company is growing at a fantastic rate with over 130 employees, reaching sales to over $30M in 2004, and looking even better in 2005.

Keep your eye on these guys…

e-Security Wave Catcher

We all know that security intrusion, protection and compliance are hot topics these days as mentioned in my earlier article “Send Lawyers, Guns and Money”. And promised I would write about some of my favorite companies I work with, one of which is a great bunch of guys from e-Security.  e-Security focuses on Security Event Management (SEM) and continuous compliance monitoring for IT controls. Basically, their software makes sense out of the deluge of security log data that all the different systems on the network spit out. It replaces the manual work of sifting through all that data with automation and then correlates the information, issues alerts (unlike my dog Kasie who generates many false positives), provides remediation processes, reports, etc. Saves time, money and helps you manage risk more effectively.

They’ve got a ton of folks from the industry and they seem to get it. The company’s really easy to work with and worth taking a look at. 

They are quick to adopt the leading edge technology from Microsoft… On November 7th lookout for great press on thier latest product release!

Additionally, they have an all-star management team starting with CEO Chuck Teubner who recently transitioned from Groove Network where he was President.  Chuck is responsible for strategic planning and execution, corporate leadership, and taking the company to the next level of growth and success.

CEO Chuck Teubner

Reed Harrison is the Founder and Chief Technology Officer for e-Security, Inc. and serves as an innovator and recognized specialist in the information security industry. Reed holds a patent on network-based intrusion detection, and co-founded e-Security following eight years as Chief Security Officer at a Fortune 500 company, where he built and successfully deployed global security processes.

CTO, Founder Reed Harrison

How to position startups successfully in enterprise engagements;

Being a former Financial Service Information Technology executive I am often asked by startups; how do I position startups in large enterprise engagements.  The answer is simple – have something that is of ardent interest to the organization that complements their existing infrastructure and skills.  Keep in mind the most expensive aspect of any risk based enterprise venture is the cost of people, and loss of time, therefore your product/service must synergize with the existing architecture and development / support philosophy.

One such endeavor I recall that was a very successful Grid engagement that was lead approximately two years back within a major insurance company in NJ.  You wouldn’t typically associate insurance companies with cutting edge technology; however this one was very proficient with multi-million dollar Massively Parallel Processing (MPP) platforms.  Enter startup Topspin (TS) networks, which did their homework identifying major accounts and noted risk taking individuals engaging in this space of MPP technology.  Essentially, TS switch created a virtual Grid architected exactly like IBM’s SP2 MPP switch, only TS switch was focused x86 nodes costing $1,500 each, opposed to IBM’s AIX nodes costing $250,000 at that time. The IBM MPP architecture was quickly mimicked with TS Infiniband switch and cost savings ranged from 10 to 15 cents on the dollar as compared to price performance on $MM MPP platforms.

Being an enterprise early adopter of Grid technology I was asked to present my findings at several different industry events -- displaying results and relative costs (use search engines for details).  While speaking Stanford Networking Research Center (SNRC), I requested that Topspin and Venture Capitalist community recognize Microsoft as a key player in the enterprise space, and that any Grid platfrom would only realize fully enterprise utility when provisioning Microsoft OS is achieved.  Well, my request was recently answered on September 16 2005; Topspin announced support for Microsoft Windows 2003 with high performance Infiniband protocol drivers.  From my perspective, Topspin’s approach to Grid computing is the most ‘pure definition’ of utility Grid computing in the industry, combining open architecture flexibility, with high performance x86 computing.

So what are some of the lesson learned?

• Must align with enterprise corporate philosophy.

• Must be easy to install & maintain with little impact on existing staff & skills.

• Must partner / evolve with other technology standards (i.e. MPP)

• Must be open to other vendors platforms (i.e. UDB, Oracle and MS SQL server)

• Must be cost effective.

• Must beat existing technology in price & performance

Icing on the success story, Topspin was recently acquired by Cisco May 2005, for their market leadership and penetration into enterprise datacenters.

Send lawyers, guns, and money

I think Warren Zevon song “Send lawyers, guns, and money” was a metaphor about the condition of fighting security vulnerabilities within corporate America. Many operating systems threats originate from the former Soviet Union, Europe, Middle East, and Africa where the long arms of the law can not prosecute. It’s a huge financial gamble today for corporations not to take very aggressive actions against these vulnerabilities. Check out these stats - - It’s not difficult to explain why fighting normal security threats isn’t enough anymore;

• Number of active Phishing sites nearly 3k, new Axis-of-evil hosting sites Canada, Korea, US.
• Identity theft fraud losses est. $53 billion annually, 10mm individuals affected and companies experience cost averages internal 2-3mm verse 57k external per incident.
• Personal Liability of Identity Theft; between $5k and $10k.
• Credit Card fraud 10mm annually / 160,000 incidences / 45mm compromises.
• 2+Billion spent on security consultants, and rising by 15% annually.

Which brings me to another point; my personal carbon based security system is called Kasie. A 65lb yellow Labrador retriever who generates many false positives (i.e. continuous barking), articulated in painful detail by my neighbors. She is frequently disabled by the “Red-Collar” that contains a special electronic device that administers a small shock when barking occurs. I’m sure both neighbors and criminals love it!

Security technology can also cause the same effect generating excessive Security Information and Event Monitoring (SIEM) without context of usage. Too many false positives and you just want to shut it down, resulting in letting the criminals in. The delicate balance is driven by the law of; stopping the bad guys is good, stopping the good guys is extremely bad. Making sense of all this data and developing a proactive response plan is the first step in taking an active offensive position.

The good news from my perspective is that the space is getting a tremendous amount of attention, and many Emerging Business startups are presenting very creative solutions covering hot spots fitting perfectly into corporate strategies. In case you haven’t read my bio yet, I joined the Microsoft Emerging Business Team July 2005 managing the Security Portfolio. The Microsoft Emerging Business Team (EBT) works with venture capitalists (VCs) and Independent Software Startups (ISVs) start-up companies worldwide to enable innovation and accelerate the software ecosystem. The Microsoft EBT mission is to identify and facilitate opportunity for start-ups and VCs, acting as the single point of contact and accountability to Microsoft. I have roughly 250 Security companies (70% Microsoft based) growing by est. 25 per month and constantly scanning the portfolio for disruptive players for trend setting technologies.

In the near future I will post trends, links, hot spots and feature companies that I find very interesting - - and of course if you have something you’d like me to check out please don’t hesitate to reply, or e-mail me on the topic.

Don.