John Katsaros

RSA Week and Juniper's Shiny New Fabric

RSA is always such an interesting conference we always enjoy writing about it.  As an extra bonus, last week Juniper announced its major new product – QFabric – which gives us more stuff to talk about.

Thumbs up or down?

The keynotes at RSA, rumored to cost more than $100K per speaking spot/sponsorship slot, are always an interesting collection of vendors talking about their security product strategies.  In the good old days the CEO's used to show up – Gates and Chambers would be there showing their comprehensive focus on closing security holes.  But these days the topic has cooled off.  The titles are more often General Manager than corporate CEOs and the presentations are not as interesting nor theatrical as before.

We thought that this year we'd do a brief summary of the high points from the vendor keynotes.

Vendor	Keynote Speaker	Summary
RSA (EMC)	Art Coviello	Trust the Cloud
Microsoft	Scott Charney	Kumbaya – work together and we'll solve these security issues
Symantec	Enrique Salem	Walls are broken.  Manage and Protect. Watch out there's really bad stuff out there.
HP	Bill Veghte	NSecurity needs to evolve – Today REACTIVE.  Tomorrow PROACTIVE
CA	Mike Denning	Who, what access, what role? Then it suddenly turned out to be a panel session.
Cisco	Tom Gillis	Collaborate with Confidence. Every Device, Every Moment
Qualys	Philippe Courtot	Hard to tell what that was about – it also turned into a panel session and he became a panelist.  "Biggest fear is fear itself"

 

Big Footprint – Even Bigger Plans

During his keynote at RSA, RSA's Executive Chairman Art Coviello had Richard McAniff, VMware's Co-President and Chief Development Officer join him on stage for a "discussion" about Cloud Adoption.  What strikes you the most is that these companies that are important in the virtualization world are owned by EMC (fully owned in the case of RSA and 80% owned in the case of VMware) which itself is very influential regarding virtualization.  And what's good for one isn't necessarily good for the other.  Security, for example.  It's not in VMware's best interest to focus too much on security issues – security concerns might slow down customer virtualization deployments.  RSA on the other hand would love to focus attention on virtualization security issues (especially ones that are mitigated through use of its products).  That might have been the case for server virtualization but with cloud computing this might be different.  Coviello's and McAniff's co-presentation was essentially a preemptive dividing up of cloud security – we'll do management and compliance, you do security controls and we'll let others do network and endpoint security.  Normally these positions would be competed for in an open arena.  But, for instance,  why would VMware or EMC (along with Cisco) the co-owners of VCE decide to open up the V-Block configurations to competing products when they can just as easily block anyone trying to fill the space.

Compliance or Operational Improvement?

The RSA exhibit hall was filled with companies promoting "Compliance" as the value proposition.  While on the one hand it's easy to see how compliance is important since organizations who don't meet their compliance obligations may either be monetarily fined or prevented from doing business.  However, vendors are reaching something we're calling  compliance parity – if Vendor A makes you PCI compliant and Vendor B also makes you PCI compliant (and the same for vendors C,D and E), then hasn't compliance become a commodity at that point and don't A, B, C, D and E need something else to differentiate themselves?  When we asked vendors about this our friends at Agiliance had the best response – the difference is Operational Excellence.  Compliance in the first place is government's way of mandating IT operational improvements.  In the long run organizations must drive operational improvement and compliance is really a few steps into a much longer journey.  If a vendor does it right, their customers not only can pass a compliance audit, the quality of their IT organizations are substantially improved.

RSA 2010

For years we've listened as Art Coviello, RSA's CEO, kicked off the RSA conference keynotes with his view of the industry. Whether you like him or not, it's his show so he gets to set the stage for what follows. Three years ago Art C. predicted the demise of the independents in the security business — consolidation and collapse of the many independent firms was on the horizon as the major players swept up features and functions till all we had left would be a "Snow White and the Seven Dwarfs" type of market (and you could guess who would be Snow White). While sounding dramatic at the time it was largely wrong in large part due to the fact that security is not a static problem but changes on both the user side and the attacker side. You don't have to look far for proof that the independents have done well in the past few years — ArcSight and SourceFire might be the most visible proof of this. In this year's keynote, he talked about the importance of the cloud and the need for security in order to make Cloud Computing adoption happen. And the topic of securing the Cloud was pretty much the most popular topic of the vendor keynotes. The Cloud is viewed as a security opportunity that no one wants to miss. But what does that mean? Right now Cloud security is pretty much a PowerPoint battle, with vendors crossing out the word "Server" in their old presos and putting in the words "Cloud Computing." Three years ago the business consolidation prediction for security turned out to be wrong. It may well end up that the Cloud security promoters don't yet understand how things will evolve.

Someday Soon — Learning from RSA

One thing that stood out at this year's RSA conference was how sophisticated the bad guys have become — in the 20 years that bad stuff has been happening to computers the bad guys have gone from being disgruntled individuals cobbling together a new virus at night to today where the threats are coming from first class development shops interconnected through complex value chains with specialists at every stage of the process. Today's bad guys are well endowed both financially (able to afford world class development environments) and intellectually. At the rate of technical improvement they'll soon be ahead of the vendors that we rely on to protect this stuff. Consequently, defending against these threats isn't easy, either for enterprises protecting corporate assets or for vendors building security products. A few years ago we were skeptical when in his keynote address RSA's president Art Coviello predicted a decline in the number of small security startups due to structural consolidation in the security business. Well that decline might just come to pass for an entirely different set of reasons — as the bad guys have become incredibly sophisticated building security products has become incredibly complex and expensive. Small players can't afford to keep up with the bad guys. It's going to take more than a few million dollars to finance "the next big thing" in the security business. Keeping up with the bad guys will require significant engineering expenses and top talent — lots of time and money.

Where have all the demos gone? (Longtime Passing...)

None of the RSA keynote speakers did a demo onstage. That's too bad; the demos are usually the best part. We assume that there was some sort of show sanction restraining presenters. Let's face it, with the exception perhaps of John Chambers, the average high tech RSA keynoter isn't that interesting of a speaker (or may not have enough to say) without the drama and entertainment of a good demo. Most of these guys are salesmen anyway, so it should come as no surprise that a good salesman is more interesting when there is a little "show and tell" that accompanies the performance. This is one change we're voting for in 2010.

Clouds Got In The Way

The Configure virus, aka Conficker C couldn't have come at a better time. For the past few years, we've pointed out that the security industry needs a good old fashioned virus to put a spike in sales. The timing of Conficker couldn't have been any better — you'd think that the RSA Conference team was giving PR advice to Conficker's creators. Imagine this scenario — in March, about five weeks before a big security conference, news gets out of the discovery of a "state of the art" threat with advanced intelligent features and modern link security for phoning home. This threat was to deliver its payload on April 1st (just three weeks before the conference). Just what the security industry needed. Unfortunately, there were only a few vendors who make marketing hype around this threat. Almost 1/3 of the signage at the show exhibits were about "cloud" strategy — the industry's latest buzzwords. And it's worth pointing out that these were mostly hype strategies without any real underlying technology yet. And the keynote's speakers' slides also were mostly about future strategies, not dealing with the current threats. It's a shame — a threat with such good timing is a valuable thing to waste.

Send In The Clowns

Did you notice the number of relatively small security acquisitions that took place in or around RSA this year? There was a bunch. Seems to be a combination of reasons resulting in low acquisition prices — investors are tired, it's not fun being a small independent security company with current market conditions, growth is slower than expected and things are taking too long. Buyers, being offered good deals, are making acquisitions to fill in holes in their product lines to offer broader product suites. It will be interesting to see how many of these acquisitions actually result in significant revenues. Often what looks like synergy turns out to be a distraction — after all, the reason that these small companies have had difficulties is due to their lack of getting market traction in the first place.

Recession Tales

If you didn't think there was a recession before you went the RSA conference, you might have come away with a completely different view. The conference was "too quiet" which may have been due to its unusual scheduling (usually the conference is in February while this year it was in April during a week which conflicted with two other infrastructure events plus Spring Break for many families). But you couldn't help feeling the slowdown -- it didn't seem as big or as active as past RSA events. And there is plenty of reason for thinking that the security business could be in for an economic driven slowdown. As you know, the security value propositions have evolved to include risk and compliance. Several vertical markets, most notably the financial services vertical (banking, securities and insurance) consequently play a greater role in the early adoption cycle of these products -- the financial industry understands risk and has lots of regulations to deal with. Unless you've been under a rock for the past six months, it's hard to miss the fact that the financial sector is being pummeled due to the mortgage crisis -- companies in this space are loosing billions. It's well known that companies in the financial sector are quick to respond to changes in their bottom line by increasing (or in this case decreasing) their IT spending. And of course, it's likely that what gets cut first is discretionary spending on new project initiatives (the very thing that the security infrastructure sector needs the most). So it may be that there is a direct path from the front page woes of the financial industry to a slowdown in the rate of adoption of new security initiatives. Usually, we look to the financial sector to lead infrastructure sectors out of a recession by being the first to increase budgets. The question is: "If not them, then who?"