Peter Christy

A Shoutout to Marvin Wheeler ....

I just learned that Marvin Wheeler is leaving Terremark, having completed their transition into Verizon. Marvin is one of nicest and most interesting people I've worked with.

I met Marvin at EMC's "Road to the Private Cloud" analyst meeting late in 2009. Terremark was a featured EMC customer "poster boy" talking about the government business they had been capturing into their new Cloud data center offering. I asked Marvin what the key to their value proposition was. He said that his answer would probably surprise me: it was the security that they provided. He was right. At the time (and to a large degree still today) security shows up on the "con" side of the Cloud ledger, not on the "pro." I asked Marvin if we could follow up on the topic and he arranged a follow on briefing with Chris Day, Terremark's security leader.

Marvin explained that five years prior he had hired Chris, noting that whenever computer crime was mentioned in the Miami papers Chris was always the expert quoted. In that time, Chris had built up an interesting set of security services sold togovernment clients and in support of areas like forensic accounting. They specialized in what you did after you had been penetrated, not just preventing penetration (until recently, the prime focus of the "security companies"): discovering penetration; understanding the nature of the threat and scope; stoping the threat; remediating the damage. Terremark had realized that in a virtualized SP data center they could offer versions of these services that were pre-wired into the infrastructure fabric (rather than having to be patched in after an attack) and they could provide the expertise to use these offerings whereas their government customers couldn't on their own. On balance, although you might be slightly more vulnerable to penetration in a multi-tenant data center (or at least it was arguable), you were clearly better off if you were penetrated. Terremark was way head of the rest of the world being able to view the Cloud as a new medium with new opportunities rather than something where you did what you always did.

I was impressed and added Marvin to my "bright people worth keeping in touch with" list, and discovered along the way he was one of the "nice" guys in the business, always possible to reach and always useful to talk to.  More recently, Marvin as been central to the formation of the Open Data Center Alliance that was spun out of CIO discussions that Intel had.  I would guess that the Cloud purists think this is another example of how hopeless private clouds are, but ODCA is an important venue for making progress on building practical hybrid Cloud integrations.

I can understand completely why Terremark all of a sudden getting much bigger quickly is a time to move on. I'm sure Marvin will show up somewhere interesting soon enough, and wish him the best!

Shoemaker's Children

As has been well-publicized by now, RSA Security was broken into, a fearful event because of the possibility (however remote) that the result would be compromising the security of one or more of their token customers. RSA did a pretty good job of communicating with their customers and with the analyst community, but you have to wonder what kind of realization is sparked inside. At the RSA Show earlier there was a beginning dialog that businesses should assume that they are at least partially penetrated rather than just focusing on preventing penetration. I would guess that is what RSA realized painfully. Historically businesses used a perimeter defense with a "soft" interior meaning distrust those on the outside and trust those inside. If you think you may be penetrated you have to distrust everyone and become much more consequential about examining and controlling all communications, include that which is entirely inside the business. I'm betting, unencumbered by any facts, that RSA is getting much more concerned about who does what within the company as well as from the outside. It's a good lesson for all, ideally learned before the attack.

Scott Charney: Internet Security as Public Health (take 2)

Microsoft's Security CVP Scott Charney regularly produces really provocative ideas. In the last 12 months Scott lofted the idea of treating computer infection like human infection and using network quarantine just like we do in the case of infectious diseases. He got quite a bit of feedback and he discussed that and his revised vision as part of his RSA keynote. There are a lot of infected PC's in the world that are used in BotNets to inflict all sorts of evil things. In most cases the PC owner is blissfully ignorant of the infection. So what if your PC-based VoIP phone has replaced your land line, and just when you need to make an emergency call your PC has been quarantined from the network (Charney's original suggestion). Obviously bad things could happen. In response to this criticism and others, Scott ingeniously folded in the use of Microsoft's Identity Claims architecture. A key concept here is that a user has many ways of satisfying an external request for identity credentials and which is used is entirely under the user's control. The idea here is that low value Internet uses could continue unabated on an infected computer (where the infection had been determined externally – all the security companies have lists of lots of known infected machines) but that sensitive transactions could require that some proof of health. For example, your PC is believed to be infected and you try and access your bank account. The bank replies by requesting a proof of identity that incorporates a health certificate (that could be provided by your security software). If the trusted security software believes that the machine is healthy (the security software is enabled and running with up to date signatures and a scan has been done recently) then the request would go forward. Otherwise the user would need to take a cleansing break until that certification was available. It's not as simple as the original quarantine idea but a lot more practical. It's clearly not a practical short term solution but could be an important component of improved network security and trustability downstream.

Cisco Does Software

Cisco introduced the ASA 5585-X security appliance. Beyond the exciting name (J) this appliance demonstrates how far Cisco has come at embracing software solutions in lieu of those dependent on custom silicon. To be fully honest, there is still a smidge of silicon special sauce in the 5585, but mostly it's based on the Intel Nahalem-EX ("Westmere") server CPU's. The 5585 is a 2RU appliance with two processor blades inside (one imagines something similar will show up soon in other devices). Each blade has two 6-core (12 thread) CPU's and a wad of DRAM. So inside the 2RU there are 4 CPU's (24 cores, 48 threads) a whopping amount of good old vanilla X86 horsepower. Getting 48 threads to coordinate on an application requires careful attention to architecture and implementation, but Cisco has a lot of relevant experience in the Ironport email and web proxy offerings and they seem to have put it to good use. When the Ironport team assumed a much larger role in the Cisco security business, Tom Gillis talked about driving a software — intensive plan focused on leveraging Intel commodity parts and that seems to be just what has happened. It isn't quite pure software yet, but it's getting pretty close. Now Cisco can listen to Intel's clock of progress with the anticipation of getting a faster security system more or less for free.

Microsoft Security Intelligence Report

Late in 2009 Microsoft published the 7th version of this report, covering the first half of calendar 2009. In addition to the threat intelligence research and the feedback from the virus and spam control tools that all security vendors have, Microsoft uniquely gains information from: the hundreds of millions of Windows systems that use Microsoft and Windows Update capabilities; from the automatic application and system problem reports that many Windows systems send back to Microsoft; as well as from the reporting from the Microsoft Malicious Software Removal Tool, a tool that Microsoft runs regularly in the update process targeted at the detection and remediation of selected current threats. Microsoft uses this report to promote its security activities, but invests effort far beyond that in terms of broad reporting and analysis on the ever evolving threat and threat response landscape. The result is a remarkable 200+ page document chock full of interesting data and graphs, available for download from Microsoft. Scanning the current version of this report should be required for anyone trying to understand these important topics. My hat is off to the folks at Microsoft for the continuing investment and very useful contribution. — pchristy@irg-intl.com