RE: Where is security industry gng??

[Ron DuFresne <dufresne () winternet com>]

On Mon, 13 Sep 2004, Geoff Shively wrote:

> Think about it this way, security was once focused on simple solutions
> to solve problems (network architecture with security in mind, device/OS
> hardening, etc).
>
> Let us recap the history of the industry so that I can set the stage for
> where I think it is headed.
>
> In the last 5-7 years the security problem has grown complex and sheer
> number of threats have skyrocketed, which brought to life an industry of
> complex solutions to a combat a complex problem. IMHO, the wrong way to
> deal with the problem.
>
> Companies began popping up left and right with the latest and greatest
> network security appliance to position themselves on the network (in
> some odd or obscure location) and perform tasks that are only useful if
> you have one of the companies other 5 security devices working in
> tandem.

Actually, I think the security device industry rose to meet the needs of
companies not willing to foot the bill of paying for the expertise that
was at the time.  Devices tend to have sweet GUI frontends, and make life
easier on those without many of the skills that have now become all the
rage and made security skills and certifications the side markets they are
now.

> Odd behavioral and AI technologies had been all the rage for in
> 01'-03' as IDS rose to the top of the market. With an expensive and
> complicated network of sensors and reactive response units in every
> corner of a network it was not wonder that Richard Stiennon from Gartner
> released the "IDS is Dead" report
> (http://www.nwfusion.com/news/2003/1006ids.html) back in 03.

IDS' were first proposed as tools to sit behind the FW, to amke sure it's
policies were compliant and not bypassed, most folks soon thought of them
as a toy to sit in front of the FW, to help make arguements about how
important their department were and in an effort to garner more funding
<see hyow many attacks we stopped and spotted just today!>.


> 2003 IDS Company: "Oh no, IDS is dead, someone call marketing and tell
> them we are now IPS"
>
> We have all seen the move from IDS marketing to IPS marketing, the same
> stuff, repackaged, repositioned, and resold to enterprise. Fortunately
> the cream is rising to the top and old re-branded IDS/IPS solutions are
> being shelved by enterprise.

IDS' as mentioned above tend to be misunderstood, and so misconfigured
that they tend to be ignored, and they tend to be placed and forgotten,
even by those adept at tuning them cause there is no funding for a person
or three to monitor them, no wonder they have been annouced by gartner
<choke> as dead, they were never given proper life to begin with...


> I would like to say that we have seen the last of people installing
> overly complex 'solutions' to cure their acute security pains... but we
> have not.

Agreed, security has quickly forgotten the main principle in IT, KISS.

> So, to where I think the industry is headed.
>
> [*] Reactive technologies die out, they cannot react fast enough to
> modern day threats
> [*] Security moves back to the host, where it is needed most. Harden the
> OS. Helps solve internal attack and propagation issues and also
> external.

Not to mention HP's venture to incorporate it into the kernel which tends
to make a system with all the bells and whistles turned on run like a 386
with winXP...

> [*] Routers and switches will begin to incorporate more security
> features by default. This will keep perimeter security moving along.

begin?  This has been happening for about 6 years now, and is a variation
on the sec-device market...

> [*] A handful security companies will fall due to unprofessional
> business practices, and a handful will find themselves acquired by the
> bigger fish.
> [*] The consumer will become more aware of the problem due to in your
> face spyware/malware that is crippling home computers. Anyone else have
> their grandmother calling them because their Wintel box takes 30 minutes
> to boot and is relatively unusable?

only minimally, consumers tends to be almost as ignorant as voters...


> I hope to see people focusing on solutions more so than problems, but we
> will see about that one.

I'm not sure how to read this, in that unless there is a problem to solve,
there;'s no need for a solution <smile>.

Thanks,

Ron DuFresne
-- 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
"Cutting the space budget really restores my faith in humanity.  It
eliminates dreams, goals, and ideals and lets us get straight to the
business of hate, debauchery, and self-annihilation." -- Johnny Hart
        ***testing, only testing, and damn good at it too!***

OK, so you're a Ph.D.  Just don't touch anything.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html