Andrew Hay

November 2, 2011
by The 451 Group - search results
Comments Off

Coalfire begins Navis-gating the underserved ‘GRC lite’ sector

Founded in 2001, Louisville, Colorado-based Coalfire Systems has evolved past its IT audit and compliance consulting roots to introduce a new services-led IT governance, risk management, and compliance (GRC) platform for the PCI Data Security Standard, Gramm-Leach-Bliley Act, HIPAA/HITECH, NERC CIP, Sarbanes-Oxley and FISMA-regulated industries. Called Coalfire Navis, the Web-based portal aims to provide all of the testing, documentation, reporting and technical support that organizations need to effectively maintain their compliance initiatives.

October 28, 2011
by The 451 Group - search results
Comments Off

Secunia challenges the old guard with its take on vulnerability management

Copenhagen, Denmark-based Secunia is one of a handful of Europe, Middle East and Africa (EMEA) security vendors with an international footprint, solid customer base and an active user community – the list becomes even smaller when we begin identifying vulnerability management players in the region. The company's flagship product, the Secunia Corporate Software Inspector (CSI), is an authenticated internal vulnerability scanner that claims to be capable of assessing the security state of practically all programs that run on either Microsoft Windows and Macintosh systems.

October 27, 2011
by Andrew Hay
2 Comments

Is Syslog the Esperanto of the Internet?

flagI don’t have a lot of time to write this up but today on Twitter, I made what I thought was a fairly profound statement comparing the syslog protocol to the ‘international’ language of Esperanto – well, profound for 7am and before I finished my first cup of coffee. If you’re not sure what Esperanto is, Wikipedia has a great write up on the language here. To summarize (borrowing from Wikipedia):

Esperanto was created in the late 1870s and early 1880s by Dr. Ludwig Lazarus Zamenhof, an ophthalmologist of mixed cultural heritage from Bialystok, then part of the Russian Empire. According to Zamenhof, he created this language to foster harmony between people from different countries.

After some ten years of development, which Zamenhof spent translating literature into Esperanto as well as writing original prose and verse, the first book of Esperanto grammar was published in Warsaw in July 1887. The number of speakers grew rapidly over the next few decades, at first primarily in the Russian Empire and Eastern Europe, then in Western Europe, the Americas, China, and Japan. In the early years, speakers of Esperanto kept in contact primarily through correspondence and periodicals, but in 1905 the first world congress of Esperanto speakers was held in Boulogne-sur-Mer, France. Since then world congresses have been held in different countries every year, except during the two World Wars. Since the Second World War, they have been attended by an average of over 2,000 and up to 6,000 people.

Finnish linguist Jouko Lindstedt, an expert on native-born Esperanto speakers, presented the following scheme to show the overall proportions of language capabilities within the Esperanto community:

  • 1,000 have Esperanto as their native language.
  • 10,000 speak it fluently.
  • 100,000 can use it actively.
  • 1,000,000 understand a large amount passively.
  • 10,000,000 have studied it to some extent at some time.

What’s interesting is how certain groups have grabbed hold of the language to bend it to their idea of the ‘perfect universal language’ (sound familiar? CEE, CEF, XDAS, et al, I’m looking at you!):

Though Esperanto itself has changed little since the publication of the Fundamento de Esperanto (Foundation of Esperanto), a number of reform projects have been proposed over the years, starting with Zamenhof’s proposals in 1894 and Ido in 1907. Several later constructed languages, such as Universal, were based on Esperanto.

Instead of trying to work together to make the current language (syslog) work, splinter ‘standards’ and efforts have formed in attempt to save time and effort. I understand that changing a standard is no small task but I don’t feel that enough people have tried to apply the needed pressure on the IETF to enact change (#OccupySyslog anyone?).

Another Wikipedia article gives a great overview of why the language failed as the de facto international language that its creator hoped it would become.

I believe that Esperanto still has a better chance at becoming the de facto international language than the syslog alternatives have of displacing the current standard.

October 26, 2011
by The 451 Group - search results
Comments Off

Trend Micro releases Deep Security 8.0; adds physical, virtual and cloud controls

Trend Micro Deep Security 8.0, a product evolved from the acquisition of Canadian host intrusion-prevention system (HIPS) vendor Third Brigade in April 2009, is the company's latest revision of its server security platform – comprising antimalware, firewall, IDS/IPS, Web application protection, integrity monitoring and log inspection in one integrated solution. Trend Micro has spent quite a bit of time on its endpoint portfolio and has updated the product with a handful of new capabilities aimed at increasing security for physical, virtual and cloud servers in addition to ensuring that Deep Security meets Common Criteria Evaluation Assurance Level 4 (EAL 4+) certification.

October 21, 2011
by The 451 Group - search results
Comments Off

HP combines ArcSight, Fortify and TippingPoint assets into new platform

Hewlett-Packard has announced that it has folded its disparate ArcSight, Fortify and TippingPoint product portfolios into a new business unit called HP Enterprise Security Products; it is combining assets from these entities into what it calls the HP Security Intelligence and Risk Management (SIRM) Platform.

October 21, 2011
by The 451 Group - search results
Comments Off

Security as an availability play

Vendors are forever looking for new ways to peddle their wares. Often, a vendor will hitch the company's product pitch to the latest and most prominent organizational breach exploited by the media, or will craft its messaging toward the latest revision of a particular industry-targeted regulatory standard or best practice. Sometimes, however, the security and compliance concerns held in such high regard by vendors (who happen to have products and services in hand that they feel will solve the world's problems) fall on the deaf ears of the business decision makers.

October 17, 2011
by The 451 Group - search results
Comments Off

Red Lambda harnesses grid computing to tackle the ‘big data’ security problem

Red Lambda, headquartered in Longwood, Florida, bills itself as a massively scalable identity-aware network security software vendor for enterprise, government and service provider organizations. Leveraging the power of its own grid-based architecture, dubbed AppIron, the company states the products developed for its platform combine the power of a virtual supercomputer, relational stream processing and artificial intelligence technologies to address 'big data' security problems.

MetaGrid, the company's first marketable product for the enterprise, is a hybrid anomaly-detection, threat-mitigation and identity-aware ESIM product targeted at service providers, cloud providers, Web properties, governments, utilities and financial services organizations. With more than 30 employees, a recently launched Europe, Middle East and Africa (EMEA) sales footprint and an innovative technology, Red Lambda hopes to show traditional ESIM buyers how to tackle big-data security concerns.