Captain's Blog

Virtualization In The Cloud Provides Significant Advantages

Virtualization provides the foundation for servers on demand by implementing an on-line operating system that is required for all other operating systems to run on the Cloud. Virtualization also enables the Cloud to rapidly create server space based on end-user demand by simply running a new instance of an operating system on an existing server. Virtualization through the Cloud creates a model by which servers become services and the underlying operation system is no longer a factor in how quickly or easily a new server can be provisioned. Looking at the rapid growth of smart phones you see devices where the applications are not tied to the browser but instead are tied to the underlying operating system.  Netbooks will run a phone operating system or Windows® and virtualization is the key to managing all these mobile devices practically.  This would indicate in the future that there will be more operating systems not less, but they will allow the end-user to do more, increasing efficiency, productivity, and cost effectiveness via a virtual desktop.  All in need of management.

 

 

As organizations look to further GreenIT initiatives, another advantage of virtualization in the cloud is the fact that a virtual server can be running Microsoft®, Linux®, or another operating system on the same physical hardware enabling low utilization servers to be paired with high utilization servers allowing significant savings in energy costs.

 

 

Another benefit to virtualization in the Cloud is the ability to constantly rebalance servers as their usage spikes and drops and to do quick disaster recovery by moving images from one data center to another and quickly restoring the images on new hardware when current hardware fails. 

 

 

The Cloud is designed to support IT customers with a simple, flexible and scalable value proposition.  Virtualization provides additional benefits that allow IT organizations to truly leverage the level of optimization that Cloud computing promises.  

 

here is a related link.

 

Conficker

Slowing or stopping the advance of the Conficker worm is a tremendous patch management and configuration management challenge.  The problem is that organizations have a hard time knowing what patches are really installed and how systems are actually configured.   Small organizations or individuals may be able to retain control, but most organizations are in  a constant state of flux: new  physical computers join the network, configuration settings change, and new software applications are added.  The problem has gotten even worse with the increased emphasis on virtualization.  Tools made by companies like Microsoft and Symantec require Agents – software for managing patches and configuration settings -- be installed on the systems they are trying to protect.  If companies can’t get an agent installed on a machine, they can’t find it, and therefore can’t fix it!  The only realistic approach is to have patch management and configuration management software that can work without the need to install agents and has the ability to assess and fix both physical and virtual machines.   The Conficker.C variant is particularly nasty in that it targets security software in an effort to disable or render it ineffective.  The worm actually blocks the Microsoft patch management agent.   At Shavlik we focus on making technology that is simple and does not require software (agents) on the target computer.  We have always done this, and at a time like this, our product is uniquely qualified to combat the threat of Conficker.C!

 

We can talk about our free assessment for the missing patch and misconfigurations.

 

More details at:

 

http://www.shavlik.com/landingpage/20090326-conficker.aspx

Gartner note on high cost of WSUS

I’m sure you may have already seen this…but just in case. The following excerpt is from a Gartner white paper called; “The Patch Management Market: Collision or Coexistence?” dated March 3, 2008. There was a very interesting nugget in it regarding WSUS…

“Although Microsoft has improved WSUS, client feedback suggests that WSUS is not as rich in content (pre-req/co-req) and as robust in targeting and reporting as the focused patch solutions. Thus, organizations accepting WSUS as "good enough" have significantly higher labor costs for content analysis, testing and deployment. Although Microsoft is making improvements to WSUS, we do not believe it will be a best-of-breed solution for patch management. Through 2012, the most-effective Windows patch management capabilities will be provided by point-solution vendors.”

May "Jet" patch has exploits

According to InformationWeek and others, the latest Microsoft  patch for Jet (MS08-028) has exploits.

since Jet is so widely used this is a key one to scan for and patch (as are all patches of course) depending on your role in security or operations management. 

Large Exploit of MS07-004

It seems there is a widespread attack around s/w missing MS07-004

From WebSense:

"This mass injection is remarkably similar to the attack we saw earlier this month. ...  Once loaded, the file attempts 8 different exploits (the attack last April utilised 12). The exploits target Microsoft applications, specifically browsers not patched against the VML exploit MS07-004 as well as other applications"

From News.com "Javascript injection claims UN and UK government sites"

InfoSec Europe vs. RSA 2008

We just got back from a week in London to attend InfoSec Europe, the biggest computer security show in EMEA.  Much like RSA is in the States InfoSec Europe is the show of the year for security people.

The attendance at InfoSec Europe was strong, our 20x30 booth was full for 3 days straight and the show runs long hours, in short it was busy.  RSA has similar traffic but we all agreed that the crowd in the UK was much more buyer focused than the RSA crowd which was more people walking around the show floor vs. seeking products to use.  Thus I would rate InfoSec Europe as the stronger show  at least from a vendor perspective.

Its not clear what this exactly means other than the people at InfoSec were there to find solutions vs. maybe people at RSA attend to go to security training sessions and are not as much there to find products to use.

I am also finding that industry, not just the security industry, is starting to bring security into the fold much more than in the past. Its becoming part of the IT culture now, which leads to a maturing of products to meet the needs of the corporation vs. all of us ISVs trying to create the new cool thing to attract the attention of the security experts.  It is also becoming very clear that industry wants stand-alone security products instead of having security added to existing management products, security is not just milk & sugar with your tea and people are now realizing that having been burnt by making the assumption that it is.  Just as there is Web 2.0 we are now in Security 2.0 - security as a key and independent part of IT.

One other item that came out very clearly in both shows, and we talked to 1000s of people over them, is WSUS is just not cutting it.  Customers need patching beyond the basics, and the patches missed by WSUS are critical and plentiful. 

These two  shows are back to back now with just a week in between, and they are about 8 time zones apart, making it hard for companies like ours to attend both in full force but we did it and our crew did a great job.  I got the sense other vendors send separate teams as I did not see the sample people at both shows, other than us.  Next year they are moving the shows even closer which seems a bit unfair, but at the end of the day it gives us in the industry at release month to shoot for, to assure we have our latest ready to show, much like we used to do at Comdex a while back.

Cheers

Eric Schultze at RSA 2008 video

Eric talks Patch Smack at RSA video

A bit more on RSA 2008

This article in Baseline Mag notes that the security markets are mature, much like I noted in my previous entry.  They have a different take which is interesting in that they claim the maturity means we have a seat the the CEO table, which is of course something security folk have been pushing for over the years.

On part of the article that does not seem to be occurring is that the big platform companies are taking over security.  Far from it, the big platform security solutions are disasters, security is too hard to get right to make it an under-managed add-on from a large vendor.  The markets are more likely heading to the case where there are two solutions, that cooperate, one does full management and the other does great security.  Things should be shared around reporting and remediation possibly and standards like SCAP are driving that, but right now there are no signs that the security industry is being absorbed by the large system vendors (HP, IBM etc.) In fact, Microsoft continues to create security products vs. just adding security features to their management products (SCCM/MOM/SMS).

RSA show 2008

EMC's RSA security show was last week, I believe its the largest security trade show in the world.  From my perspective the show was massive based on the number of vendor booths, it was not possible to learn what each vendor did - there was just too many booths and many of the booth people were not technical so they just pointed me to their brochures (ouch). 

Vendors ranged from Microsoft and other general s/w vendors who provide security add-ons and solutions, to the traditional security vendors such as Symantec and of course us. I talked to a number of security industry veterans, some of have being in the industry for well over 10 years, I also talked with a number of large companies (ISVs) who are adding security to their current offerings - both groups are driving a very practical level of security innovation into products vs. creating new ideas.

If I had to pick one take away from the show was that all vendors were driving solid, practical, somewhat basic solutions to meet security needs vs. create new ways to do things. In the near term this is good as the industry needs such solutions, but in the longer term a lack of the more crazy innovation will start to hurt the industry.  Any industry needs new ideas to be put into it all the time, with most new ideas failing but key ones catch on and drive change. 

I recently read that Henry Ford did not work with finance people because he felt they were anti-innovation, and maybe what we are seeing occurring is heavily funded companies who at this time are looking for safe returns and large companies who need to take care of large customer bases are taking over the trade show floors, and possibly the industry which could limit innovation.

The included show photo is not a very good photo, but its the best I have.  The show floor was much larger than this picture shows. I also attached a shot of crowd waiting for the Olympic Torch which was supposed to travel very close to the RSA show, with the torch re-route I am not sure it did, I had to get back to work so I could not wait around for it...

Server 2008 patch

Coming on Patch Tuesday:  Fixes for critical vulnerabilities affecting Windows Vista and Windows Server 2008.

The most interesting thing, in fact the surprising thing to me, are the patches for both Vista and Server 2008.  I am not surprised that here are patches, but for Server 2008 its a pretty fast patch post release.