<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: oracle]]></title>
    <link>http://securityratty.com/tag/oracle</link>
    <description></description>
    <pubDate>Mon, 25 Aug 2008 09:18:59 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Oracle OpenWorld]]></title>
      <link>http://securityratty.com/article/4a612b981c405e3c45119d7a5669375d</link>
      <guid>http://securityratty.com/article/4a612b981c405e3c45119d7a5669375d</guid>
      <description><![CDATA[Well, Oracle OpenWorld came and went. As usual, I hardly had any time to attend sessions. The one really cool session I attended ( besides my own ) was by Tanel Poder talking about troubleshooting...]]></description>
      <content:encoded><![CDATA[Well, Oracle OpenWorld came and went. As usual, I hardly had any time to attend sessions. The one really cool session I attended ( besides my own  ) was by Tanel Poder talking about troubleshooting Oracle when the Oracle instrumentation does not work. See his blog for details. I really loved his straight forward [...]<div class="feedflare">
<a href="http://feeds.feedburner.com/~f/slaviks-blog/WxxD?a=GybOL"><img src="http://feeds.feedburner.com/~f/slaviks-blog/WxxD?i=GybOL" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/slaviks-blog/WxxD/~4/407022983" height="1" width="1"/>]]></content:encoded>
      <pubDate>Tue, 30 Sep 2008 03:18:05 +0000</pubDate>
      <category domain="http://securityratty.com/tag/oracle">oracle</category>
      <category domain="http://securityratty.com/tag/oracle openworld">oracle openworld</category>
      <category domain="http://securityratty.com/tag/oracle instrumentation">oracle instrumentation</category>
      <category domain="http://securityratty.com/tag/tanel poder">tanel poder</category>
      <category domain="http://securityratty.com/tag/cool session">cool session</category>
      <category domain="http://securityratty.com/tag/attend sessions">attend sessions</category>
      <category domain="http://securityratty.com/tag/straight forward">straight forward</category>
      <category domain="http://securityratty.com/tag/time">time</category>
      <category domain="http://securityratty.com/tag/blog">blog</category>
      <source url="http://feeds.feedburner.com/~r/slaviks-blog/WxxD/~3/407022983/">Oracle OpenWorld</source>
    </item>
    <item>
      <title><![CDATA[Links List 9.29.08]]></title>
      <link>http://securityratty.com/article/48fee769715c390d500bbc1e0ea43623</link>
      <guid>http://securityratty.com/article/48fee769715c390d500bbc1e0ea43623</guid>
      <description><![CDATA[Trade shows, trade shows and more trade shows. VMworld and Interop dominated the stage a couple of weeks ago and then there was the annual Oracle blowout in SF last week. Has anyone gotten any work...]]></description>
      <content:encoded><![CDATA[<p><img style="border-right: 0px; border-top: 0px; margin: 5px; border-left: 0px; border-bottom: 0px" src="http://blog.sciencelogic.com/wp-content/uploads/2008/09/oracle.jpg" border="0" alt="oracle" width="240" height="164" align="left" /> Trade shows, trade shows and more trade shows. VMworld and Interop dominated the stage a couple of weeks ago and then there was the annual Oracle blowout in SF last week. Has anyone gotten any work done lately?? <em>(</em><a href="http://flickr.com/photos/cdye/sets/72157607458101608/" target="_blank"><em>image from cdye1</em></a><em>)</em></p>
<p>Does <a href="http://sfcitizen.com/blog/2008/09/24/its-oracles-world-were-just-living-in-it/" target="_blank">Oracle run the world</a>? I would have to say no but Raj (Larry Ellison is his idol) and the 40,000 Oracle customers that descended upon SF last week might beg to differ. What do James Carville and Mary Matalin have to do with enterprise software? Pretty much nothing, except for the fact that they delivered the opening keynote for <a href="http://www.oracle.com/openworld/2008/index.html" target="_blank">Oracle OpenWorld</a>. (And that’s the only and last politically-oriented thing you’ll hear from me as we run up to the election). For a surprisingly funny and extensive photo gallery of the eye-popping event, check out <a href="http://flickr.com/photos/cdye/sets/72157607458101608/" target="_blank">cdye1’s photostream</a> on Flickr.</p>
<p>But UB40, Elvis Costello and Seal aside, Oracle OpenWorld did offer training, certifications, and always entertaining speeches by Ellison. Ben Worthen’s favorite – “<a href="http://blogs.wsj.com/biztech/2008/09/25/larry-ellisons-brilliant-anti-cloud-computing-rant/?mod=djemTECH" target="_blank">Larry Ellison’s Brilliant Anti-Cloud Computing Rant</a>” delivered to analysts on Thursday. From Ben’s slightly-edited excerpt:</p>
<p>“The interesting thing about cloud computing is that we’ve redefined cloud computing to include everything that we already do. I can’t think of anything that isn’t cloud computing with all of these announcements. The computer industry is the only industry that is more fashion-driven than women’s fashion. Maybe I’m an idiot, but I have no idea what anyone is talking about. What is it? It’s complete gibberish. It’s insane. When is this idiocy going to stop?</p>
<p>“We’ll make cloud computing announcements. I’m not going to fight this thing. But I don’t understand what we would do differently in the light of cloud computing other than change the wording of some of our ads. That’s my view.”</p>
<p>So did everyone catch that? Cloud computing is complete gibberish and idiocy, but apparently Oracle’s already been doing enough around it to advertise the fact. I will have my cake and eat it too!</p>
<p>We’ve been pumping out the posts from the shows we went to – let me tell you, live-blogging is hard when you’re trying to share apparently miniscule amounts of bandwidth with 14,000 other attendees – and we have even more to share as we step back, contemplate and describe how some of the announcements, info and especially roadmaps fit into our overall picture over here at ScienceLogic.</p>
<p>For example, we released the results of our annual industry IT survey last week. Twice a year – at FOSE (for Government IT) and at Interop NY (for enterprises) – we take advantage of the fact that we have a big beautiful booth at these shows and offer a fabulous ScienceLogic t-shirt in return for a couple of minutes time with attendees living the <a href="http://blog.sciencelogic.com/why-we-l-o-v-e-tradeshows/03/2008" target="_blank">problems we try to solve</a>. Instead of telling people what their problems and priorities are, we like to ask.<br />
<a href="http://blog.sciencelogic.com/interop-ny-survey-top-it-challenges-trends-and-what-it-is-spending-money-on/09/2008?" target="_blank">Interop NY Survey - Trends and Challenges</a><br />
<a href="http://www.sciencelogic.com/pressrelease_20080925.htm" target="_blank">Detailed Reports on Trends and Comparison to Government IT</a></p>
<p>And I just had to share this one because it is so bizarre. Are VMware and Paul Maritz guilty of <a href="http://it20.info/blogs/main/archive/2008/09/21/143.aspx" target="_blank">plagiarism</a>? You have to check this out to get even part of the picture. Apparently this guy has posted his slides (we know they are from VMworld 2007 because it says so in the lower-right-hand corner…) which prove that the “virtual datacenter operating system” idea was his idea a year before it showed up on Maritz’s keynote this year. Hmmm. And then after posting all these slides and making all the connections between his presentation and Maritz’s, he says he’s just kidding about the plagiarism. Can anyone sort this out and let me know?</p>
<p>I’ll tell you who wasn’t kidding when I went by their booth at VMworld – a certain chargeback vendor and VMware “partner” who was quite shocked two months ago when they walked into a meeting with VMware about future roadmap. Apparently, the slides they saw (preview of VMware’s announcement re adding extended chargeback capability within vCenter management services) were mighty might similar to slides they had given in a presentation to VMware about their own roadmap. Coincidence? I’ll let you decide. And I’ll also say, their strategy to combat this – support for Hyper-V coming early in 2009.</p>
]]></content:encoded>
      <pubDate>Mon, 29 Sep 2008 23:00:14 +0000</pubDate>
      <category domain="http://securityratty.com/tag/oracle openworld">oracle openworld</category>
      <category domain="http://securityratty.com/tag/oracle">oracle</category>
      <category domain="http://securityratty.com/tag/cloud">cloud</category>
      <category domain="http://securityratty.com/tag/annual oracle blowout">annual oracle blowout</category>
      <category domain="http://securityratty.com/tag/vmware">vmware</category>
      <category domain="http://securityratty.com/tag/vmware partner">vmware partner</category>
      <category domain="http://securityratty.com/tag/industry">industry</category>
      <category domain="http://securityratty.com/tag/annual industry">annual industry</category>
      <category domain="http://securityratty.com/tag/apparently oracles">apparently oracles</category>
      <source url="http://blog.sciencelogic.com/links-list-92908/09/2008">Links List 9.29.08</source>
    </item>
    <item>
      <title><![CDATA[Interop NY: Cloud Language: The Taxonomy of On-Demand Computing]]></title>
      <link>http://securityratty.com/article/69fa97ea284dec188b278c522ed18fd8</link>
      <guid>http://securityratty.com/article/69fa97ea284dec188b278c522ed18fd8</guid>
      <description><![CDATA[This session on cloud computing was presented by Peter Laird of Oracle Corporation. Peter is a lead architect for the WebCenter product family. He previously worked with BEA as an architect for SaaS...]]></description>
      <content:encoded><![CDATA[<p>This <a href="http://www.interop.com/newyork/conference/all-by-day.php?tag=Cloud+Computing" target="_blank">session on cloud computing</a> was presented by Peter Laird of Oracle Corporation. Peter is a lead architect for the WebCenter product family. He previously worked with BEA as an architect for SaaS efforts. He also blogs at <a href="http://peterlaird.blogspot.com/" target="_blank">Laird On Demand</a>.</p>
<p><strong>Defining Cloud Computing</strong></p>
<p>Cloud computing is a very active community. The <a href="http://groups.google.com/group/cloud-computing" target="_blank">Google Group</a> gets 600 posts per month and many bloggers are covering the space. However, &#8220;cloud computing&#8221; is impossible to define in a way that satisfies everyone (or even most). Cloud computing is not alone in this controversy, consider the definition and meaning of &#8220;Web 2.0&#8243;, &#8220;mashups&#8221; or &#8220;RESTful architecture&#8221;. All of these terms are relatively recent. According to Google Trends, these terms became popular to the general public sometime between 2005 and 2007:</p>
<ul>
<li>Web 2.0 - often confused with RIA, AKA Social Computing, Long-Tail Apps, Crowdware (2005 by O&#8217;Reilly Media)</li>
<li>Mashup - made popular by Google Maps, AKA Composite/Situational Apps. (2005)</li>
<li>REST - Has a strict definition, but many don&#8217;t understand it and abuse the term. (2006 by R. Fielding)</li>
<li>Cloud computing - collides with many other terms, such as SaaS, Grid, Utility, PaaS, etc. (2007)</li>
</ul>
<p>The definition of cloud computing is in progress:</p>
<blockquote><p>There&#8217;s a Darwinian evolution of the exact definition of cloud computing running around. We&#8217;re about a country mile away from &#8220;knowing when I see it&#8221;, which is excellent progress. The cloud to everyone&#8217;s silver-lining has enough material to write a 3 volume desktop reference at this point. - Michael Cote, June 2008</p></blockquote>
<p><strong>Definition #1</strong> - &#8220;Cloud computing is the realisation of Internet (&#8221;Cloud&#8221;) based development and use of computer technology (&#8221;Computing&#8221;) delivered by an ecosystem of providers. - Sam Johnston, July 2008</p>
<p><strong>Definition #2</strong> - &#8220;Cloud computing = network computing. I love the idea of cloud computing, the next evolution of the most network intensive architecture possible, but one that if it works well, is transparent. It&#8217;s all about the transparency.&#8221; - Douglas Gourlay, Cisco, May 2008</p>
<p><strong>Definition #3</strong> - &#8220;There seems to be a group myopia around so-called &#8220;cloud computing&#8221; and its definitions. What we&#8217;re really talking about are &#8220;cloud services&#8221; of which, &#8220;computing&#8221; is only a subset&#8230;Cloud services are not SaaS. They are far more akin to web services&#8230;&#8221; - Randy Bias, neoTactics, May 2008</p>
<p><strong>(Anti-)Definition #4</strong> - &#8220;Note that I refer to cloud services, not to the could. I am not interested in defining cloud as a term, because I don&#8217;t think it&#8217;s very useful. For those of us in the distributed computing&#8217;s pace</p>
<p><strong>The Working Definition (Winner!):</strong></p>
<p>&#8220;&#8230;the notion of providing easily accessible compute and storage resources on a pay-as-you-go, on-demand basis, from a virtually infinite infrastructure managed by someone else. As a customer, you don&#8217;t know where the resources are, and for the most part, you don&#8217;t care. What&#8217;s really important is the capability to access your application anywhere, move it freely and easily, and inexpensively add resources for instant scalability.&#8221; - Mitchell Crandell, Rightscale, June 2008</p>
<p><strong>Taxonomies of the Cloud Space</strong></p>
<p>Taxonomies are useful to provide insight into a market. It classifies a multitude of players into a smaller bucket.</p>
<p><em>Andreessen&#8217;s Platforms - September 2007</em></p>
<p>Provided an early taxonomy model for emerging cloud platforms</p>
<p>Platform being a system that can be programmed</p>
<ul>
<li>Access API - platform that provides web service endpoints</li>
<li>Plug-In API - platform invokes your code, that you have deployed remotely</li>
<li>Runtime Environment - your code runs inside the platform&#8217;s process space.</li>
</ul>
<p><em>Mehta 11 Layer Stack, April 2008</em></p>
<ol>
<li>Facilities (space, power, cooling)</li>
<li>Network</li>
<li>Hardware (e.g. servers Amazon EC2 runs)</li>
<li>Hardware virtualization (e.g. Xen for EC2) - optional</li>
<li>O/S (e.g. Linux)</li>
<li>Systems Management (e.g., tools to manage EC2 instances)</li>
<li>Application Middleware (e.g., MySQL on EC2)</li>
<li>Application Code</li>
<li>Application APIs / Web Services</li>
<li>GUI for Application</li>
<li>GUI for Application Development / Customization</li>
</ol>
<p><em>Croll Cloud Stack, June 2008</em></p>
<p>7 layer stack within Turnkey app and Generic Platform.</p>
<p><em>Turnkey app</em></p>
<ul>
<li>SaaS</li>
<li>Extensible app</li>
<li>Generic IDE</li>
<li>Constrained APIs</li>
<li>App Cluster</li>
<li>Virtual Data Center</li>
<li>Virtual Servers</li>
</ul>
<p><em>Generic Platform</em></p>
<p>The bottom of Alistair&#8217;s stack includes &#8220;root access &#8220;style compute clouds.</p>
<p><em>Robert Anderson, July 2008</em></p>
<p>3 layer stack</p>
<ul>
<li>Software (SaaS)</li>
<li>Platform (PaaS)</li>
<li>Infrastructure (IaaS)</li>
</ul>
<p>This is the model taxonomy for this session.</p>
<p><strong>Related Concepts and Terms</strong></p>
<ul>
<li>Infrastructure as a Service (IaaS), Hardware as a Service (HaaS) are synonyms to cloud infrastructure.</li>
<li>Virtualization</li>
<li>Hosting</li>
<li>Autonomic computing</li>
<li>Distributed computing</li>
<li>Grid computing</li>
</ul>
<p>Cloud Applications</p>
<ul>
<li>SaaS</li>
<li>S+S (Software+Services)</li>
<li>Managed Service Provider (MSP)</li>
</ul>
]]></content:encoded>
      <pubDate>Wed, 17 Sep 2008 14:25:32 +0000</pubDate>
      <category domain="http://securityratty.com/tag/cloud">cloud</category>
      <category domain="http://securityratty.com/tag/cloud applications">cloud applications</category>
      <category domain="http://securityratty.com/tag/croll cloud stack">croll cloud stack</category>
      <category domain="http://securityratty.com/tag/cloud infrastructure">cloud infrastructure</category>
      <category domain="http://securityratty.com/tag/platforms process space">platforms process space</category>
      <category domain="http://securityratty.com/tag/space">space</category>
      <category domain="http://securityratty.com/tag/cloud space">cloud space</category>
      <category domain="http://securityratty.com/tag/cloud platforms">cloud platforms</category>
      <category domain="http://securityratty.com/tag/cloud services">cloud services</category>
      <source url="http://blog.sciencelogic.com/interop-ny-cloud-language-the-taxonomy-of-on-demand-computing/09/2008">Interop NY: Cloud Language: The Taxonomy of On-Demand Computing</source>
    </item>
    <item>
      <title><![CDATA[Links for 2008-09-10 [del.icio.us]]]></title>
      <link>http://securityratty.com/article/2d1af0f676495f958d061ee0c5c8bf43</link>
      <guid>http://securityratty.com/article/2d1af0f676495f958d061ee0c5c8bf43</guid>
      <description><![CDATA[Paul Melson's Blog: ArcSight User Conference 2008 * Logger 3.0 has adopted a more-ESM-like boolean filter interface. Big improvement over the chained-regex search in 2.5 and earlier. * Demo of Logger...]]></description>
      <content:encoded><![CDATA[<ul>
<li><a href="http://pmelson.blogspot.com/2008/09/arcsight-user-conference-2008.html">Paul Melson's Blog: ArcSight User Conference 2008</a><br/>
* Logger 3.0 has adopted a more-ESM-like boolean filter interface. Big improvement over the chained-regex search in 2.5 and earlier.
    * Demo of Logger 3.0 shows that searches of data (no details on data set) are roughly 80x faster than a similar sized search on 2.5. (The claim is 100x faster, but I counted. Still, that&#039;s a significant improvement.)
    * Hugh has hinted that the slick, high-performance append-only storage stuff that Logger has is going to be integrated into ESM is some release beyond 4.5. That could mean the end of the Oracle / PartitionArchiver storage model.</li>
<li><a href="http://vmblog.com/archive/2008/09/09/splunk-tames-the-chaos-brought-on-by-virtualization.aspx">Splunk Tames the Chaos Brought on by Virtualization : VMblog.com - Virtualization Technology News and Information for Everyone</a><br/>
Existing system management tools were not designed to handle the dynamic nature of virtualization.  The Splunk for VMWare Management application includes a VMWare API for data input, over 25 pre-defined searches, alerts, and reports and dashboards specifically designed to monitor key metrics for the VMWare Virtual Infrastructure.</li>
<li><a href="http://eventlogs.blogspot.com/2008/08/why-your-hr-department-will-love.html">Dorian Software BLOG: Why Your HR Department Will Love Windows Vista, Even If Your IT Department Doesn't.</a><br/>
Event ID 4802 tracks whenever the screensaver is invoked after a group policy-determined idle time.

Event ID 4803 tracks whenever the screensaver is dismissed by the logged-on user.</li>
<li><a href="http://www.tditx.com/log-management.asp#hypervisor">Moderately Idiotic Competitor</a><br/>
But the clever inside criminal is taking all the payroll data from the system that is either off the network or is temporarily down. When the machine comes back up, there is no record of the intrusion and the traditional &quot;inside out&quot; log management system tells the user there is no problem.</li>
<li><a href="http://lastinfirstout.blogspot.com/2008/07/presumed-hostile-your-application-is.html">Last In - First Out: Presumed Hostile - Your Application is Out to Get You</a></li>
<li><a href="http://help.eclipse.org/help33/index.jsp?topic=/org.eclipse.tptp.monitoring.doc.user/samples/slog_analyzer.html">Help - Eclipse SDK - Working with the Log4J Logging sample</a></li>
<li><a href="http://www.datagovernance.com/cartoon_2.html">Cartoon 2 from The Data Governance Institute ROI</a></li>
<li><a href="http://gordonewasiuk.com/?p=967">Eccentric Engineer &raquo; Blog Archive &raquo; Conf Call Hem and Haw</a><br/>
It’s just a damned centralized-logging platform.  Unix sysadmins have been doing those for years.  This stuff is about as basic as tying your shoes.  All this fluff seems like overkill…but it’s IT…and we have policies.</li>
<li><a href="http://blog.isc2.org/isc2_blog/2008/08/security-metric.html">(ISC)2 Blog: Security metrics: more is not better</a></li>
<li><a href="http://www.roer.com/node/394">Are you Owned? | Roer.Com Information Security Blog</a><br/>
# list of all your profiles online, with your log in.
# list of all your IM/e-mail and other communication tools, with log in
# list of other sites/tools that requires you to log on.
# The lists above should also include each sites URL or contact information for changing passwords, or in worst case shutting them down.
# a friends-list who you trust, and who are willing to help you get back your own life online. The purpose is to have them help you rebuild your internet presence. Make sure you agree some way for them to be certain that they are communicating with you, and not someone else.</li>
<li><a href="http://www.csoonline.com/article/412163/Industry_View_Web_Application_Security_Today_Are_We_All_Insane_">Industry View: Web Application Security Today - Are We All Insane? - CSO Online - Security and Risk</a><br/>
The problem has gotten so bad that industry sources say most websites hosting malware have been hacked, Google says 1.3 percent of their search queries return malicious content, and Vint Cerf (father of the Internet) approximates that one quarter of all PCs are part of a botnet. Firewalls are not working. Antivirus/spyware is not working, nor are weekly patching, user education, SSL, or &quot;turning off the home computer&quot; as recommended by the FBI cyber-crime website. In what has become an inside joke, every authority says to use these &quot;best-practices&quot; despite their ineffectiveness.</li>
<li><a href="http://taosecurity.blogspot.com/2008/09/schneier-agrees-security-roi-is-mostly.html">TaoSecurity: Schneier Agrees: Security ROI is &quot;Mostly Bunk&quot;</a></li>
</ul><img src="http://feeds.feedburner.com/~r/AntonChuvakinPersonalBlog/~4/389332419" height="1" width="1"/>]]></content:encoded>
      <pubDate>Wed, 10 Sep 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/information security blog">information security blog</category>
      <category domain="http://securityratty.com/tag/blog">blog</category>
      <category domain="http://securityratty.com/tag/application">application</category>
      <category domain="http://securityratty.com/tag/web application security">web application security</category>
      <category domain="http://securityratty.com/tag/security">security</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/user">user</category>
      <category domain="http://securityratty.com/tag/arcsight user conference">arcsight user conference</category>
      <category domain="http://securityratty.com/tag/security roi">security roi</category>
      <source url="http://feeds.feedburner.com/~r/AntonChuvakinPersonalBlog/~3/389332419/anton18">Links for 2008-09-10 [del.icio.us]</source>
    </item>
    <item>
      <title><![CDATA[It Was Sposed to Be So Eaaasy]]></title>
      <link>http://securityratty.com/article/5714e6ea5723d4a1d18b692711ca3452</link>
      <guid>http://securityratty.com/article/5714e6ea5723d4a1d18b692711ca3452</guid>
      <description><![CDATA[Earlier this year, I gave a talk with on Breaking Web Services with Brian Chess at RSA. We pointed out that adding security into Web services is an exercise left to the implementer, the standards...]]></description>
      <content:encoded><![CDATA[<p>Earlier this year, I gave a <a href="http://1raindrop.typepad.com/1_raindrop/2008/04/rsa-debrief-p-1.html">talk</a> with on Breaking Web Services with Brian Chess at RSA. We pointed out that adding security into Web services is an exercise left to the implementer, the standards bodies and vendors give you some primitives, but it is still up to you to figure out all of the items on the <a href="http://arctecgroup.net/pdf/WebServicesSecurityChecklist.pdf">Web services security checklist</a>&#160;should work together in a cohesive system. Needless to say, there are many ways to shoot yourself in the foot.</p><br /><div>So during our talk, someone from Oracle stands up and says, &quot;hey, you guys are making this stuff sound hard. Its not hard we support WS-Security...&quot; etc. Again, the whole point of our presentation was *not* that there are not very interesting general purpose security capabilities in Web services, our point was that you need to figure out the architecture yourself, and then bend the tools to your will. Oh, and deliver on time.</div><br /><div>So imagine my surprise, when I read this article <a href="http://www.ddj.com/database/209400693">&quot;Digitally Signing and Verifying Messages in Web Services&quot;&#160;</a>which talks about using Oracle&#39;s WSM tools to sign Web service messages and verify signatures in Web service messages, but only addresses integrity - absolutely nowt on authenticity! Integrity is important, but there are lots of times when it is not enough. Many times your service needs to be concerned with replay attacks, authentication policies and so on. To deal with those things, we would typically add policies and capabilities for timestamps, nonces and other primitives into the signature block, but the article is silent on those things. (Rad Mark O&#39;Neill&#39;s <a href="http://xmlnetworking.blogspot.com/2008/08/digitally-signing-and-verifying.html">post</a> on this as well)</div><br /><div>Its not about _can_ the standards do something or other, I mean given the right resources the standards can put a monkey on the moon, its about what use cases have they engineered in and what is supported in the tools today. I firmly believe SAML has such great adoption across the industry because they have a use case centric view and so gave the vendors something to engineer and optimize for. I think we&#39;ll still get there in WS-Security and other areas as well, but the use cases are not built into the spec (as with SAML) and so its taking longer.</div><br /><div>One of our points in the talk was - we want you vendors to do your job better and instead of shipping a box Legos, ship a Lego gas station, a Lego airport, and so on. Connect some dots for your customers.&#160;</div><br /><div>What I see in <a href="http://arctecgroup.net/training.htm">training</a> on this topic, is sort of the following - 1) Do I need Web service security? 2) Oh ok, well can I get by with SSL? 3) Oh wait that doesn&#39;t actually protect my assets, can I just use WS-Security? 4) Oh wait, WS-Security isn&#39;t just a checkbox for security, I need to figure out timestamps, nonces, signatures, encryption policies and so on.&#160;And finally 5) How do I accomplish this?</div><br /><div>Once we get to step 5 then the real work can begin. Its not easy to get a lot of developers through all of this, and again this is before the real work begins. Even once the lead developers and architects figure this out, there is still the little matter of transitioning it to the rest of the team.</div><br /><div>I remember I was working with an enterprise architect several years ago, and he bought a Web service XML gateway like <a href="http://www.vordel.com/">Vordel</a> to add WS-Security support into his Web services apps, but he didn&#39;t even buy it as a runtime tool, he bought it as Security API, the runtime enforcement in his opinion was a bonus! He said in effect, well I know I need to do this, but I can&#39;t expose all these security primitives directly to my developers.</div><br /><div>So yeah, I wish it was easier, but in my experience its not right now. Its not about raw capabilities its about use case realization. I think learning from what has worked well is the way to go. SAML&#39;s use case centric approach is one that has.</div><br />]]></content:encoded>
      <pubDate>Wed, 10 Sep 2008 03:12:42 +0000</pubDate>
      <category domain="http://securityratty.com/tag/ws-security">ws-security</category>
      <category domain="http://securityratty.com/tag/support ws-security">support ws-security</category>
      <category domain="http://securityratty.com/tag/web service security">web service security</category>
      <category domain="http://securityratty.com/tag/service">service</category>
      <category domain="http://securityratty.com/tag/security">security</category>
      <category domain="http://securityratty.com/tag/primitives">primitives</category>
      <category domain="http://securityratty.com/tag/security primitives directly">security primitives directly</category>
      <category domain="http://securityratty.com/tag/ws-security support">ws-security support</category>
      <category domain="http://securityratty.com/tag/security api">security api</category>
      <source url="http://1raindrop.typepad.com/1_raindrop/2008/09/it-was-sposed-to-be-so-eaaasy.html">It Was Sposed to Be So Eaaasy</source>
    </item>
    <item>
      <title><![CDATA[Towards a Streaming SQL Standard]]></title>
      <link>http://securityratty.com/article/11661732df3a8a5a25e83671bf0c6979</link>
      <guid>http://securityratty.com/article/11661732df3a8a5a25e83671bf0c6979</guid>
      <description><![CDATA[In More Towards a Streaming SQL Standard , Marc Adler says, Despite what I think about Streambases marketing and sales organization, you must admit that Zdonik and Cherniack are first-class...]]></description>
      <content:encoded><![CDATA[<p>In <a href="http://www.cs.brown.edu/~ugur/streamsql.pdf" target="_blank">More Towards a Streaming SQL Standard</a>, Marc Adler says,<em> &#8220;Despite what I think about <span id="SPELLING_ERROR_3" class="blsp-spelling-error">Streambase&#8217;s</span> marketing and sales organization, you must admit that <span id="SPELLING_ERROR_4" class="blsp-spelling-error">Zdonik</span> and <span id="SPELLING_ERROR_5" class="blsp-spelling-error">Cherniack</span> are first-class researchers, and have contributed a lot to the field of <span id="SPELLING_ERROR_6" class="blsp-spelling-error">CEP.&#8221;</span></em></p>
<p>I agree that these gentlemen are top notch researchers, witnessed by the fact that the authors do not mention nor claim to be &#8220;complex event processing&#8221; anywhere in their paper!  This paper is not about CEP, nor does it claim to be about CEP, it is about stream processing and unifying SQL standards.</p>
<blockquote><p><em>ABSTRACT: This paper describes a unification of two different SQL extensions for streams and its associated semantics. We use the data models from Oracle and StreamBase as our examples. Oracle uses a time-based execution model while StreamBase uses a tuple-based execution model. Time-based execution provides a way to model simultaneity while tuple-based execution provides a way to react to primitive events as soon as they are seen by the system.</em></p></blockquote>
<p>Asmentioned on numerous occasions, stream processing is a very important area in CEP/EP.   It is important not to confuse the higher situational knowledge from object-object correlation and state management with the single-object event refinement that occurs in stream processsing.    Event stream processing is fundamentally different than complex event processing. </p>
<p>Event stream processing performs operations on streaming event objects.   In almost all advanced CEP/EP applications is is necessary to perform robust track and trace operations on streaming event objects, like tracking the position of an airplane.    Tracking the position of an aircraft can be modelled very nicely with event stream processing.  Tracking individual event objects is a precuror to multiclass object situation refinement.</p>
<p>When we manage the state of all the aircraft in the skies over New York, you need more than a stream processing construct.  You need to manage the state of all the aircraft.  Paul Vincent of TIBCO Software being to address this important point in <a title="Permalink" href="http://tibcoblogs.com/cep/2008/09/02/the-value-of-state/"><span style="color: #055486;">The Value of State…</span></a>  </p>
<p>Again, we will be better equiped to solve complex distributed event processing problems if we do not confuse the notion of event stream processing and complex event processing.   These technologies are indeed complimentary, both very important, but they are not the same.</p>
<p>I applaud Oracle and StreamBase&#8217;s work toward a unified standard for <em>SQL extensions for streams.</em></p>
]]></content:encoded>
      <pubDate>Fri, 05 Sep 2008 13:39:08 +0000</pubDate>
      <category domain="http://securityratty.com/tag/individual event objects">individual event objects</category>
      <category domain="http://securityratty.com/tag/event objects">event objects</category>
      <category domain="http://securityratty.com/tag/event">event</category>
      <category domain="http://securityratty.com/tag/single-object event refinement">single-object event refinement</category>
      <category domain="http://securityratty.com/tag/complex event">complex event</category>
      <category domain="http://securityratty.com/tag/event stream">event stream</category>
      <category domain="http://securityratty.com/tag/stream">stream</category>
      <category domain="http://securityratty.com/tag/standard">standard</category>
      <category domain="http://securityratty.com/tag/sql standard">sql standard</category>
      <source url="http://www.thecepblog.com/2008/09/05/towards-a-streaming-sql-standard/">Towards a Streaming SQL Standard</source>
    </item>
    <item>
      <title><![CDATA[Streaming SQL Approaches Insist in Ignoring Causality by PatternStorm]]></title>
      <link>http://securityratty.com/article/46fcc325a183e0e5f0b350bcc9aeb6b5</link>
      <guid>http://securityratty.com/article/46fcc325a183e0e5f0b350bcc9aeb6b5</guid>
      <description><![CDATA[The following excellent discussion is reposted from Streaming SQL approaches insist in ignoring causality by PatternStorm
The recent paper Towards a Streaming SQL Standard by Oracle and Streambase...]]></description>
      <content:encoded><![CDATA[<blockquote><p>The following excellent discussion is reposted from <a href="http://www.thecepblog.com/wp-admin/#p452">Streaming SQL approaches insist in ignoring causality</a> by PatternStorm.</p></blockquote>
<p>The recent paper &#8220;<a href="http://www.cs.brown.edu/%7Eugur/streamsql.pdf" target="_blank">Towards a Streaming SQL Standard</a>&#8221; by Oracle and Streambase unifies and generalizes two different execution models of Streaming SQL: Oracle&#8217;s and StreamBase&#8217;s.</p>
<p>While it&#8217;s true that the generalization succeeds in overcoming the unability of both execution models of producing correct results for astonishing simple queries (showing evidence of the actual limitations of these two Streaming SQL languages) it is also true that the generalization is closer to being overly complex than natural and intuitive.</p>
<p>The root cause behind the actual limitations of these two Streaming SQL languages is that their execution models &#8220;hardcode&#8221; the way events can be related to each other: in the Oracle case events are partially ordered by timestamp, in the StreamBase case events are totally ordered by time of arrival. These design decisions (natural in a stream oriented lamguage) have strong implications on what queries can be answered correctly, particularly when these queries involve joins of derived streams.</p>
<p>The generalization, of course, mainly consists in providing a new operator that allows the user to establish custom ordering relationships among the events (the SPREAD operator), which is good news but takes us to the fundamental issue: event processing cannot be reduced to stream processing, that is, to the processing of events that are totally or partially ordered by a pre-defined relationship (as Oracle and StreamBase actual implementations do), on the contrary, no particular ordering can be assumed because the user needs to be able to order the events in different ways in order to solve different problems. This is what event processing is about and the paper provides evidence that Streaming SQL approaches have found the need to move towards that direction and are having trouble in their way.</p>
<p>For instance, one of the queries used in the paper as an example of a query that StreamBase cannot solve (but Oracle can) is the following: correlate the stream that contains the total number of cars on the road for each time interval with the stream that contains the total average speed of the cars on the road for each time interval in order to detect the situation where the avergae speed is below 45 and the total number of cars is two or more. This query can be very easily and more robustly solved if you order the events by causality rather than by time, that is, if you have each position report update the average speed stream and the total number of cars stream and then you causally relate each position report to the new average speed event and the new total number of cars event that it generates; then the query is just a matter of detecting all report speeds that are causally related both to an average speed event below 45 and a total number of cars event of two or more (notice that this approach is more robust than Oracle&#8217;s time-based one because it works without requiring derived streams to be synchronized with the report speed stream)</p>
<p>Conclusions:</p>
<ul>
<li>Event Processing is a generalization of Stream Processing (as the paper shows)</li>
<li>Event Processing requires providing the ability to the user of creating custom relationships among events and then define patterns/queries using those custom relationships.</li>
<li>Causality is more often than not a more robust and easier criteria to order events than time or order of arrival.</li>
<li>Event Processing Languages should support causality.</li>
</ul>
<p>Regards,<br />
PatternStorm</p>
]]></content:encoded>
      <pubDate>Fri, 05 Sep 2008 10:25:35 +0000</pubDate>
      <category domain="http://securityratty.com/tag/sql">sql</category>
      <category domain="http://securityratty.com/tag/sql approaches insist">sql approaches insist</category>
      <category domain="http://securityratty.com/tag/cars stream">cars stream</category>
      <category domain="http://securityratty.com/tag/stream">stream</category>
      <category domain="http://securityratty.com/tag/average speed event">average speed event</category>
      <category domain="http://securityratty.com/tag/event">event</category>
      <category domain="http://securityratty.com/tag/sql languages">sql languages</category>
      <category domain="http://securityratty.com/tag/languages">languages</category>
      <category domain="http://securityratty.com/tag/cars event">cars event</category>
      <source url="http://www.thecepblog.com/2008/09/05/streaming-sql-approaches-insist-in-ignoring-causality-by-patternstorm/">Streaming SQL Approaches Insist in Ignoring Causality by PatternStorm</source>
    </item>
    <item>
      <title><![CDATA[XSS fortune cookie]]></title>
      <link>http://securityratty.com/article/ebb795063c6db43201a38a043c2c54db</link>
      <guid>http://securityratty.com/article/ebb795063c6db43201a38a043c2c54db</guid>
      <description><![CDATA[Forgive me in advance for an extremely bad joke, if you can even call it that, but I just can't help it
Here's how to get an XSS fortune cookie

1) Ask the mighty Google oracle who might be able to...]]></description>
      <content:encoded><![CDATA[Forgive me in advance for an extremely bad joke, if you can even call it that, but I just can't help it.<br />Here's how to get an XSS fortune cookie:<br /><br />1) Ask the mighty Google oracle who might be able to tell you your fortune. <br /><a href="http://www.google.com/search?hl=en&q=tell+my+fortune&btnG=Search&lr=lang_en" target="_blank">http://www.google.com/search?hl=en&q=tell+my+fortune&btnG=Search&lr=lang_en</a><br /><br />2) Select one of the sponsored links; in this case I chose <a href="http://www.spiritualexperts.com/" target="_blank">SpritualExperts.com</a>. <br /><br />3) Pick a variable. I settled for <span style="font-style:italic;">banid</span>.<br /><br />4) Ask it if it has a cookie for you.<br /><a href="http://www.spiritualexperts.com/psychic_reading/psychic_reading.asp?banid=%22%3E%3CSCRIPT%3Ealert%28document%2Ecookie%29%3C%2FSCRIPT%3E" target="_blank">http://www.spiritualexperts.com/psychic_reading/psychic_reading.asp?banid=%22%3E%3CSCRIPT%3Ealert%28document%2Ecookie%29%3C%2FSCRIPT%3E</a><br /><br />Voila...an XSS fortune cookie. Sorry. Really, I am.<br /><br />The webmaster has been advised...play nice.<br /><br />Screenshot for after they fix the issue.<br /><br /><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://1.bp.blogspot.com/_kVOWaY1TAF0/SL3NFWH4GQI/AAAAAAAAACk/j6nJeVjRbSk/s1600-h/FortuneCookie.png"><img style="cursor:pointer; cursor:hand;" src="http://1.bp.blogspot.com/_kVOWaY1TAF0/SL3NFWH4GQI/AAAAAAAAACk/j6nJeVjRbSk/s320/FortuneCookie.png" border="0" alt=""id="BLOGGER_PHOTO_ID_5241571033050781954" /></a><br /><br /><a href="http://del.icio.us/post?url=http://holisticinfosec.blogspot.com/2008/09/xss-fortune-cookie.html&title=XSS fortune cookie " title="XSS%20fortune%20cookie ">del.icio.us</a> | <a href="http://digg.com/submit?phase=2&amp;url=http://holisticinfosec.blogspot.com/2008/09/xss-fortune-cookie.html" title="XSS fortune cookie ">digg</a>]]></content:encoded>
      <pubDate>Tue, 02 Sep 2008 12:10:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/xss fortune cookie">xss fortune cookie</category>
      <category domain="http://securityratty.com/tag/cookie">cookie</category>
      <category domain="http://securityratty.com/tag/fortune">fortune</category>
      <category domain="http://securityratty.com/tag/google">google</category>
      <category domain="http://securityratty.com/tag/mighty google oracle">mighty google oracle</category>
      <category domain="http://securityratty.com/tag/extremely bad joke">extremely bad joke</category>
      <category domain="http://securityratty.com/tag/compsychic readingpsychic">compsychic readingpsychic</category>
      <category domain="http://securityratty.com/tag/chose spritualexperts">chose spritualexperts</category>
      <category domain="http://securityratty.com/tag/play nice">play nice</category>
      <source url="http://holisticinfosec.blogspot.com/2008/09/xss-fortune-cookie.html">XSS fortune cookie</source>
    </item>
    <item>
      <title><![CDATA[Golf Driven Security]]></title>
      <link>http://securityratty.com/article/97c3f2f6b2c052ca89495ba3c65d43d2</link>
      <guid>http://securityratty.com/article/97c3f2f6b2c052ca89495ba3c65d43d2</guid>
      <description><![CDATA[I don't have anything against the sport, in fact I think that if the software security people want to get in the enterprise security game they have to get a lot better at golf. I blogged about how the...]]></description>
      <content:encoded><![CDATA[<p><span style="font-size: 13px; font-family: Helvetica; ">I don&#39;t have anything against the sport, in fact I think that if the software security people want to get in the enterprise security game they have to get a lot better at golf. I </span><a href="http://1raindrop.typepad.com/1_raindrop/2008/08/software-security-market.html"><span style="font-size: 13px; font-family: Helvetica; ">blogged</span></a><span style="font-size: 13px; font-family: Helvetica; "> about how the network security sector is about fifteen times larger than software security sector, prompting one person to write saying that we have invested wisely in network security, eliminated the problems and will address the software security problem with internal processes and tools.</span></p><p><span style="font-size: 13px; font-family: Helvetica; "><br /></span></p><div><p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px Helvetica"><span style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 12px/normal Helvetica; font-size: 13px; "><span style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 12px/normal Helvetica; font-size: 13px; font-family: Helvetica; ">The problem is that compared to software security we are clearly overspending on network security, the hardware/software is unchanged for a decade - </span><span style="font-weight: bold; font-size: 13px; font-family: Helvetica; ">in any other area of computing the cost would be falling like a rock (</span><span style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 12px/normal Helvetica; font-size: 13px; font-family: Helvetica; ">how much would 1995 version of Oracle or Windows cost now? 5 cents on the dollar, yet CISOs still cut $900M worth of checks to Checkpoint each year). The problem is&#160;there is no market effect because the CISO&#39;s budget keeps increasing and they have no idea what/where/how to spend so they just play golf with their Checkpoint rep and send in the renewal.&#160;</span></span></p><p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px Helvetica"><span style="font-size: 13px; font-family: Helvetica; "><br /></span></p><p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px Helvetica"><span style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 12px/normal Helvetica; font-size: 13px; font-family: Helvetica; ">Internal processes and tools are necessary yet nowhere near sufficient to &quot;solve&quot; software security. One reason we &quot;have gotten rid of&quot; network attacks is that no one cares. its a 1990s 31337 attacker goal, not a mafia enterprise goal (botnets aside). business, be they legit or criminal, wants data and functionality. so its all about apps and data. we are just at the very begining crawl stage of even understanding how to solve these problems. That&#39;s why when i hear security consultants harsh on something like static analysis I just laugh. are they better than a top 1% resource in the world? no way. do we have a multi billion dollar gap to close? ya sure, ya betcha. We need things that scale.</span></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px Helvetica; min-height: 14.0px"><span style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 12px/normal Helvetica; min-height: 14px; font-size: 13px; font-family: Helvetica; "><br /></span></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px Helvetica"><span style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 12px/normal Helvetica; font-size: 13px; font-family: Helvetica; ">People dont write their own virus protection, but for some reason attempt to do their own input validation, it is the same exact problem. people routinely write their own authentication, authorization and audit. i could go on.</span></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px Helvetica; min-height: 14.0px"><span style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 12px/normal Helvetica; min-height: 14px; font-size: 13px; font-family: Helvetica; "><br /></span></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px Helvetica"><span style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 12px/normal Helvetica; font-size: 13px; font-family: Helvetica; ">I have rarely seen an industry so ripe for disruptive innovation as software security.&#160;</span></p><div><span style="font-family: Helvetica; font-size: 12px; line-height: normal;"><br /></span></div></div>]]></content:encoded>
      <pubDate>Tue, 26 Aug 2008 13:00:50 +0000</pubDate>
      <category domain="http://securityratty.com/tag/software security">software security</category>
      <category domain="http://securityratty.com/tag/software security sector">software security sector</category>
      <category domain="http://securityratty.com/tag/software security people">software security people</category>
      <category domain="http://securityratty.com/tag/network security sector">network security sector</category>
      <category domain="http://securityratty.com/tag/network security">network security</category>
      <category domain="http://securityratty.com/tag/people">people</category>
      <category domain="http://securityratty.com/tag/golf">golf</category>
      <category domain="http://securityratty.com/tag/internal processes">internal processes</category>
      <category domain="http://securityratty.com/tag/reason attempt">reason attempt</category>
      <source url="http://1raindrop.typepad.com/1_raindrop/2008/08/golf-driven-security.html">Golf Driven Security</source>
    </item>
    <item>
      <title><![CDATA[Software Security Market]]></title>
      <link>http://securityratty.com/article/0adbf216425dc6d24bde35c8640002aa</link>
      <guid>http://securityratty.com/article/0adbf216425dc6d24bde35c8640002aa</guid>
      <description><![CDATA[Information Security budgets are pretty crufty , they are an accumulation of decisions but the analysis that led to these decisions is rarely revisited, it just snowballs. So the normal Information...]]></description>
      <content:encoded><![CDATA[<p>Information Security budgets are pretty <a href="http://en.wikipedia.org/wiki/Cruft">crufty</a>, they are an accumulation of decisions but the analysis that led to these decisions is rarely revisited, it just snowballs. So the normal Information Security budget is just a legacy artifact of when the network was the greatest vulnerability. <a href="http://www.cigital.com/~gem/">Gary McGraw&#160;</a><a href="http://www.informit.com/articles/article.aspx?p=1237978">took a pass</a> at reviewing the numbers in software security, breaking down software security sectors like tools and services (note to Gary - I think <a href="http://www.aspectsecurity.com/">Aspect</a> does more than just training!). This is great work by Gary to get these numbers to see the real changes occuring in software security. Here were his findings on software security tools:</p><div><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="font-family: &#39;Lucida Grande&#39;; line-height: 19px; ">One of the most important developments in the software security market can be seen in the tools space which, combined, almost doubled to $150-180 million. Top of list are two major acquisitions that closed in 2007: Watchfire&#39;s purchase by IBM (somewhere in the range of $120-150 million on 2006 revenue of $26 million) and SPI Dynamics&#39;s purchase by HP (for around $100 million on 2006 revenue of $21.2 million).</span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="font-family: &#39;Lucida Grande&#39;; line-height: 19px;">...</span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="font-family: &#39;Lucida Grande&#39;; line-height: 19px; ">The black box space was flat in 2007, with IBM/Watchfire checking in at $24.1 million and HP/SPI Dynamics earning $22.3 million. Smaller companies in the space, including Cenzic, Codenomicon, WhiteHat and the like had combined revenues around $12.5 million (a growth of 25%, though Cenzic grew 16% and WhiteHat 52%). Most of the growth &quot;hiccup&quot; in the black box market can be attributed to the serious challenges posed by any acquisition. So far 2008 looks to be back on track from a growth perspective in the black box testing space. The global reach that IBM and HP offer are already making a big difference.</span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="font-family: &#39;Lucida Grande&#39;; line-height: 19px;"><br /></span><span style="font-family: &#39;Lucida Grande&#39;; line-height: 19px; ">On a more positive note, static analysis tools for code review grew at a healthy clip in 2007 into a $91.9 million dollar market. Fortify was up 83% to $29.2 million. Klocwork grew over 60% to $26 million. Coverity grew over 50% to $27.2 million. Ounce Labs tripled their revenue to $9.5 million.</span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><br /></blockquote><div><br /><div>These are very nice growth numbers, what company doesn&#39;t want 83% growth? However, the total picture is not so good. Gary&#39;s estimate shows the software security space coming in at $150 Million total, yet we see a company like Checkpoint that won the network security war in 1995 with earnings of around $900 Million! One single network security vendor is 6 times bigger than the entire software security space?!? Complete UTTER Madness!</div><br /><div>This is the stupefying, stultifying effects of budget cruft, where the decisions made in <a href="http://1raindrop.typepad.com/1_raindrop/2007/10/network-securit.html">The People&#39;s Republic of Information Security</a> have no bearing on reality of threats or even a business case.</div><br /><div>Let&#39;s look at networks. Obviously Cisco is the biggest, they earned $39.5 Billion last year. Pretty stellar. So spending $900 Million (Checkpoint) to defined $39.5 Billion seems like a pretty good deal.</div><br /><div>Except, let&#39;s compare software security spending - last year Microsoft earned $60 Billion, SAP $16 billion, and Oracle $22 Billion. So that is about $98 Billion and you are going to &quot;defend&quot; that with allocating $150 Million worth of software security tools?</div><br />

</div><table border="1">
<tbody><tr>
<td>
</td>
<td><span style="background-color: #d0d0d0; font-family: &#39;Trebuchet MS&#39;; ">
Network
</span></td>
<td><span style="background-color: #d0d0d0; font-family: &#39;Trebuchet MS&#39;; ">
Software
</span></td>
</tr>
<tr>
<td>
Asset Value
</td>
<td>
$39.5 billion
</td>
<td>
$98 billion
</td>
</tr>
<tr>
<td>
Security Investment
</td>
<td>
$900 Million
</td>
<td>
$150 Million
</td>
</tr>
<tr>
<td>
Security Investment <br />&#160;as a percentage of asset value
</td>
<td>
2.28%
</td>
<td>
0.15%
</td></tr></tbody></table>

<br /><div>This table greatly disturbs me. From a prioritization standpoint The People&#39;s Republic of Information Security is misaligned by orders of magnitude. Next time you read about a data breach, or see an auditor&#39;s report with thousands of findings you won&#39;t have to wonder how it happened. It happened because Information Security doesn&#39;t have its eye on the ball.</div><br /><div>Consider that software security tools could grow 50% a year for five years and still be half of where Checkpoint is today!</div><br />I see the outcomes of backwards looking, crufty decisions by Information Security every day - one or two software security sherpas heading out to work with thousands of developers, meanwhile the network security people sit around and read the newspaper and go home every day at 5.</div><br /><div>The optimistic way of looking at all this data is that there is major room for growth for software security, if you take Checkpoint as a target, then the software security space should evolve to around 2% of the software space meaning that it should evolve into a $2 billion space <span style="font-style: italic;">around fifteen times larger</span> than it is today. Unprotected assets will either be protected or will cease to be assets, VCs get your check books ready.</div>]]></content:encoded>
      <pubDate>Mon, 25 Aug 2008 09:18:59 +0000</pubDate>
      <category domain="http://securityratty.com/tag/software">software</category>
      <category domain="http://securityratty.com/tag/software security market">software security market</category>
      <category domain="http://securityratty.com/tag/software security sectors">software security sectors</category>
      <category domain="http://securityratty.com/tag/space">space</category>
      <category domain="http://securityratty.com/tag/tools space">tools space</category>
      <category domain="http://securityratty.com/tag/compare software security">compare software security</category>
      <category domain="http://securityratty.com/tag/software security sherpas">software security sherpas</category>
      <category domain="http://securityratty.com/tag/software security space">software security space</category>
      <category domain="http://securityratty.com/tag/software security">software security</category>
      <source url="http://1raindrop.typepad.com/1_raindrop/2008/08/software-security-market.html">Software Security Market</source>
    </item>
  </channel>
</rss>
