October 27, 2004

SecureWorld Expo Day 2 Review

Well, I am back in Canada tonight, and have a bit of time to catch up on the rss feeds and update the blog. I thought I should summarize day 2 of the SecureWorld Expo show.

Here is a quick review:

  • The early morning breakfast session with Kirk Bailey, CISO of the City of Seattle seemed to be pretty good. We showed up a bit late, and had to sit in the back... where the sound was really bad. Luckily I think he is coming up to the West Coast Security Forum and I will be able to hear him speak when he comes up.
  • Crispin did a presentation on host based intrusion prevention for Linux systems through the use of LSM. Interesting stuff. His Subdomain product does similar stuff to my current Windows work in intrusion prevention, hold that to some deep inspection stuff that I am doing. I have heard him speak before, and this presentation wasn't as "fun" as when he talks passionately. His presentation on defending servers during DefCon at the Bellingham Linuxfest was much more interesting.
  • I listened to an EXCELLENT presentation on "Next generation Approach to Risk Analysis" by Peter Stephenson. He presented an interesting topic on Forensic Analysis of Risks in Enterprise Systems (FARES). I could go on for hours about the topic as it was very enlightening as a qualitative risk assessment process. Instead I will point you to the very informative slide deck that was used during the presentation. One thing I liked was the way to use Coloured Petrinet to create interactive risk analysis models and actually test how an attack vector may be mitigates in a network environment without having to actually modify your environment. Makes simulations very nice.
  • The most disappointing panel of the conference, IDS vs IPS was a big flop. There was NO constructive debate on the pros and cons of IDS vs IPS. It was again rah-rah [vendor name here] approach is the greatest. No one would give a straight answer to anything. From cost to implimentation techniques, it was all basically a deflection to come talk to them and explore needs. Beau summed it up pretty good as we walked out. No way in hell should anyone put a network IPS in place to STOP critical business network flow when so many false positives already overwhelm us in the IDS space. I add that no way in hell should we consider a single device accessable by the Internet to hold all our keys to our security; network IPS vendors saying you should store all your private keys for a certificate proxy should be shot. (That would be a good portion of the panalists)
Overall, it was a good show. I am chomping at the bit now though for the West Coast Security Forum. In a few blog entries later this week, I will discuss some of the interesting findings that I had while talking with vendors.

Posted by SilverStr at October 27, 2004 11:24 PM | TrackBack