Articles

 

  • Seeing a Phish

    Let’s start with CNN – and no, not that CNN, but rather convolutional neural networks. This class of deep neural networks is the workhorse for computer vision, and is one of the underlying forces behind recent advances in artificial intelligence. Their design is inspired by the image processing done in the visual cortex of the animal brain. When you see one of those cat recognition demos by an AI system, a CNN is likely doing most of the work.

  • Securing Your Workload Mesh

    Andrew Carnegie once said this: 'The way to become rich is to put all your eggs in one basket and then watch that basket.' While this quip from the industrialist might have been useful folksy advice for Grandma and Grandpa, it is terrible guidance for the modern computing and application system designer. A much better mental image in computer science today involves distribution – and the correct unit for scattered computation is the workload.

  • Security Conference Boothonomics

    With the RSA Conference at T-minus two weeks, I wanted to share some heartfelt advice with those of you now doing vendor booth planning. My advice comes from many years of standing on either side (seller and buyer) of that little porto-table with its stacks of data sheets and bowls of Hershey kisses. My hope is that this advice will help you to maximize the ROI for your little slice of exhibitor heaven in Booth 7002 of the South Expo.

  • The New CIO Mandate

    Without question, it’s one of the most exciting times to be a CIO today. Given the pace of technology change that’s occurring in the consumer space, coupled with the impact that modern technologies such as Machine Learning and Blockchain are having on our global workflows, there are tremendous opportunities for IT to enable our companies to thrive.

  • Man, these passwords. We need AI.

    While waiting to go on-camera last week at Yahoo Finance, I was mulling about, chatting up the other guests outside the studio. A woman was seated nearby with her laptop, and when I introduced myself as a cyber security professional, she summarized her view of my life’s work in three words: Man, these passwords. And then, she offered a concise and entirely correct solution to the problem – also in just three words: We need AI.

  • VM Security from an Unexpected Source

    Much of what you learned in Operating Systems 101 is no longer applicable to modern computing – and virtualization lies at the root (ahem) of this change. The core principle is that physical host machines are now used to run multiple guest virtual machines (VMs) to optimize the use of memory, bandwidth, and CPU.

  • One-Stop ERP-Sec

    The two most prominent providers of enterprise resource planning (ERP) security have now merged: Boston-based Onapsis announced this week that they have acquired Heidelberg-based Virtual Forge. While the deal terms were undisclosed, we do know that the resulting company will have three hundred staff, which creates a solid global base on which to drive growth. Led by Mariano Nunez, this newly-combined team looks formidable.

  • Making MSPs into MSSPs

    The Wikipedia entry for managed services has its first reference to security at Word 345 of the narrative. When you Google 'managed services', the People-Also-Searched-For box lists cloud computing, data center, IT service management, outsourcing, and Software-as-a-Service, with no references to security. Suffice it to say, managed services from MSPs are viewed as broader and largely distinct from managed security services from MSSPs.

  • Using AI to Cluster and Protect Data

    One of the oldest previously-classified US documents, written over one hundred years ago, explains how to make secret ink: “Take one ounce of linseed oil, 20 ounces of liquid ammonia, 100 ounces of distilled water. This mixture must be shaken up before using with a quill pen. Write in free space between words written in pencil. To make this writing appear, dip the whole letter in cold water, and read secret writing while wet. Upon drying the writing disappears.”

  • Five Cyber Security Hopes for 2019

    Fifty years ago, the surprisingly political Smothers Brothers convinced CBS to let Pete Seeger perform on their show his anti-war protest song, Waist Deep in the Big Muddy. The famous song’s perfect title reflects its basic Vietnam-era premise – namely, that our country was stuck in a terrible situation with no obvious solution. And like the sad hero of the song, once you get stuck deep enough in the mud, there might be no escape.

  • Visibility for Enterprise Security

    When you hear the term high-speed packet capture, what comes to mind? For me, the term has always conjured thoughts of comprehensive lawful intercept, broad metadata analysis, critical infrastructure protection, and on and on.

  • Implementing Zero Trust

    Thirty years ago, I needed a Russian alphabet for Unix troff (yea, I know – but please don’t ask). Online search tools didn’t exist back then, so finding a workable package was tougher than you’d expect. After some poking around, I managed to locate a colleague at Bell Labs – Eric Grosse – who had what I needed. He possessed a library of Cyrillic glyphs that could be easily mapped to our troff text input. It worked perfectly for our stealthy project.

  • Tip Toeing Through Cyber Insurance

    “If you took all the men and women employed in the U.S. insurance industry and laid them head to toe, starting on New York’s William or John Street – the little-talked-about insurance industry equivalents of neighboring Wall Street – they would stretch up the West Side Highway, head to toe, over the George Washington Bridge into N.J., down the N.J. Turnpike to the Pa. Turnpike, across Pa. into Ohio, through Ohio along Interstate 80 past Chicago, past Des Moines, past Lincoln, Nebraska – still head to toe, one after another – past Cheyenne, Wyoming to someplace just shy of Salt Lake City.”

  • Compliance-as-a-Service

    When my kids were small, there was this torturous jingle on Sesame Street that combined the letters of the English alphabet into a jumbled melody.

  • Weaving Behaviors into the Next-Generation SIEM

    In my private files, I have a note from Dorothy Denning saying that she enjoyed my 1998 book on intrusion detection. If you live in the security industry, then you’ll know that this is like having Einstein tell you he liked your physics paper. Professor Denning was the first, for example, to show that activity timelines could identify anomalies from normal behavior. Her 1987 IDES paper remains iconic reading for all students studying cyber security.