I paid a visit to the RSA security conference on Wednesday afternoon, primarily to see what new products and services are easing corporate insecurities. I certainly didn’t need to be convinced that security is top-of-mind for most small, mid-sized, and large companies. If I had any doubts, the sheer volume of vendors (250+ exhibitors) and scale of presentations (Chambers, Gates, McNealy) at this show dispelled them. I don’t have attendance figures, but I’d guess that RSA was certainly on a par with PDC or TechEd. All the major software and hardware vendors were represented handsomely - Cisco, IBM, Microsoft, HP, Sun, CA, Symantec - basking in the luxury of deep pile carpet and 50′ x 50′ booth displays that looked like Italian furniture showrooms. Some vendors even opened a full bar service (beer on draft) towards the end of the conference exhibit hours; they got lots of traffic but nobody paid a blind bit of attention to their products once the suds were flowing!
Despite the big corporate largesse, I have to say that most of the interesting stuff was happening with the smaller software companies that were announcing some great innovations and impressive product releases. Amidst the mill of encryption, smart card, virus protection, and firewall technologies, there were a few gems to be found. SPI Dynamics ran a tiny booth in the Microsoft Partner Pavilion, but I continue to be really impressed by what they are doing for Web application security. Having talked to their product team at VSLive, I spent some more time looking at a demo of their DevInspect product for Visual Studio developers. It’s a very clever tool that finds security threats and vulnerabilities in your ASP.NET applications, fixes them in some instances, runs scripts to prevent malicious input, and hands off to a number of key security resources and best practices for ongoing support. I’d like to know more about SPI’s team of security researchers, but I’m told they work around the clock identifying new threats and updating their knowledge repository. If I wanted to be picky, I’d say that SPI needs to invest in providing more learning support and case studies that highlight best practices for writing secure code. It’s good to identify and fix problems after they’ve been written into a mission-critical web application, but it’s also important to instill a culture of best practices for writing secure code across your development organization. Maybe InnerWorkings could help with that, guys…
Late in the afternoon, I sat through one of the best product demos I’ve seen in a long time by a company called Verdasys. One of their product managers gave a very compelling walk-through of their Digital Guardian platform, which basically protects an organization’s data assets. I began to realize just how much visibility an organization can have into all activities across their commercial systems. The presenter used the example of a rogue employee at a large financial services institution who was trying to steal credit card information from the system. Shocking premise, I know. It tracked his every move from attempting to copy personal data between applications, hide it on the network, save it to an external drive, and process a false transaction to a friend’s account. The tracking, logging, and reporting tools were all web-based, beautifully designed, and really powerful at identifying and isolating this type of security breach. I particularly like the “Forensic Reports” that the management console produced - great name for an efficient and no-nonsense product! I’d feel a lot safer knowing that my bank (and all its anonymous subsidiary holding companies) had this kind of data tracking and protection system in place.
I also spent some time with Microsoft’s application development lifecycle folks and got a good overview of their internal security practices. They walked through the use of threat models, code scanning tools, code reviews, and security testing. I even walked away with a copy of the “19 Deadly Sins of Software Security”. I’m told this book is the security bible for every developer working at Microsoft (I’m sure the authors would agree). As impressive as the lifecycle model looks, and despite the obvious strides that have been made in OS and application security, I still feel there’s a lack of formal learning and ongoing support underpinning the lifecycle model - everything else in the model looks solid, but that’s a pretty significant omission in my humble opinion.
On a final note, I discovered that the hardest thing to secure in downtown San Jose is a simple parking spot. I spent about 30 minutes being waved from one monolithic concrete parking lot entrance to another, dodging hundreds of distracted pedestrians with orange access cards dangling from their necks. I eventually parked in another zip code and got some fresh air walking to and from the show. Yet another sign that security is big business in this part of the world…
