William Jackson | Old security issues, and plenty of new ones
Connecting state and local government leaders
Cybereye'commentary: More attention is being given to actively protecting what is inside the network rather than putting up fences.
The RSA Security conference and trade show kicks off tomorrow at the Moscone Center in San Francisco, with four days of speakers, panels, workshops and a show floor that usually is as crowded as the schedule.The conference not only is one of the largest security conferences of the season ' from 15,000 to 20,000 people are expected to attend and nearly 400 vendors are exhibiting their wares ' but it traditionally is one of the densest in terms of useful information crammed into a brief period of time. There are more than 200 sessions being presented in 18 different tracks. No one attending the event will be able to do more than get a sampling of it, but there are some broad patterns emerging in the products to be exhibited and security concerns to be discussed.The traditional security issues we have been facing for years are not disappearing, and improvements in firewalls, antivirus solutions and intrusion detection systems will be demonstrated. But as the network perimeter continues to become vague, more attention is being given to actively protecting what is inside the network rather than putting up fences.RSA Chief Executive Officer Art Coviello called for a new focus on information-centric security in last year's opening keynote speech, and it now is accepted wisdom that enterprises need to focus on protecting data, with system defenses being a means to an end rather than an end in themselves. This year's hot topics reflect this consensus.Network Access Control was one of the big buzzes at last year's conference and it remains a hot topic this year. NAC enforces policies about the identity, health and security configuration for devices connecting to a network, because all the perimeter defenses in the world are useless if you let a poorly patched laptop PC infected with a variety of malware connect to your servers. No longer cutting-edge technology, NAC is beginning to mature and the emphasis this year seems to be how to make it simple and ensure that it interoperates with a variety of networking equipment.Replacing NAC as the hottest topic might be virtualization. Now that the major information technology players are supporting virtual servers ' that is, multiple operating systems running on a single piece of hardware rather than the traditional monogamous mating of one server and one operating system ' security companies are working on ways to secure these configurations. It is becoming apparent that many of the tried and tested tools used to secure servers do not work and play well in a virtual environment. Administrator are faced with a conundrum: Hardware-based security appliances offer high performance and ease of use, but those appliances might no longer do the job they were bought to do after excess server hardware has been eliminated from the data center, and operating systems share physical resources. The vendors, of course, are coming up with answers for them.Finally, there is the Web 2.0 umbrella, which refers to anything interactive that can be accessed over the Web. Some of these are germane to the enterprise, such as Web applications used for business. Others are consumer-focused playthings such as social networking sites, virtual worlds and peer-to-peer file sharing applications that are creeping into the enterprise by back doors. Managing and securing them is a big challenge, and hence a big topic.One event probably sure to catch a lot of attention will be a Wednesday town hall meeting hosted by Greg Garcia, the Homeland Security Department's assistant secretary for cybersecurity, providing a first peek at the results from last month's Cyber Storm II exercises. Don't expect a lot of detail ' participants sign nondisclosure agreements to ensure there are no leaks of embarrassing vulnerabilities that turned up in the exercises. But there should be some interesting results from what is being billed as the most comprehensive cyber exercise in U.S. history.
Cybereye columnist
William Jackson
GCN
NEXT STORY: GCN Best of Fose winners named