Where are the leaders?

This is inspired by both my buddy Sun Tzu and Michael Farnum. Michael is a little down in the tooth over the state of security. It seems to all be about playing catchup and buying stuff. But are we getting anywhere? It seems that we are always a few steps behind the bad guys.

My handy dandy Art of War calendar quote for last Friday says "The lives of the people and the order of the nation are in the charge of the generals. The difficulty of finding good leadership material is a perennial problem."

Therein lies the problem. Leadership. We have leaders in security but mostly they are focused on their company issues or their own little area of expertise. What we need are leaders who lead from where they are and then move out into larger area and share their experience. We need people who aren't afraid to take chances and challenge the best practices. Much of our problem stems from the fact that we tend to lean too much on the concept of best practices. We say "Oh look we need to implement X solution because it is a best practice." We look at things and say "What best practice can we implement to address X issue?" We don't stop and think about where the problem stems from and what is the best answer for us instead of the best practice answer.

In today's world of regulations and compliance we are afraid to look outside of best practices for fear of having auditors question us. Those who don't worry about the auditors and worry about securing their networks and protecting their data in the way that is best for them are the ones who are the leaders. They are the ones who stay ahead of the bad guys instead of playing catchup.

So to answer Michael's question "Does Security Nirvana Exist?" No, but those who think and don't just blindly follow the crowd are a lot closer to it than the rest of the world is.

Michael Farnum tried to run me off the road today!

OK, so it probably wasn't really since he is in Texas and I'm in Georgia. It sure did look like him though.

I was driving down the road and just as I started to turn right from the right hand turn lane the SUV next to me decided that he also wanted to turn right. The problem was that he wasn't in a turn lane. I ended up in front of him and I looked in the rear view mirror and this guy looked just like Farnum. I know my blog is gaining on his, but this is a drastic measure. If he had been wearing the Grinch outfit that Shimel gave him I think I would have wrecked.

Preach It, Michael!!

Michael Farnum is more than a little upset with Microsoft for their comments regarding a new bug that has been discovered in IE Vista.


I don't blame him. It makes me mad as well. Why do software companies think that they can just do what they want as they want. Is it because we don't have much of a say or what we say doesn't really matter to them. Once a company reaches a point where they hold a large part of the market for a type of software they just seem to quit caring. They forget who brought them to the dance. Many people don't have much of a choice but to continue to use their software because it is the standard. It is what everyone else uses and if they switch to another vendor then it makes it harder to share files with other business partners and most companies don't want to have to deal with it.

If Microsoft is really concerned with security as they keep telling us that they are then they need to be concerned about ALL of security. That includes availability as well as confidentiality and integrity. What good is data that is confidential and that hasn't been altered if it can't be accessed by those who need it. I know that many people think that IE is a web browser used to play on the Internet, but it's much more than that. Microsoft even bills it as a business critical application and they encourage companies to port applications to browser based so that IE can be used to access the data. I know that in my company IE is CRITICAL. If it fails then we fail. Our main business app relies on IE to the extent that it won't work properly in FireFox, Opera, Safari or any other browser.

I take up Michael's cry of "Microsoft, FIX IT!" and I think that all of us need to rally around this. It's time that software companies get the message that we won't be walked over.