Tempted to “Skimp” on IT Security?

FACT: According to a study presented at last week’s annual RSA Conference on cyber security, by Palo Alto Networks CTO Nir Zuk, “Users are routinely, and fairly easily, circumventing corporate security controls. And that is because traditional firewall technology was not meant to grapple with the diversity of Internet applications of recent years.”

ANALYSIS: Security has been an even hotter topic than usual for the past month, what with new national-level attention to cyber security and, for Microsoft, a culmination of sorts of various strands of effort into our new “End to End Trust” initiative.  My boss, Jim Simon, attended the RSA Conference in San Francisco, with his boss, Craig Mundie, Microsoft’s Chief Research and Strategy Officer.  Craig laid out Microsoft’s “End-to-End Trust” vision, designed to provide users more control over online and enterprise systems.  His keynote was widely covered (even by offbeat security blogs, like RiskBloggers.com) so I don’t need to rehash it.

Nir Zuk’s presentation was interesting – and not just because he’s one of the true pioneers of firewall technology.  He really understands secure enterprise environments, something I’m talking about increasingly with government organizations, who are learning the hard way the need to protect their data, apps, and computing platforms.  

Air Wars: the Air Force Takes Heat for its PR

FACT: A heated online debate is erupting about a particular photo posted online, and the brouhaha around it focuses on whether or not classified details are contained therein, thus revealing them. 

ANALYSIS: Given that others are even now writing extensively about this photo and its controversy I thought I would add a couple of thoughts.  Don’t bother blaming me for linking to the photo, by the way; given the attention and reposting/rehosting it has already received, the glare of publicity can only serve to prod better security practices. 

I expect to see parody versions on Flickr soon, with “Area 51” touches.

And so to my related thoughts: recently, an active-duty USAF officer and regular reader emailed me about one of my posts concerning Rod Beckstrom and the new National Cyber Security Center, which he had not previously heard of.  He wrote that in discussing it with a colleague, the response was “I thought the Air Force Cyber Command already had the mission to coordinate all cyber security efforts.”