RSA Security Octagon: What's the Best Way to Secure Applications?

We're doing something a little different this year at #RSA with a Security Octagon. Everyone loves a good debate and in the security community discussions pop up constantly around a myriad of topics at any given point - with individuals or groups in the community taking opposing sides in these quarrels. While we’re not looking for a knock-down drag out geek fight, we are looking for a spirited debate in hopes of engaging with security pros to lend their support and opinions to the topic.

In the first debate we focus on the topic of application security. Is application security just secure coding or is it more than that? Preston Hogue from F5 and Jeremiah Grossman from WhiteHat Security are our first participants to discuss 'What's the Best Way to Secure Applications?'

How can you play along?

Visit https://f5.com/securityoctagon to cast your vote and comment on the discussion.

1. Make sure to use the appropriate #hashtag:
      a. #TeamGrossman
      b. #TeamHogue

2. Can’t pick a camp to support, promote the program overall:
      a. #SecOctagon

If you're at RSA, visit F5 booth 1515 and say 'Aloha' to DevCentral folks John Wagnon and Jason Rahm and ask how you can Integrate WhiteHat Scans With BIG-IP ASM.

And a very special thanks to Jeremiah for participating this year. Always appreciate his security insight and for a look back at previous RSAs, here are the past 5 years of interviews we did together.

RSA2015 - The InfoSec Landscape with Jeremiah Grossman


RSA 2014: Jeremiah Grossman Interview


RSA2013: Interview with Jeremiah Grossman


RSA 2012 - Interview with Jeremiah Grossman


RSA2011 - Interview with Jeremiah Grossman


Enjoy the show!

ps

Technorati Tags: f5,rsac,security,devcentral,octagon,silva

Connect with Peter:	Connect with F5:

RSA2015 – The InfoSec Landscape with Jeremiah Grossman

In a fascinating and fun conversation, InfoSec luminary, web application expert, TEDx speaker and WhiteHat Security Founder, Jeremiah Grossman explains some of the change occurring within information security. Have the never ending breaches changed the way people think about security? How do organizations protect their critical applications in today’s hybrid environments? He also has some fun with the fate of the perimeter and also explains why InfoSec needs security guarantees. And if you ever wondered, learn why many InfoSec folks participate in a Brazilian Jiu Jitsu Smackdown after events like RSA. Is there a connection between personal self-defense and defending against digital attacks?

 

ps

Related

• RSA 2015 - The Preview Video
• RSA2015 – Find F5
• RSA2015 Partner Spotlight - RSA Risk Based Authentication
• RSA2015 – Defending the New Perimeter
• F5 @ RSA 2015
• F5 YouTube Channel

Technorati Tags: f5,rsa,rsac,grossman,whitehat,infosec,security,ssl,silva

 

Connect with Peter:	Connect with F5:

RSA 2014: Jeremiah Grossman Interview

We are at it again! For the 4^th year in a row, Jeremiah and I chat in our annual RSA video catch up. I get some interesting security insight from WhiteHat Security Founder & CEO Jeremiah Grossman. We touch on web vulnerabilities, mobile apps, why SQLi and XSS is still a problem for organizations, WhiteHat’s Aviator secure browser along with some business advice for those entrepreneurial technologists looking to jump start their start-ups. Always a fun and interesting conversation with Jer.

ps

Related

• RSA 2014: Find F5
• RSA 2014: Anti-Fraud Solution (feat DiMinico)
• RSA 2014: Secure Web Gateway (feat Moses)
• RSA 2014: DDoS Protection (feat Bocchino)
• RSA 2014: High Performance IPS (feat Blair)
• RSA 2014 Customer Spotlight: CARFAX
• RSA 2014: API Integration (feat Marshall)
• RSA 2014: Layering Federated Identity with SWG (feat Koyfman)
• F5 at RSA 2014
• F5 Expands Synthesis Architecture with Advanced Web and Fraud Protection Services for Worry-Free Application and Internet Access
• F5 YouTube Channel

Technorati Tags: f5,whitehat,grossman,security,web,rsa,rsac,silva,video,mobile

 

Connect with Peter:	Connect with F5:

RSA2013: Interview with Jeremiah Grossman

Peter Silva catches up with WhiteHat Security Founder & CTO Jeremiah Grossman to talk about WhiteHat’s recent round of funding, vulnerabilities in mobile apps, the idea for companies to hack themselves first along with some trends regarding web vulnerabilities. Always fun to chat with one of InfoSec’s coolest dudes and a fellow local boy.

 

ps

Related:

• RSA2013: Aloha from RSA
• RSA2013: Find F5
• RSA2013: Gimme 90 Seconds Security Edition
• RSA2013: Partner Spotlight – Websense
• RSA2013: Partner Spotlight – Quarri
• RSA2013: F5 RSA Security Trends Survey
• RSA2013: BIG-IP SSL/TLS Services
• RSA2013: BIG-IP DNS Services
• F5′s YouTube Channel
• In 5 Minutes or Less Series (23 videos – over 2 hours of In 5 Fun)
• Inside Look Series
• Life@F5
• Also this week, check out: Mobile World Congress – Day 1 & Mobile World Congress – Day 2

Technorati Tags: f5,rsac,rsa,rsa2013,psilva,video,grossman, mobile apps,whitehat

RSA 2012 - Interview with Jeremiah Grossman

In my 100th F5 video, I interview WhiteHat Security Founder & CTO, Jeremiah Grossman.  Topics include security jargon, Hack Yourself First, RSA activities and some interesting observations about web application security.

ps

Resources:

• F5 YouTube Channel
• RSA 2012 - Welcome to San Francisco
• RSA 2012 - Find F5 Booth 2147
• F5 Attends RSA Conference to Help Organizations Deploy Multilayer Security Solutions without Compromise

Technorati Tags: F5, RSA, Pete Silva, security, business, education, technology, internet, cybercrime, jeremiah grossman

Connect with Peter:	Connect with F5:

2012 IT Staffing Crisis?

After just proclaiming, a mere four days ago in The Top 10, Top Predictions for 2012, that I wouldn’t predict anything for 2012 and simply would repurpose other’s predictions, I offer this prognosis.

An area I have been thinking about recently is the availability of IT personnel, or lack thereof in 2012.  It began with a conversation with a F5 colleague and a simple premise:  Information Technology personnel seem to be in demand.  We have read stories to this effect, and even anecdotally realized that times are not that bad for IT careers, despite the financial crisis. Sure, many were laid off from failing startups or collapsing banks a couple years ago, but many seemed to get new jobs rather quickly, and many of us get a few job solicitations every month.

In researching the real statistics on IT unemployment (from Help Desk to System Admins to Developers to Business Analysts), we realized how much of an understatement the premise was:

Dice.com, May, 2011:  3.8% IT unemployment - 65% of hiring managers anticipated hiring more technology professions in 2H 2011, and 49% said they were paying more in salary this year than last year.

Bureau of Labor Statistics, June 2011: 3.3% IT unemployment – Expects IT employment to grow ‘much faster than the average of all occupations’ through 2018. 

Bureau of Labor Statistics, July 9th, 2011: 3.3% IT unemployment - Information Security Analyst unemployment: ZERO.  Network Architect unemployment:  0.2%

Consider that the economy has not really recovered from the crash, and that many companies downsized or went out of business altogether.  5% unemployment is generally considered to be "full employment"; 3.3% is typically unhealthy for business growth.  When our economy gets through this difficult period, where are companies going to find IT workers?  But more specific, what does this mean? 

I think that operating expenses is going to be an increasingly difficult problem for everyone, in every industry.  Besides paying serious money to lure IT people away from other companies, employers are going to start paying serious money to protect the IT resources they already have.  When you are an IT manager, every system you consider for implementation has two costs – the upfront cost, and how much of a resource it will take to manage it, the classic CapEx and OpEx.  If you produce a solution that does not require additional headcount to manage, or actually reduces headcount, you can save OpEx for a lot of companies.  Even if ProductX costs $100k, that's only the price of one IT guy for one year.  And that price is going up day by day.

iApps in BIG-IP v11 is a great step toward reducing OpEx, and evening the bar of who and what knowledge is needed to deploy our solution.  Evening the bar of what skill set is needed is vitally important, because most companies can at least find some System Admins (2.8% unemployment) but may not find a Network Architect or InfoSec guy to implement the apps on the BIG-IP.  The WhiteHat integration with BIG-IP ASM is similarly great, especially to those who implement the solution.   Many organizations are unable to devote enough resources to managing a WAF, plus they can't find the InfoSec personnel anyway since their unemployment rate is ZERO and has been for a few years.  The integration allows those with minimal security experience the ability to build a solid web application security policy.  Often, simply feeling comfortable with an appliance is all that’s needed for IT staff to give it attention.

The coming or currently unfolding (?) IT HR crisis will matter to many organizations over the next few years.  Interestingly, while I was writing this, a tweet arrived asking, ‘@wimremes: random thought : do you (still) rely on recruiters or do you use your own network to find the right people for a job?’  I’m really not sure exactly how it will play out but simply something to think about.

ps

References:

• The Top 10, Top Predictions for 2012
• Information technology unemployment dips below 4%; skills hunt escalates: survey
• What IT hiring managers want, now
• IT jobs thriving despite lackluster economy

Technorati Tags: F5, cyber security, predictions, 2012, Pete Silva, security, mobile, labor, jobs, social media, staffing, employment, internet, identity theft

Connect with Peter:	Connect with F5:

F5 Case Study: WhiteHat Security

Founder & CTO of WhiteHat Security, Jeremiah Grossman talks about the F5/WhiteHat partnership, the benefits of the WhiteHat Sentinel & BIG-IP ASM integration, the sophistication level of some of the recent attacks/breaches reported in the media, blocking SQL Injections and why organizations should consider an integrated WAF and Scanner like the WhiteHat/F5 solution.

ps

Related:

• WhiteHat Security
• WhiteHat Blog
• Jeremiah Grossman Blog
• F5/WhiteHat Partnership
• F5 Youtube Channel

Technorati Tags: F5, RSA, Pete Silva, security, business, education, technology, internet, cybercrime, grossman

Connect with Peter:	Connect with F5: