Skip to content


AC34 Finals: Notes of Interest

I've noticed several things in the current America's Cup finals that keep my interest. While others in San Francisco seem completely oblivious to the racing, and it's hard to drag them out and watch, I'm still excited about watching these points:

  1. Overall performance (energy transfer) engineering: ETNZ has the best boat design engineers in the world. It's clear. They're getting 4-5 knots more speed upwind. That is a huge factor for match competition where getting on top of the other boat means controlling the finish — the deciding factor in several races so far. I've seen far more twist at the top of the ETNZ sail compared to Oracle. Basically, Oracle spent more than double yet ended up with a slower boat. A straight run speed delta also tends to have a serious psychological effect on the sailors, forcing other errors, because it's hard to stay positive when side-by-side you fall behind.
  2. Reduced drag: Both teams position sailors further and further below deck level. One of the team engineers told me that one single sailor standing up causes enough drag at 25knts to impact performance by several seconds a kilometer. The boats are only a few seconds apart in the races so over a 1500m course a boat with less drag from sailors themselves will have a measurable advantage. ETNZ seems to have the more aerodynamic deck and cowlings. It also hurts when water hits you at 25knts (like cold nails) so working lower is probably welcome relief.
  3. Turns: As the boats jockey for dominance they carve incredibly fast turns. A 72ft boat that can pivot at speed within its own waterline is a phenomenal engineering achievement. The wind and water generate massive loads yet the captains clearly transfer the energy and shift quickly while keeping speed. ETNZ has an advantage in this area as they clearly make smoother turns and maintain more of their speed, which further capitalizes on straight-line speeds.
  4. Team fitness: These people have trained non-stop for three years, every day and often twice a day. They are at the peak of physical shape. Yet when I watch the videos with sound on I hear them wheezing and coughing as if they can barely catch their breath. Turning and tuning the boat completely maxes them out. And they can't go anywhere. Unlike football, soccer, basketball, baseball, volleyball…there is no relief or substitution possible. The Round-the-World Ocean races once were described to me as playing rugby without any option of leaving. That is why professional sailing could perhaps be seen as one of the top physically demanding sports in the world.
  5. Tactics: I'm completely shocked at the errors a usually ultra-aggressive Spithill has made. I expected to see Oracle try and force errors, play dirty and get in Barker's face at every chance. Instead Spithill has made repeated unforced errors and been charitably giving away races. Perhaps he is not in sync with his team, or the speed delta is getting into his head. When the match-racing heat is on high, Spithill starts melting and makes moves painful to watch. Meanwhile Barker, always the quiet gentleman, sails away confidently and cleanly.
  6. Team Nationality: Spithill almost made me spit up when I first saw him tell an audience Oracle is the "home team". This man is an Aussie through-and-through. Nothing wrong with that, but he has stated in interviews that ever since 1983 (when he saw Australia win the cup) he has dedicated his life to Australia keeping the cup. In the post-race interview a few days ago he repeated his "home team" nonsense and said ETNZ is trying to "take the cup far away". Barker, in a beautifully accurate retort said "if we win we'll bring it closer to your home". Indeed, Spithill might prefer a NZ win.

    Spithill thus comes across as awkward as if forced to ask for support now from the country he has loved to hate as a sailor. In addition, despite being in America, Oracle also has a reputation for disdain towards its home country and especially the cities lived-in by Ellison. A real-estate agent just told me the Oracle CEO bought a house in SF to watch the races and immediately demanded the neighbor, an elderly lady in retirement, cut down her trees so he could get a better view. She said no at first, since they were clearly on her property. Then Oracle lawyers promptly arrived and asked her if she really, really wanted them to wipe out all her retirement money in a messy legal fight and leave her for dead. With a home team like that who needs enemies?

    ETNZ, in stark comparison, has used a large percentage of funds direct (kick-started) from their government and held discussion about how the money spent will benefit taxpayers (jobs, business, trade, etc.).

  7. Boat Nationality: Both boats were built in New Zealand, which if advertised more might help recoup some of the national investment. More interesting than that, however, is the ETNZ boat was designed by the American team that won the cup back from NZ in 1988 with a catamaran. So the ETNZ boat is essentially a successor American boat to the 1988 campaign, while the Oracle boat is apparently not American at all. It may even be French, since they have boasted about finding their initial wing designer in France. Whatever the Oracle boat is or isn't, to me ETNZ is really sailing the American boat design.
  8. Waterfront access for dinghies: Perhaps the most annoying fact of the entire event is that it is inaccessible to the common person. Super-yachts need more berthing space about as much as anyone needs a hole in the head. Those who aren't billionaires, on the other hand, really REALLY need a place to launch a performance dinghy in San Francisco. Basically if you're a kid in an Optimist you're ok because clubs will support that but once you graduate to something fun where do you go? And if you're a young professional ready to splash down some money and go for a hot ride…you basically can't unless you go far away. The waterfront has no facilities and no support. None. That is perhaps the biggest oversight of this entire event. Even rockets are more accessible than high performance dinghy sailing to people who live in SF.

Those are some of the major notes. In summary, ahead I see a sea-change in the boat-building industry and very little change in the American sailing community. Globally we'll get more efficient, faster and more fun boats of all sizes yet unfortunately this will not lead to any more American kids rushing to get into sailing.

I have a bunch more items I'm tracking but just wanted to share the biggest and most recent ones. Let me know if you have others to add or discuss.

Posted in Sailing, Security.


AC34: ETNZ Bows Down…and Survives

Several people have suggested I explain the ETNZ crash. Usually it comes up casually. I get all animated and start describing the details of the event and then people say "that's interesting, others need to hear this"…and I think why didn't the America's Cup put someone on the commentary team who actually races catamarans?

Just one source of reporting would be OK if it was amazing and insightful. Tell a few war stories, life in the trenches stuff, pepper it with math and science, and I'd be glued to the tube during the Louis Vuitton races.

Instead search the entire Internet and you will find only one video, one set of boring empty perspectives. Here it is. Notice how lame the comments are during the action at Gate 3:

The announcers mention a puff, and basically having nothing to say other than what happened after the bows dive down. Men overboard, damage on the front. Duh:

This all has to do with the pitch. The bows went down. [...] They stuffed the bows for some reason…that wave hit them.

Thank you captain obvious!

Unfortunately this is not far from the official statement language of ETNZ, as reported by Sailing World. At least they provide some detail such as shift in speed:

The team’s AC72 Aotearoa popped up onto its hydrofoils rounding the mark and then a gust of wind hit. The port (left) bow of Aotearoa buried up to the main crossbeam, reducing the boatspeed from 40 knots to 13 and flicking two crewmembers, Rob Waddell and Chris Ward, overboard. The two grinders were recovered unharmed by the team’s chase boat, but the rush of tons of water tore the port side fairing off the main crossbeam and left the crew shaken.

“In this sort of racing, the boats are incredibly powerful. You see how quickly the speed rockets up as you make the turn around the top,” said skipper Dean Barker. “We came in there with good pressure. Through the turn we were always going to pick up a decent increase in speed; I’m sure there are a few things we could’ve done better.

Dropping from 40 to 13 knots in seconds feels like what, exactly? Unless you've been on a boat that stuffs the bows into a wave it's hard to imagine. That's why an announcer should be someone who has lived the danger, experienced the excitement, and can relay the feelings to a general audience.

So allow me to try. Here is the scoop (pun not intended) on what happened and why, and what it feels like.

This kind of event is all too common in catamaran sailing. This is what failure usually looks like:

Fail1

But not this:

Notfail

Not yet, at least. Those crazy cats in the last photo (pun not intended) are burying their entire hull and managing to avoid pitch-pole (tripping).

So the biggest risk of crashing in catamaran racing is actually when you turn to go down wind at the windward mark. It's really quite simple and expected, which means ETNZ was about to crash in the area most likely to cause a crash.

If you've raced catamarans you simply know that when you approach the windward mark in a big wind, you might be experiencing a bowel movement as you turn the boat away from the wind. When the catamaran does not oppose or release power that builds in the sail it dives the bows. A big puff hitting ETNZ as it bore away (turned after the mark) certainly fits that equation.

But this isn't the first time a puff has hit a boat in this critical moment. Catamaran sailors know puffs happen at the windward mark all the time. So why didn't the team just handle it? Actually, like the last photo above, they did.

First of all, the wave-piercing design of the AC72, which some say look like inverted hulls, is meant specifically to allow the boat to survive a dive. From that perspective, they came out of the dive instead of crashing because they knew it could happen. Amazing risk engineering.

The announcers should have been all over the fact that a 72ft boat with wave-piercing hulls can survive a deep dive at 40knts. That was an unbelievably beautiful and planned graceful exit, unlike the Oracle incident where the boat flipped up and eventually broke apart.

Here is a clever comparison of the Oracle and ETNZ boats from CatSailingNews

Comparison

The article is mostly pointing out that Oracle has been copying ETNZ to stay competitive. Notice something else, however. The bows of the two boats are both inverted and designed for wave-piercing yet still quite different. The Oracle boat appears to have far less ballast (float) than ETNZ.

Could Oracle have survived such a dive? My experience on the A-Class catamaran over four generations of design is that a clever buoyancy model in the bows makes a MASSIVE difference. Oracle, like the current platform I sail (an A3.5), looks anemic in the front end. It would likely have had a harder time even with the re-design after their crash.

Oracle

This is what an announcer could have mentioned. Bow design. They also could have mentioned the effect of the T-shaped rudders, and L-shaped foils. And they could have mentioned the aerodynamics of the carbon relative to fluid density (wind above versus water below). Saying a crash is related to "pitch" simply isn't good enough.

Second, a turn in puffs and big wind is scary business because of pressure for rapid decision-making. When Barker turned the corner he made a critical error by taking the turn too tight at the wrong moment. Bad luck, perhaps you could say.

It is a lot like turning a car into a hairpin curve. You know in your mind the speed you need to stay in control as you reach the apex. But in sailing you don't get to take your foot off the gas or hit the brakes. There are no brakes. And a puff is like someone pushing your gas pedal to the floor.

Instead of smoothly turning you suddenly find a huge boost of power pushing you in a direction other than where you anticipated. Fractions of a second are all you have to decide how you're going to handle all the excess power that threatens to toss you over.

Barker could have headed up, accelerated in a straighter line to keep the bows from diving. This actually compounds the danger if it doesn't work, which I won't go into here. His team also could have dumped power from the sails by stalling them. Stalling or luffing can be very complicated to do in extreme conditions at high speed, especially as it can cause the boat to lose stability.

The bottom line is Barker had several options and he turned a surprise into a strategy by keeping the boat flat enough that he could blast out of the water with speed after a dive instead of careening sideways. Fantastic boat handling married to fantastic engineering. Sideways would have been a disaster. Here's what happened to Artemis in an AC45 race last year. Watch at 1:10

So we've covered some of the engineering and some of the boat handling (and trim) involved. What about feelings? The sensation of a pitch-pole is absolutely terrifying. It happens so fast you can barely process what is going on. Here's an ETNZ team member recollection on SailingWorld

“I’m on the forward pedestal and was holding on for dear life,” McAsey said. “I was the second guy under water, with Jeremy Lomas in front of me. I was holding on as hard as I could. It all was a blur, everything’s wet and white, you come up, there’s a bit of broken carbon around the place and we’re two guys short. From there on it was just a matter of trying to cover the two guys lost.

Exactly right. One second you're dry, flying and focused the next second you are blasted in the face by icy frothing salt-water and have no idea what is going on. The key to his story is probably the pedestal. My guess is he held that thing with a death grip as soon as the first drop of water touched his skin.

Keep in mind these sailors are the peak of professional athlete fitness. They train twice a day in the gym and have the strongest grip strength you can imagine. But things happen so fast, things get so slippery and cold, and everything can get turned around in tons of water hitting you at 40knts.

One time on my boat in a race I buried the bows so hard, so fast into the back of a giant wave that I was fired like a missile straight off the boat. I was sailing smoothly one minute and then BAM I'm three feet under water and trying to figure out which way is up.

A catamaran going from fast to slow quickly means it stops and you keep moving. There are no seat belts because you have to be able to move around. And that can mean you bounce off hard and often sharp carbon parts and line, and end up totally disoriented without vision or hearing…and dealing with the shock of rapid temperature change.

It hurts A LOT. I don't bruise, ever, but one time I hit a wave so hard the boat stopped and I slammed into the back of a razor-sharp windward foil. It gave me a giant green, blue and black bruise on my thigh for weeks. Hanging on to a pedestal is far better option than getting catapulted, washed away or sliced into pieces.

So much to talk about. This tiny little snippet of sailing in the Cup could instantly bring up a ton of background and detail. Yet the "official" and only announcers just repeated "oh my gosh" and statements of the obvious.

Where is our John Madden of sailing? Can't the organization find a seasoned and colorful catamaran sailor to fill in the commentary? I can think of so many, I have to wonder how the current announcers were chosen.

Posted in Sailing, Security.


3 Realities of Big Data Security

HD Moore has been quoted extensively in an article called "3 Inconvenient Truths About Big Data In Security Analysis". I found it interesting although not quite on target. Here is a possible dose of reality for his three inconveniences. I've kept his paragraph headers the same for clarity:

1. "Big Data Isn't Magic"

HD tells us:

"People say if you have all of your data in one place, you'll magically get the security benefit. That's not true," he says.

You know what else I bet is not true? That someone actually said "you'll magically get the security benefit". Sounds like HD had to prop up a straw-man argument in order to show us a knock-out argument.

Aside from that logical fallacy, I'll discuss his more subtle point hiding behind the straw-man. Sales people are prone to making exaggerated claims.

HD is right. Finding meaningful insight in data is called a "science" for a reason. The complexity was highlighted recently at a presentation by SriSatish Ambati of 0xdata of an "open source math and prediction engine". The presentation was called "Data Science is NOT Rocket Science" and about five minutes into the presentation a heckler in the audience yelled out "What was the title of this talk? I feel like I'm about to launch a rocket."

Clearly even very intelligent and well-intentioned people are prone to overstate speed of value and ease of working with Big Data. However, this is where I disagree with HD. People are trying to market Big Data as easier than it is because they may actually believe it is NOT magic. Have you ever had a math professor say the subject is easy? They are not telling you it is magic.

To put this in perspective of other areas of science, Einstein was one of the biggest proponents of creativity and simplicity.

I know quite certainly that I myself have no special talent; curiosity, obsession and dogged endurance, combined with self-criticism have brought me to my ideas.

So if you are a company trying to sell Big Data, you are in the business of selling simplicity out of complexity. Perhaps if someone does not believe in science they would think they are being sold magic. Einstein's point, that a transformation from the complex to simple requires an investment, is pretty-much the opposite of magic.

Should everyone really have to understand how results were achieved for our results to have value? I say no. Results have to be scientific, something that can be verified independently; I don't think being unfamiliar with science means magic is the only other option.

HD himself reveals this when he calls for investment.

"So just be careful about where you invest, and make sure that if you are investing in a data analytics tool, you at least have one body sitting in front of it and you're investing just as much in people as you are in the process," he says.

At least one body? I disagree with that principle. It's too vague to have meaning. What is that person doing? Robert Pirsig's Zen and Art of Motorcycle Maintenance explores this dilemma at length but to put it briefly, some pay BMW a lot of money because they really have no idea how to build a motorcycle of their own. This does not mean they dedicate at least one body. They hire a mechanic as necessary, on demand.

So if HD had said make sure you have at least one person riding a motorcycle, ok fine I agree. Instead he seems to be saying make sure you have at least one mechanic on every motorcycle along with you as you ride it…

I do not disagree with a premise that you should invest wisely in people and process and technology to get the most benefit. Rather, I disagree that everyone has to peel back the covers on everything all the time (they instead can invest fractionally in someone else to do that for them) and…I also would like to see at least one example of someone who actually says Big Data is magic.

2. "Putting All Our Eggs In One Rickety Basket"

HD has a very good point here and takes it too far. This is the usual security professional lament to management: please verify that you can trust an environment. Put as a question: why and how should we trust any Big Data "basket"?

"We see a lot of stuff in development around big data toolkits — things like Mongo and Cassandra — and there's not a lot of security built into these tools," he says. For example, MongoDB doesn't support SSL by default, and there isn't the same level of security offered in similar tools as more established traditional relational databases. "It's actually pretty frightening how insecure these tools are by default, yet they're becoming the back-end for most of the big data services being sold today."

Not frightening. Expected. New technology is often developed with priorities higher than security. Who is really surprised to read "stuff in development" and "not a lot of security built into" within the same sentence. What is frightening is that people would use this new technology without considering the risks. To put it more clearly we can see Hadoop continue to gain popularity, despite missing familiar controls such as communication encryption, as we leverage broader risk management strategies.

"You're making these really juicy targets for someone to go after. Everyone kind of cringes when we look at some of those big password breaches in the past, but that's nothing compared to a multiterabyte data leak."

Telling executive management at some organizations that they have become a "really juicy target" might be taken as proof of success. After all, what is more successful than having assets of high value? And who said after a big password breach in the past "you know what, we should never again put our passwords in one place"?

Back to reality: First, some security controls are essentially impossible to implement in Hadoop so a business may have no choice but to move ahead after weighing risk of failure. Having no basket for eggs is in fact a worse option for some than having just one basket. I'm not advocating one basket, quite the opposite, but I'm saying there's a cost associated with zero baskets. Second, perimeters and bastions make internal communication encryption far less important. We're seeing some amazingly tight environments built because data owners know that they need a protected data lake to secure against unauthorized use. This is expensive, but it's an option that allows a really juicy target to exist. Third, data processed does not have to be sensitive (although the definition of sensitive changes dramatically in Big Data environments). The juiciness of eggs (hey, it's HD's analogy, I don't like it either) can be controlled when the environment can not.

3. "Law of Averages Says An Analytics Provider Breach Is Coming"

This is the grand finale of HD analysis, where he tells us the impact of the first two problems, and it seems to backfire.

"One thing that's almost guaranteed to happen in the next year is we're going to see one of the large providers of analytics services — whether security, log data, or something else — get breached," he says. "It's just the law of averages at this point. There's enough folks offering services who don’t necessarily know what they're doing that we're going to see a big breach."

Saying there will be a big breach within twelve months does not sound like Bernoulli's "law of averages". To me it sounds like a statement of the obvious. Almost every breach report I read indicates hundreds of breaches per year. Verizon in 2013, for example, issued a one-year report that starts with "621 Confirmed Data Breaches Studied". So if I were a betting man I would say a big breach will come in the next 30 days…ok, 24 hours.

But seriously, it seems to me that predicting a "big breach within a year" is not the kind of statement that moves anyone to react quickly on an issue. HD said above in #2 that things are "actually pretty frightening" and yet he warns we have 8,766 hours before impact?

Most people will probably hedge their bets or adopt a wait-and-see response when told they are 12 months from impact. "Put that in the budget for next year" would be a lucky result.

Perhaps more importantly HD fails to mention why anyone would be required to report a Big Data breach to the public. Unless regulated data is in these environments, or someone external is affected, then what obligation is there to make the breach "seen" by us?

The Big Data examples he provides us ("whether security, log data…") does not impact anyone external to the victim and has no legal requirement for disclosure.

Posted in Security.


Guide to VMworld 2013: Trust

Trusted IT (or Trust for short) is a big topic this year at VMworld, especially with the recent release of Log Insight. Here is a sample of sessions related to Trust and that you can find online in the conference agenda.

Out of 590 total sessions

Availability (28 sessions, 13 speakers)
Security (72 sessions, 49 speakers)
Compliance (24 sessions, 6 speakers)
Data Protection (19 sessions, 6 speakers)

Availability
========
BCO1000-GD – High Availability with Duncan Epping and Keith Farkas
BCO1001-GD – Stretched Clusters for Availability with Lee Dilworth
BCO5047 – vSphere High Availability – What's New and Best Practices
BCO5065 – VMware vSphere Fault Tolerance for Multiprocessor Virtual Machines – Technical Preview
BCO5160/2 – Implementing a Holistic BC/DR Strategy with VMware – Part One and Part Two
BCO5276 – Next Generation ‘Economical’ Data Protection for Business-Critical Applications
EUC5805 – Why Delivering Cloud-based Clinical Workspaces Makes Perfect Sense for Healthcare
SEC6850 – Achieving Security Agility in the Virtual Data Center
VCM5577 – Ensuring Clinical Trial Patient Safety with vCenter Operations Management
VCM7369-S – Uncovering the Hidden Truth in Log Data With vCenter Log Insight

Security
======
GS-MON – General Session – Monday – Gelsinger GS-TUE – General Session – Tuesday – Eschenbach
EUC5143 – Is 911 a Joke in Your Network? – How VDI Can Improve Threat Response
EUC5196 – Secure Mobility – FIPS, CAC and Beyond
EUC5369 – Beaufort Memorial Hospital Enhances Patient Care with Secure Mobile Solutions
EUC5805 – Why Delivering Cloud-based Clinical Workspaces Makes Perfect Sense for Healthcare
HOL-HBD-1302 – vCloud Hybrid Service – Networking & Security
HOL-HBD-1303 – vCloud Hybrid Service – Manage Your Cloud
HOL-PRT-1306 – Catbird-Hytrust-LogRhythm – Partner Security and Compliance
HOL-SDC-1315 – vCloud Suite Use Cases – Control & Compliance
NET1001-GD – vCloud Networking and Security & NSX for VMware Environments with Ray Budavari
NET5522 – VMware NSX Extensibility: Network and Security Services from 3rd-Party Vendors
OPT4968 – US Air National Guard – DoD Private Cloud Initiative – How Virtualization Saved $45 Million in Power\Cooling and Life Cycle Management
PHC5120 – Why Hackers are Winning and What Virtualization & Cloud Can Do About It
PHC5070 – vCloud Hybrid Service Jump Start Part One of Five: vCloud Hybrid Service: Architecture and Consumption Principles
PHC5409 – vCloud Hybrid Service Jump Start Part Two of Five: vCloud Hybrid Service: Networking and Security Basics
PHC5488 – vCloud Hybrid Service Jump Start Part Three of Five: vCloud Hybrid Service: Advanced Networking and Security
SEC1003-GD – Network Security Services New Model for IPS, URL Filtering, Forensics in the SDDC with Anirban Sengupta
SEC1004-GD – Agentless Security Antivirus, Vulnerability Management, File Integrity Monitoring in the SDDC with Azeem Feroz
SEC5168 – Dynamic or Dud? Why Software-Defined Data Centers Need Dynamic Security
SEC5178 – Motivations and Solution Components for Enabling Trusted Geolocation in the Cloud – A Panel Discussion on NIST Reference Architecture (IR 7904)
SEC5253 – Get on with Business – VMware Reference Architectures Help Streamline Compliance Efforts
SEC5318 – NSX Security Solutions In Action – Deploying, Troubleshooting, and Monitoring for VMware NSX Service Composer
SEC5749 – Introducing NSX Service Composer: The New Consumption Model for Security Services in the SDDC
SEC5750 – Security Automation Workflows with NSX
SEC5755 – VMware NSX with Next-Generation Security by Palo Alto Networks
SEC5889 – Troubleshooting and Monitoring NSX Service Composer (and Partner) Policies
SEC5894 – Deploying, Troubleshooting, and Monitoring VMware NSX Distributed Firewall
SEC5891 – Technical Deep Dive: Build a Collapsed DMZ Architecture for Optimal Scale and Performance Based on NSX Firewall Services
SEC6850 – Achieving Security Agility in the Virtual Data Center
STP1015 – Is Your Data Center Smart? – Improving the Security and Performance of Virtualized Environments through a Data Center Operating System
STP1018 – Secure and Monitor Sensitive Assets in Your Virtual Infrastructure
STP1020 – Solving the security and compliance challenges of a true Enterprise cloud
TEX5667 – Case Study: VMware vCloud Ecosystem Framework for Network and Security Enables Network Services Virtualization
VCM6065 – How to Manage Security Levels and Infrastructure to Provide IaaS / PaaS / SaaS Services Based on a Single Virtual Infrastructure
VSVC1007-GD – Platform Security with Mike Foley
VCM1005-GD – Log Insight with Steve Flanders
VCM4445 – Deep Dive into vSphere Log Management with vCenter Log Insight
VCM4528 – Tips and Tricks with vCenter Log Insight (NEW!)
VCM5034 – Troubleshooting at Cox Communications with VMware vCenter Log Insight and vCenter Operations Management Suite VCM7369-S – Uncovering the Hidden Truth in Log Data With vCenter Log Insight

Compliance
=========
SEC5775 – NSX PCI Reference Architecture Workshop Session 1 – Segmentation
SEC5820 – NSX PCI Reference Architecture Workshop Session 2 – Privileged User Control
SEC5837 – NSX PCI Reference Architecture Workshop Session 3 – Operational Efficiencies
BCO5829 – Drying Out After Hurricane Sandy: Leveraging vCloud Director and Other Cloud Enablement Tools for Simpler, Faster DR Operations
EUC5196 – Secure Mobility – FIPS, CAC and Beyond
OPT5887 – How Does VMware Uniquely Enable Leaders in Healthcare Electronic Medical Records to Improve Quality of Care and Meet Unique Industry Requirements
HOL-SDC-1315 – vCloud Suite Use Cases – Control & Compliance
PHC5679 – Protecting Enterprise Workloads Within a vCloud Service Provider Environment
SEC1001-GD – Activity Monitoring Visibility into Users, Applications for Compliance Troubleshooting with Mitch Christensen
SEC1002-GD – Compliance Reference Architecture: Integrating Firewall Antivirus, Logging IPS in the SDDC with Allen Shortnacy
SEC5253 – Get on with Business – VMware Reference Architectures Help Streamline Compliance Efforts
SEC5428 – VMware Compliance Reference Architecture Framework Overview
SEC5589 – Healthcare Customer Case Study: Maintaining PCI, HIPAA and HITECH Compliance in Virtualized Infrastructure
VCM4838 – Automating IT Configuration and Compliance Management for Your Cloud

Data Protection
============
BCO1002-GD – Data Protection and Backup with Jeff Hunter
BCO4756 – VMware vSphere Data Protection (VDP) Technical Deep Dive And Troubleshooting Session
BCO5041 – vSphere Data Protection – What's New and Technical Walkthrough
BCO5160 – Implementing a Holistic BC/DR Strategy with VMware – Part One
BCO5162 – Implementing a Holistic BC/DR Strategy with VMware – Part Two
BCO5276 – Next Generation ‘Economical’ Data Protection for Business-Critical Applications
BCO5851 – VMware Backups That Work – Lessons Learned and Backup Performance Tuning Based on Extensive VADP Benchmark Testing
BCO5855 – Leveraging Advanced Storage Capabilities To Meet Today’s Virtual Environment SLAs
HOL-SDC-1305 – Business Continuity and Disaster Recovery In Action
PAR6413 – Capturing the Backup and Disaster Recovery Opportunity with VMware
PHC5679 – Protecting Enterprise Workloads Within a vCloud Service Provider Environment

Posted in Security.


AC34 Team Oracle Caught Cheating…Again

This is the third incident, as far as I can tell. The first incident, spying on competitor designs, resulted in a penalty for Oracle. The second incident was when Oracle tried to use the Artemis incident to force competitors to change their design, and was rebuffed. Now Oracle is accused of yet another design-related incident.

Skipper Max Sirena of Italy's Luna Rossa is the latest America's Cup competitor to accuse defending champion Oracle Team USA of cheating in what potentially could be one of the biggest scandals in the regatta's 162-year history

As I've said before it's obvious Oracle's design is inferior. Team New Zealand has out-innovated the American team and Oracle is cheating to try and catch up.

There is irony in these incidents. The Oracle captain recently said in an interview that their design changes were done, they were focused on sailing. In fact, he emphasized that making design changes at this late date could interfere with his ability to focus and become a better sailor; arguing that design change could actually have a trade-off or hurt their chances.

There also is a question of what Team Oracle management is going to do about being caught cheating on design, yet again. Here's how their CEO has responded:

"I don't think it's right that if a few people break a rule on a team of 130 people, that the whole team gets branded as cheats," Coutts said in his first public comments in the week since Oracle announced that it was forfeiting its overall championships from the first two seasons of the ACWS after the violations were discovered.

[...]

Coutts used the latest performance enhancement drug scandal in Major League Baseball as an analogy, saying that if certain players were suspended, "does that mean the whole team are cheaters? I don't think that's right to draw that conclusion."

That is an interesting ethical question for the CEO to pose. I would rather hear him say "I take responsibility for the actions of my team" or "I am in charge and this is unacceptable, this will not be tolerated and will not happen again."

Instead, we hear that Team America is going to play victim to their own team? In risk management terms, that should be a giant red flag. This is precisely why the U.S. government moved forward the Sarbanes-Oxley regulation. Too many CEOs had claimed they had no idea about fraud under their watch and objected to "the whole team" being branded cheaters.

It is possible that some rogue member of the team was acting independently. That seems unlikely given that it is not an isolated incident. It also seems unlikely, given the response from the CEO is to play victim and tell other teams to stop pointing fingers.

I don't think it's right that other teams should use this as an orchestrated PR campaign to slander another team when there's a jury process going on and the facts haven't been established.

Strange perspective. Cheating doesn't require PR orchestration. Fraud doesn't require PR orchestration. When it's discovered, when an investigation begins, the expectation and the norm is negative press. It would require orchestration to do the opposite, for competitors to be complimentary and supportive; to say "don't judge" or "don't blame management, everyone has bad apples".

More to the point when the CEO of UCLA tried to say that patient privacy breaches were the result of isolated staff it turned out to be exactly the opposite. A sting operation by Farah Fawcett and her Doctor proved that management wasn't taking responsibility. Widespread and systemic security failures continued despite firing "isolated staff". Eventually outside investigators were brought in and not long after the state of California passed two new laws to hold executive management accountable.

The sad fact is Team Oracle management is not talking about how they abhor cheating or how they will stake their reputation on a fair game. They are most likely trying to cheat their way through a design failure. They've tried spying, they've tried blocking the other designs, and now they're accused of making unauthorized changes.

After decades of Americans trying to hold top management accountable for the actions of their entire team, it is the statements by the CEO of Team Oracle that are making America look bad.

Coutts admitted last week that someone with the syndicate illegally placed weights in the bows of three 45-foot catamarans without the knowledge of the skippers or management. One of the boats was loaned to Olympic star Ben Ainslie, who is sailing with Oracle Team USA this summer in hopes of launching a British challenge for the 35th America's Cup.

Coutts said then that it was "a ridiculous mistake" because the weights "didn't affect the performance." Oracle forfeited its results from the four ACWS regattas in question, and its two overall season championships.

Someone made a mistake. Don't blame the team. There was no real need to cheat. These are not phrases that engender trust. Quite the opposite, they lead to distrust of management.

Coutts' risk approach does not sound far from what the utility industry once used to skirt regulations — hire a "designated felon" to the team. A CEO could claim she/he was "without the knowledge" of violations and basically pay someone else to go to jail or take the fall on their behalf.

Posted in Sailing, Security.


#AC34Fatigue "Look at My Penis Go"

Seems like most people I run into lately in SF ask me what I think of the America's Cup. Maybe it's a generic conversation starter. I take it as a serious question. Usually the conversation centers around the lack of public interest, the huge amount of money…

I thought it was hard to sum up the event until a friend described it like this:

It's a "Look At My Penis Go!" event

That, in a nutshell, is what we have now. Who wants to watch? Oracle seems to have created a giant embarrassment.

But seriously, the sailing community has left the show, the general public isn't coming. Some members of the teams even tell the public the event for them is "like being in jail"…so what is going on? Here's a few guesses based on recent experience.

Sailing community

Ellison told the esteemed St Francis Yacht Club many years ago he wanted to take over and run the Cup his way. When the local club balked at total-control negotiation, he walked a few steps to the next club. Golden Gate actually heard the fight and invited him over. Golden Gate openly admits they did it for the money; Ellison could do whatever he wanted if he gave them enough money to stay open.

Some have tried to describe this union as a poor guy and a rich guy working together, or the community working with a big company; but everyone knows Oracle doesn't play that way. They took the place over and run it their way.

Oracle's split from the St Francis community could have been a chance to pressure an old stodgy club to become more relevant to experimentation and innovation, becoming more inclusive. That would have been interesting. Instead, it looks like Ellison fell out with them for the opposite reason. St Francis is not exclusive enough — it has people he doesn't want to listen to!

It's perhaps worth adding here that when the AC45 were racing in front of the St. Francis clubhouse I walked up to the entrance with my reciprocal membership card in hand. A old man at the door stopped me and said "sorry, when the America's Cup is here we don't honor reciprocal membership status."

Annoyed but not dissuaded I walked 100 feet away and sat on the rocks by the water with 100s of other people gathering. Soon I became the unofficial announcer for the shoreline. I explained why China's roundings were slow and uncoordinated, people asked me for blow-by-blow sports-casting…it turned out to be an amazing experience helping the public understand what was happening.

The strangest part of all, perhaps, is when a guy I had sailed with on long-distance coastal races walked up (he was rejected from St. Francis also) and started to ask me about the dynamics of multi-hull speed and handling. I realized at that moment the most experienced, seasoned mono-hull racers didn't see what I could see after years of racing an A-Cat. We became a sort-of sports-cast team, he would ask general sailboat racing questions and I would color with specifics and stories. The crowd loved it.

Who is the Steve Madden of sailing? We need one. Someone funny, who gets the game, who speaks at the common person's level; someone who can't be and doesn't want to be locked up inside some exclusive club for hat-less VIPs. The club commodore since then (perhaps after realizing there was low demand) has sent a letter inviting us lowly reciprocal members to come visit during the races.

After the club denied me access I had a great time sharing the Cup experience outside with the unwashed, the uninitiated, the non-sailors. There was no sailing community connection. Even professional sailors I contacted to come watch at the club were off sailing in other events, unimpressed with the AC34 races.

General public

Number 3 (just behind LA and Muni) in the list of Things SF Love to Hate is Larry Ellison:

There really aren’t many beloved billionaire CEOs out there, but the Oracle one takes the booby prize. If his lavish lifestyle and conspicuous mansions weren’t enough to sour his standing in the city, Ellison’s campaign to bring the America’s Cup to town has done the trick. There’s been more headache than economic benefit from the Cup so far.

I walked down to the waterfront recently. A very active and respected member of the local sailing community asked me to have lunch. As I arrived, an AC72 ambled in the water nearby. There was no crowd. The general public simply didn't come.

He was looking out across the empty water when I asked "what happened to race day". He laughed and said "We hoped for twelve boats but with only four total and three working…nobody wants to watch a race of one. Today is no different than any other day — there you see a boat sailing on the Bay. The crowds won't come. So let's eat…"

Insiders

To put it bluntly, I was invited to the America's Cup backstage. I brought with me someone instrumental to America's Cup history and present success — a legend in sailboat racing. I was honored to be there with him. In fact, I couldn't believe this was happening.

For 30 seconds it was momentous, as if my entire life of sailing had led up to this moment. We arrived and shook hands with an official of the AC34 sales team. And then we were asked…"have you ever heard of the America's Cup before?"

*screeching record needle*

Awkward. We then were told by this used-car salesman looking guy with a giant diamond ring and popped white collar that the Cup is under new management and they're doing things right now — they are lining up a target audience of "generic sports enthusiasts who can pay $40K for exclusivity seats and don't really care what they're watching."

*car driving off cliff and exploding fireballs*

I flew out of that meeting like an AC72 downwind in the Bay on an August afternoon. St Francis seemed quaint and community-focused compared to this nauseating group that stood for what? Where did the love of sailing go? Who was this idiot talking with me (I still have his card) and his sidekick (she later turned her back on us, literally, to give us the sign we should leave).

Don't get me wrong, I love the America's Cup, I love sailing. In fact, my entire house has been decorated for decades with the history of America's Cup contenders (Tommy Sopwith's 1934 Endeavour, Vanderbilt's 1903 Reliance, the amazing Enterprise of 1930). And I've grown up sailing, and been fortunate enough to have sailed with and raced against many of the people working on the current campaigns.

In fact, I may still write up a detailed explanation of how the boats work, the amazing transformation in technology and teams, or do some impromptu race commentary. There's so much to talk about.

But WTF Larry? We're losing the audience, including me.

Posted in History, Sailing, Security.


Update: Putting and End to the End of Active Defense

I recently read an article, “Putting an end to ‘strike back’ / ‘active defense’ debate…”, and another it linked to, “Managing The Legal Risks Of Active Defense,” wherein my friend Bob Clark was quoted.  Here is my response: 

Why in the world would we end the debate?  Security sucks and the bad guys have a huge advantage.  Our hands are tied.  Any debate that moves the discussion forward is a good thing. 

In the first article a guy calling himself Jericho chastises those who advocate Active Defense.  He equates it to strike back and hack back.  I have to say, I agree with two of his points; many companies are now trying to capitalize on this new term, yes new term, by offering what they call active defense or hack back tools.  In many cases this advertising is deceptive since the tools merely offer the same old software defenses under a new name.  I also agree that if your defenses don’t meet the basic standard, Active Defense is not an option.

I disagree with is his characterization of Active Defense.  I wish people would stop equating it to hack back.  Hack back is the last 1% of Active Defense.  See my definition here: http://www.titaninfosecuritygroup.com/_m1698/blog/Active-Defense-definition

It is a method for companies who find themselves persistently attacked to collect the intelligence needed to evaluate the attacks, develop courses of action or options, and then enable the leadership to make well-informed decisions to move forward in an effort to protect the company.

On a spectrum the options could be anywhere from do nothing or the other extreme of hack back to either find the attackers or disrupt or deny the server(s) being used to launch the attacks. The intelligence collected will allow company leadership to make decisions at pre-determined checkpoints based on risk, liability and legal issues.

The initial decision whether to simply proceed with incident response versus Active Defense is based on determining whether the attack is a one-time incident or persistent, and how much money is being lost since. Active Defense will require the company to bring in a team of experts to accomplish the various tasks: intel collection, malware analysis, tool/technique development, evaluating legal, risk and liability issues, and therefore the cost involved must be weighed against the damage to the company or loss due to the attacks.

Also, I disagree with the many people who write in opposition to Active Defense and make broad statements about how it is illegal without defining Active Defense or detailing what they believe to be illegal or why.  If you’re not an attorney stop saying it is illegal because the legality of Active Defense is not black and white. 

Jericho’s assertions strike me as hypocritical by jumping on the bandwagon of the Active Defense flurry, making broad assertions and offering NO solutions.  If defense is so easy then provide the solution, a solution that hasn’t been tried and one that will work and not subverted by hackers within a few months.  Second, see my friend Davi’s response, here: "Putting and End to the End of Active Defense".  Good luck.

As for the article in which my friend Bob is quoted, I agree with Bob, for the most part.  You need a team of experts who know what they are doing, to include one or more attorneys who know what he/she is doing, but more than just an attorney you believe you can explain the technology to. 

This is not the kind of stuff you can just brush up on over the weekend.  This takes years of experience to understand the technology, apply the law and foresee the results or consequences.  Don’t believe it?  Ask your lawyer if he/she would be willing to put their law license on the line and provide advice in cyber security, hack back, the CFAA, ECPA, trace back, open-source collection, etc. 

What I disagree with is his comment that this is a no-win situation.  If you are a company owner and losing a lot of money or intellectual property, have tried everything else, and the attacks continue, you have a fiduciary responsibility to do something and self-defense may be your only option. 

Now, this does not mean jumping right to hack back.  My definition for Active Defense and what it entails is at the link above.  What it does mean is following a process, similar to incident response on steroids, and as the company leadership making critical decisions to protect the company.  In the end it may mean taking actions in self-defense and blocking or disrupting a CnC server or deleting your IP on a compromised server.  These options though are merely that, options in a process that requires a lot of Intel, thought and decision-making.

So, keep the debate going and don’t dismiss Active Defense as a no-win situation or illegal activity.

Posted in Security.

Tagged with , , , , , , , , , , .


Putting and End to the End of Active Defense

Today jerichoattrition wrote a provocative blog post called "Putting an end to ‘strike back’ / ‘active defense’ debate…" The magic phrase offered is this:

Ending the Debate In One Easy Line

If a company can’t do defense correctly, why do you think they can do offense right?

That simple, that logical.

Security experts are fond of saying security is a process not a destination. Continuous improvement is the aim, like balancing a bicycle, rather than aiming for a specific event and calling it done.

It is similar to keeping healthy or fit. As soon as you achieve a goal you set another and continue with your measurements and training.

But what if we could find a secret formula to settle our debates about security once and for all? What if we could utter one magical phrase to make everyone see things the way we see them — our vision of security as the final destination. Would anyone want that?

Sounds like a Twilight Zone episode to me. Someone wishes everyone would stop debating and just agree. Then, as soon as this dream comes true, the protagonist realizes a giant mistake has been made.

The camera pulls back and we see a man running frantically through the street, begging someone, anyone to debate or disagree. Instead, surrounded by smiling faces all he hears is "I agree!"

I agree. I agree...
I agree! I agree!

Do we really want that? What is simple or logical about saying good offense depends on good defense? This debate is far from over and that's a good thing…

Jericho's post does not explain away the fact that the two can be, and often are, mutually exclusive. The very foundation of a deterrence policy, for example, is an offense so effective that defensive capability becomes less relevant.

I'm tempted to point out the many sports teams with good offense and bad defense.

Instead, sticking with IT, a large enterprise that struggles to upgrade defenses still can have an effective offensive team. An offensive team in fact may be built faster/better/stronger to focus back on the enterprise itself to help pinpoint and improve slower/worse/weaker defenses.

Defense often is saddled with dependencies, depreciation issues, complexity, politics, etc.. Meanwhile an offensive team can quickly come directly into modern and advanced capabilities. In other words, building a highly effective offensive team is sometimes a strategic investment that can push an ineffective defensive team ahead.

A mismatch, with a better offensive team, means flaws can be found with visibility into risk posture, blasting through obstacles that held back better defense investments. This imbalance should be no stretch of imagination. It's common and has been happening for many years. Think of it as a football team that pits its lagging defense against its own top-ranked offensive line to pinpoint holes and improve defensive capabilities. Companies are hiring top red-team talent even when their blue-teams aren't top tier.

Back to the point of active defense, a highly-effective offensive team that is better than a defensive team simply could switch focus towards targets outside. That is why it is easy to see how a company that can't do defense right can do offense right.

The blog post also tries to warn us of a lack of solid definition for "active defense."

…note that recon is not ‘defense’. By port scanning, pinging, or tracerouting the remote system that attacked you, it does not help you defend your network. It is the first stage of an active response. Strictly based on the terminology of “active defense”, activity such as changing a configuration or creating real-time decoys to increase the cost of attack. Even today’s news, covering an entire talk on the legal risks of “active defense”, does not even define the term.

Recon is a part of defense, "it is the first stage", but it is not alone a defense. Agreed. But why are we worried that the definition isn't easy? That seems normal to me. Or why worry that a definition isn't found in one talk?

After reading the post I see more room for debate, more uncertainty and fear without solid explanation or supporting argument. Here are just four examples from where debate can easily continue:

If you can easily and positively attribute, they shouldn’t have breached your defenses. You have no business attacking them when you were negligent on defense 101.

Containment is more complicated than this view. Attribution may come later, as part of a decision process for limiting damage. Whether easy and positive attribution could be found within 1 minute or 1 day they would be post breach. Not every breach can be anticipated, which is why a common phrase responders use is "always prepared, never ready".

If you think you can positively attribute, you cannot, you are out of your element.

Again, overly simplistic view. Attribution is hard for some, easier for others. Hiding is effective for some, impossible for others. Most important is that practice makes attribution more accurate and there are many public cases of positive/successful attribution.

Even if you can miraculously attribute the human at the keyboard, regardless of how many hops back, you cannot positively attribute who hired them to hack you.

This is a decision-point rather than a dis-incentive. Responders can positively attribute deeper than just front line attacks. Anti-mob and anti-terror efforts reach source all the time. We can be just as effective.

If you attribute the person, and not the motive, by hacking back, you violated the law just as they did.

I have to point out here that legal advice from a non-lawyer is specious. Meet with a lawyer if you want to know when and how you will violate the law. As David Willson has written on this blog and presented many times, active defense is not a crime.

Posted in Security.


Red Means Go, Green Means Slow

While riding in late night taxis in Brazil I noticed they hit the accelerator through red lights. When we approached a green light, they would slow down and look around for people running the reds.

I had to ask why. The drivers said this is a risk mitigation strategy.

Because of assault danger, Brazilian drive through red traffic lights during night, just as a warning.

Since stopping at a red light, especially late at night, makes you an easy victim for car-jacking or robbery…we didn't stop.

And because everyone there knows drivers run red lights to stay safe, drivers with green lights slow down before crossing an intersection.

Just another example of why we should seriously reconsider stop-lights and their overall impact to risk (inefficiency of idling, yellow-light behavior, etc.)

Posted in Energy, Security.


The anti-virus age AIN'T over

Graham Sutherland wrote a provocative blog post titled "The anti-virus age is over." I hear this a lot and I often argue against it, as I did recently in a Twitter thread with @jeremiahg and @adamjodonnell.

I noticed Graham argues against his own title. His blog concludes:

Now don’t get me wrong, AV still has its place in the security world

Is an age over if there is still a place in the security world? I say no.

Cory Doctorow apparently does not come to the same conclusion, and instead used Sutherland's opening argument in his Boing Boing post called "When advanced black-hat hacking goes automatic, script kiddies turn into ninjas" to promote a fictional story of his own.

[The anti-virus age is over] was the premise and theme of my novella Knights of the Rainbow Table (also available as a free audiobook).

I confess I haven't read much by Doctorow since he ranted against American Airlines data collection practices. At that time I wrote the following response to his predicament:

I have always observed that wise travelers provide no more than the information that is directly relevant to the question being asked — the "most accurate" answer — which has neither too little nor too much detail. It's a fine balance, but part of the usual business of crossing International boundaries, obviously compounded by different cultural views of what constitutes suspicious or risky behavior.

Although I hate to question Doctorow's risk management vision again, it seems to me the anti-virus age will be over when we no longer see any place for anti-virus.

The age isn't over because our defense against polymorphic threats does not mean we should completely remove black-lists for non-polymorphic threats. Sutherland concedes this in the final text of his blog.

To put it another way, should we stop using seat-belts because we can get sick from bird-flu? Obviously not.

I tried to make this risk distinction in my 2012 RSA Conference presentation "Message in a Bottle: Finding Hope in a Sea of Security Breach Data." Here is how I laid out the age of seatbelts (sorry about the RSA template colors):

2012 RSA SF Conference Slide - Seatbelts

This view of history suggests to me that anti-virus software will become more integrated into the cost of our systems (like seat-belts became de-facto for cars and eventually a law). It will become less visible as it becomes integral.

So where are we headed? Analytic ability with data collection is what comes next, like air-bags were added to seatbelts. But the seatbelt analogy doesn't really work with intelligent, adaptive threats, as I also illustrated in my 2012 RSA Conference presentation (based on "Dr. John Snow's map-based spatial analysis and algorithm" for germ theory).

2012 RSA SF Conference Slide - Ghostmap

To follow Snow's footsteps our discretionary spend will shift towards data collection, anomaly detection and advanced response capabilities (e.g. big data security analysis). We will get better at finding and responding with new tools, while still using computer anti-virus and other old tools.

Posted in Security.