<html>
<head>
<meta http-equiv="content-type" content="text/html;
charset=ISO-8859-1">
</head>
<body bgcolor="#FFFFFF" text="#000000">
So this week was RSA. I can only stay a couple days at RSA, but I
have to admit it is really valuable if you want to spend 5 minutes
with various executives building ideas for partnerships. And on the
surface you can tell who's got money to throw around by the simple
size of their booth, like <a
href="http://www.youtube.com/watch?v=GPbWJPsBPdA">bower bird
buildings</a> but with more...endpoint protection. <br>
<br>
<img alt="RSA SYMANTEC"
src="cid:part2.05020007.00020004@immunityinc.com" height="270"
width="360"><br>
<br>
Above: The Symantec Scientology-like brainwashing center had to have
cost at least 500K to put together, but asking anyone how Symantec's
Reputation technology worked was futile.<br>
<br>
I talked to another hacker wandering the floor and we were both in
dismay at the giant sloshing sound of the money around technologies
we both knew self evidently didn't work. And until this morning
while my arm was being bent in unnatural directions I couldn't
figure out the ingredient MISSING from RSA. See, it is a truism in
man-wrestling that for every attack there is an escape, and for
every escape, a counter-attack. This is, of course, also trivially
true in information security. And if you spend all your time among
fellow hackers, you'll have a shared understanding of these things
in a way that makes it boring to talk about.<br>
<br>
But it's this essential grasp on basic strategy that's missing at
RSA. At one point I was sitting in the W bar drinking with a friend,
and next to us sat the VP of Engineering for FireEye, a company that
is doing hugely well (GIANT BOOTH) selling a 150000 appliance that
runs every email you have through a set of vulnerable, instrumented,
VMs, and then if an exploit triggers, it blocks the email. So, being
curious hackers, we asked him what VM hypervisor he used. And he
wouldn't say. <br>
<br>
And that right there - that's the problem. People think the problem
with AV is signatures, but signatures alone are not it. It's that
endpoint protection in general: heuristics, signatures, etc. only
work in cases where the attacker can't get access to the software.
They failed not at technology, but at strategy.<br>
<br>
Everything making tons of money at RSA is the exact same. Name one
VP of Engineering at RSA who would be comfortable with their
defensive technology working after being used by the attacking
community. FireEye, as the obvious example, only works because
attackers haven't spent the 150K to buy one. When they do, it's game
over. The RSA Conference is a massive celebration of security
through obscurity, and that's it. <br>
<br>
<img alt="RSA KEYNOTE"
src="cid:part3.07080108.00080808@immunityinc.com" height="270"
width="360"><br>
<br>
Above: RSA Keynote song of "We are the champions"<br>
<br>
-dave<br>
<br>
<br>
<br>
<br>
<br>
<br>
<pre class="moz-signature" cols="72">--
INFILTRATE - the world's best offensive information security conference.
April 2013 in Miami Beach
<a class="moz-txt-link-abbreviated" href="http://www.infiltratecon.com">www.infiltratecon.com</a>
</pre>
</body>
</html>