Posts RSS
Subscribe via Email
On Why I Blog… FUD is the Reason for the Writin’
Posted August 19th, 2008 by rybolov
This article at SC Magazine is exactly why. Kudos to Dan Philpott for calling the author on his errors.
Things that go through my mind about articles like this:
- Is it that slow of a news day? FISMA stuff is always good for a couple yucks when there’s nothing else to talk about. Looks like somebody needed filler while everybody was flying to Black Hat and DefCon.
- Once again, we’re confusing FISMA the law with the implementation thereof. Yawn.
- Ack, somebody who likes FDCC. Actually, I like it too in theory, I just don’t like the implementation.
- “Government has influence when it comes to awareness and will have opportunities to use it.” Um, yes, it’s the $75B IT budget, flex that muscle wherever you want to get the secure products you want. Do not underestimate the power of the budget.
- Follow the FISMA Naysayer and spot somebody who’s looking for money. In this case, it’s Fortify.
Funny thing is that I think I met the guy from Fortify a couple of months ago at a NoVa OWASP meeting for a showing of their fun-but-FUDtastic movie about application security. You know, you’ve seen the trailer, it looked like this:
There is a way to influence thinking in this town, and writing trash articles like this is not the way to do it. If Fortify really wants to change the world, I have some ideas on how to do it, but nobody ever asks. =)
FUD Truck Makes a Delivery photo by crmudgen23.
Guerilla CISO story time:
About 9 months ago, I got a marketing packet from Borderware. It said that “FooCorp is identified as sending spam” and offered me the opportunity to join their reputation service.
Looking at the materials they sent me, I deduced that none of the source IPs they listed was in our netblock and that what they were referring to was spam using @foocorp.com email addresses as the “from” address. Um, not a whole lot you can do to stop that, although it does make for some fun abuse@ emails from users who don’t understand how spam works: “Quit sending me this stuff, I’ll burn down your data center myself!!!111oneoneone”
Anyway, since the whole packet was pure FUD and not really relevant to anything I wanted to do, I sat down and sent an email to their Director of Marketing and CTO:
I know Borderware’s products, we use them in some of our solutions, and you have a good reputation. Please don’t resort to such a lowbrow marketing scheme because it sullies your brand.
I think Fortify is in the same boat. They have a good reputation–I have a friend who works for one of their biggest customers, and if he’s cool with it, I am.
But the question for all security companies remains: how do I sell my product without resorting to spreading FUD everywhere I go?
Similar Posts:
Posted in FISMA, Rants | 
6 Comments »
Tags: blog • cashcows • fdcc • fisma • FUD • government • infosec • moneymoneymoney • security
August 19th, 2008 at 11:22 am
I’d have said more but their comment system leaves something to be desired. How an article like that got into print is beyond me.
I am tempted to say it’s an example of the breakdown between the editorial and business sides of the source publication. But then that’s conspiratorial thinking. It is more likely the writer didn’t bother to identify actual FISMA subject matter experts. My first draft comment pointed out individuals they should have interviewed (rybolov and Patrick Howard).
August 19th, 2008 at 12:26 pm
Geez! Could these Bozos have gotten it more WRONG?
….but then I sully the reputation of Bozos the world over.
It’s good tht they identify the names of those dim bulbs who still believe FISMA’s all about paper, grades and products.
And Schmidt should know better — Accountability rests with the agency head. How many times did the VA Director have to sit at the green table withthe folded placard and photogs in front of him?
My namesake was a fan of sharpened sticks, but this is the 21st century…
Ths article is ponderous — I expect better from SC Magazine.
I couldn’t read past Schmidt’s comment without feeling like a person who’s attempted to run a mile whilst drinking a six pack.
(maybe a bit inside, but rybolov and I did recently witness such an event…)
August 19th, 2008 at 12:47 pm
There’s just SO much fertile ground (think of how it got that way) in this article…
“Schmidt cites as an example feedback after recently giving a speech. “People were commenting that we haven’t had major international events for four years. That shows we’re getting better at this and we are attacking vulnerabilities early.”
Hmmm… Chinese hackers, Titan Rain, etc. The Estonia DOS, Georgia v. Russia? The TJM debacle? Hardly international…
““There’s not enough sharing of information across agencies. You don’t know how many endpoints connect to the network. If we could share information across government agencies and have private sectors throw in technology knowledge, the results are unlimited,” he says.”
Ummm… you would know if you were doing C&A properly and actually READ the other Agency’s SSP or Interconnection Service Agreements! Or you would know that you’d never connect to a prospective partner unless that Agency had an SSP!
My favorite:
“Says Henry: “I don’t think the government will scrap FISMA, but it will morph into Department of Defense regulation points because FISMA itself is lax.”
BZZZT. Wrong. DoD and the Intelligence Community are moving toward adoption of FISMA and NIST standards/guidance precisely because they WORK. See the NIST announcement of 800-37 for proof.
On a lighter note:
rybolov, methinks the FUDmobile needs to turn up in ICANHAZFIZMA…
Man, I gotta stay away from the caffeine…
August 19th, 2008 at 2:08 pm
@Dan
Ah, you can always go add my name as an after-post, I would so groove on you for that.
@Vlad
You’re making entirely too much sense for a Tuesday.
You must be one of those paper-pushers that Rachwald was talking about. Hang your head in shame, Mr The Impaler. =)
Maybe your caffeine needs some additives?
August 19th, 2008 at 3:24 pm
@Vlad
Yeah way to much sense. Report cards and products are what people can understand, that’s why they matter.
If only there were a way to measure risk, and report on it in a meaningful way … hmmmm.
Send your caffeine to me, I’ll take good care of it.
August 19th, 2008 at 4:40 pm
Insulting your customers is always the best way to win them over!
Fortify’s Rachwald agrees that FISMA isn’t going anywhere, especially with the support of the paper shufflers.
“It’s been great for people who know how to fill out forms. Why would they want it to go away?”