eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
This will be my fifth year in a row attending the annual RSA Security Conference in San Francisco and with the economy showing signs of life – particularly the IT security sector – I’m expecting that this year’s edition will be as fascinating and fast-paced as ever.
Now, other true industry vets may scoff at my five year’s being much of a sample size, comparatively speaking, but, I feel it’s given me a pretty good feel for the show nonetheless. Each year has its similarities and glaring differences, and it’s the latter in which everyone is always interested.
As I noted in my previous RSA blog, this year’s show has a decidedly strong government presence, but with the high-profile attacks carried out against everyone from the U.S. military to critical grid infrastructure providers, along with growing recognition that stopping the cyber-crime epidemic without greater international cooperation will be nearly impossible, I’m trusting that I won’t be the only attendee sporting a high-and-tight haircut.
The keynote panel is virtually a who’s who of federal cybersec management. Who knows, we might actually hear something that constitutes real policy change.
Beyond that phenomenon, it’s an interesting year for the industry to come together and size itself up. What the overriding trends that will emerge during the show will be in 2010 is hard to guess ahead of time, but, that won’t stop me from trying.
I’m clearly a little bit biased (based on my day job in vendor land) but I’m sensing that the proactive vulnerability management tide will continue to rise as organizations appear to have embraced the idea (in part driven by breaches, in part driven by regulations like PCI DSS) that they need to address the roots of their security problems, versus merely continuing to put up defenses.
The tie-up announced last week by HP and Fortify is one such example of this type of activity, and I know there will be other announcements made along these lines as providers of secure development, vulnerability assessment, remediation and security testing technologies continue to integrate to arm customers with more of an ecosystem to help identify and fix their biggest problems.
I’m curious to see what Microsoft will say, as always. RSA vet Scott Charney of the company’s Trustworthy Computing effort can clearly point to continued improvements made by the software giant every year, but, with zero day vulnerabilities such as the one that led to the “Aurora” campaign carried out against Google and others still one of the biggest issues out there, the company will have to reinforce its commitment.
Among the biggest security vendors, clearly, the story will be about integrating more tools into their products, as always, to provide integrated, centralized security management. However, what Mssrs. Coviello, DeWalt and Salem speak to specifically should give us a better idea of where their respective strategies (both in terms of building products and making acquisitions) should go over the rest of the year.
Personally I like the thrust of DeWalt’s keynote, that there is “no point” to IT security. Now clearly we can’t expect him to get up there and tell the audience that his company’s products are no longer worth buying or relevant, but I assume that he’s going to acknowledge that organizations can no longer look to point solutions, or focus on specific points of risk to best address their problems anymore.
I’m guessing his pitch will revolve around the need for organizations to continue to move their security efforts in a more holistic direction, engraining policies and defensive mechanisms further into almost everything that they do.
I’m curious to see, as always, what’s become of darlings of RSAs past. Will we still hear much about DLP, anything about NAC, and will this be the year that mobile device security finally takes off as the emergence of more open devices and platforms, and broader wireless adoption in general, create new points of risk?
It’s always amusing to see which vendors have stuck to their guns, changed their stripes or disappeared in attempting to keep up with the fickle tastes of the buying public.
You have to remember that there will be some research, and remain aware that someone could try to embarrass the entire industry by launching attacks while we’re all out in SF gabbing away about ourselves, as with the DNS assault campaign of two years ago.
That’s part of the fun, though, as twisted as it sounds. You never know what will happen at RSA, even if it’s not typically as crazy as Black Hat, CanSecWest, ShmooCon or any of the edgier research-driven shows.
Of course, a lot of the action will be away from the Moscone at the receptions, dinners and W Hotel’s XYZ Bar as people cut loose, celebrate and commiserate.
Five years in I can honestly say I’m as uncertain and curious as ever about what this year’s RSA Conference will actually bring.
See you there.
Follow eWeek Security Watch on Twitter at: eWeekSecWatch.
Matt Hines has been following the IT industry for over a decade as a reporter and blogger, and has been specifically focused on the security space since 2003, including a previous stint writing for eWeek and contributing to the Security Watch blog. Hines is currently employed as marketing communications manager at Core Security Technologies, a Boston-based maker of security testing software. The views expressed herein do not necessarily represent the views of Core Security, and neither the company, nor its products and services will be actively discussed in the blog. Please send news, research or tips to SecurityWatchBlog@gmail.com.