Upcoming Talks At MobileWeek 2014 In NYC

I’ll be attending MobileWeek 2014 in New York City next Monday, April 13. I’m at the conference all day, so drop by and say hello. Part way through the day I’ll  deliver a 2-minute lightning talk on mobile authentication followed by a panel on enterprise mobile security and scalability.

The lightning talk is at 12:25 pm:

How To Make Mobile Authentication Dead Easy

Are your developers struggling to integrate mobile apps and enterprise data? They shouldn’t be! In just 2 minutes, learn the easiest way to get easy end-to-end security between your mobile apps and the enterprise—all without using a VPN.

It must be easy if I can cover it in only 2 minutes.

The panel starts at 1:10 (which is an odd time to start, so keep an eye on the clock). It includes participants from Hightail, and will be moderated by Geoff Domoracki, who is one of the conference founders:

The Mobile Enterprise: Productivity, Security and Scalability

We hear terms like “mobile enterprise” or “mobile workforce” – but how far are we to creating an enterprise work environment that enables real-time communication beyond geographic boundaries – freeing the employee to work from his phone anywhere in the world? This panel explores the opportunities and challenges around the emergence of a “mobile enterprise” where sitting at a desk in the office is becoming more and more out-dated. How do you share documents – secure data – prove identity – and geo-collaborate in the new mobile enterprise?

Overall it looks to be a good day. New York is a hot bed of mobile development, and I’m looking forward to meeting lots of interesting people.

See you at MobileWeek.

What We Should Learn From the Apple SSL Bug

Two years ago a paper appeared with the provocative title “The Most Dangerous Code in the World.” Its subject? SSL, the foundation for secure e-commerce. The world’s most dangerous software, it turns out, is a technology we all use on a more or less daily basis.

The problem the paper described wasn’t an issue with the SSL protocol, which is a solid and mature technology, but with the client libraries developers use to start a session. SSL is easy to use but you must be careful to set it up properly. The authors found that many developers aren’t so careful, leaving the protocol open to exploit. Most of these mistakes are elementary, such as not fully validating server certificates and trust chains.

Another dramatic example of the pitfalls of SSL emerged this last weekend as Apple issued a warning about an issue discovered in its own SSL libraries on iOS. The problem seems to come from a spurious goto fail statement that crept into the source code, likely the result of a bad copy/paste. Ironically, fail is exactly what this extra code did. Clients using the library failed to completely validate server certificates, leaving them vulnerable to exploit.

The problem should have been caught in QA; obviously, it wasn’t. The lesson to take away from here is not that Apple is bad—they responded quickly and efficiently the way they should—but that even the best of the best sometimes make mistakes. Security is just hard.

So if security is too hard, and people will always make mistakes, how should we protect ourselves? The answer is to simplify. Complexity is the enemy of good security because complexity masks problems. We need to build our security architectures on basic principles that promote peer-reviewed validation of configuration as well as continuous audit of operation.

Despite this very public failure, it is safe to rely on SSL as a security solution, but only if you configure it correctly. SSL is a mature technology, and it is unusual for problems to appear in libraries. But this weekend’s event does highlight the uncomfortable line of trust we necessarily draw with third party code. Obviously, we need to invest our trust carefully. But we also must recognize that bugs happen, and the real test is about how effectively we respond when exploits appear and patches become available. Simple architectures work to our favour when the zero-day clock starts ticking.

On Monday at the RSA Conference, CA Technologies announced the general availability of our new SDK for securing mobile transactions. We designed this SDK with one goal: to make API security simpler for mobile developers. We do this by automating the process of authentication, and setting up secure connections with API servers. If developers are freed up from tedious security programming, they are less likely to do something wrong—however simple the configuration may appear. In this way, developers can focus on building great apps, instead of worrying about security minutia.

In addition to offering secure authentication and communications, the SDK also provides secure single sign on (SSO) across mobile apps. Say the word SSO and most people instinctively picture one browser authenticating across many web servers. This common use case defined the term. But SSO can also be applied to the client apps on a mobile device. Apps are very independent in iOS and Android, and sharing information between them, such as an authentication context, is challenging. Our SDK does this automatically, and securely, providing a VPN-like experience for apps without the very negative user experience of mobile VPNs.

Let me assure you that this is not yet another opaque, proprietary security solution. Peel back the layers of this onion and you will find a standards-based OAuth+OpenID Connect implementation. We built this solution on top of the SecureSpan Gateway’s underlying PKI system and we leveraged this to provide increased levels of trust.

If you see me in the halls of the RSA Conference, don’t hesitate to stop me and ask for a demo. Or drop by the CA Technologies booth where we can show you this exciting new technology in action.

RSA Conference 2014 Preview And A Special CA Technologies/Layer 7 Event

Despite all our advances in communications—from social networking, to blogs, to actual functional video meetings—the trade conference is still a necessity. Maybe not as much for the content, which makes the rounds pretty fast regardless of whether you attend the show or not, but for the serendipitous meetings and social networking (in the pre-Facebook sense).

I find something comforting in the rhythm and structure a handful of annual conferences bring to my life. The best ones stay rooted in one location, occurring at the same time, year after year. They are as much defined by time and place as topic.

If it’s February, it must be San Francisco and the RSA conference. I’ve attended for years, and despite the draw from the simultaneous Mobile World Congress in Barcelona, RSA is a show I won’t skip. But I do wish MWC would bump itself a week in either direction so I could do both.

As everyone knows, this year the press made much ado of a few high profile boycotts of the conference and the two alt-cons, Security B-sides and TrustyCon, that sprung up in response. But I think it’s important to separate RSA the company from RSA the conference. The latter remains the most important security event of the year.

Every year, one theme rises above the rest. I’m not referring to the “official” theme, but the trends that appear spontaneously in the valley. The theme this year should be security analytics. The venture community put this idea on an aggressive regime of funding injections. We should expect an entertaining gallery of result good and bad. But either way, we will learn something, and it would be a poor move to bet against this sector’s future.

I’m also expecting 2014 to bring some real SDN traction. Traditional security infrastructure is low hanging fruit vendors too often miss. RSA is where SDNs for security will finally get a long awaited debut.

MWC may be the premier event for mobile, but most mobile security companies cover both, and CA is no exception. At RSA we’re showcasing our new Mobile Access Gateway (MAG). This features SDKs for iOS, Android, and JavaScript that make enterprise authentication simple for mobile developers.  As a bonus, this SDK offers cross app SSO. It means users sign on just once, from any authorized app. You should definitely come by the CA Technologies booth and have a look. And if you do see me at the show, be sure to ask me about the integrated PKI—surely one of the coolest, unsung features underneath the SDK hood.

CA and Layer 7 will host an afternoon event Monday Feb 24 at the nearby Marriott Marquis, and you are invited. You may recall we’ve held a few of these before, but this year, we have a very special guest. The event features Forrester Analyst Eve Maler, who will talk about Zero Trust and APIs. It is a great way to kick off the RSA 2014, and we’ll even give you a nice lunch. Who could refuse that?

To join us, sign up here.

New eBook: Five Simple Strategies For Securing Your APIs

Recently I wrote about the excitement I feel working within CA. This company is full of talented people, and when you draw on their capabilities, amazing stuff happens. Here in R&D we have some innovative solutions underway that are a tangible result of CA and Layer 7 working well together. I can’t reveal these yet, but you can see the same 1+1=3 equation at work in other groups throughout the organization.

Here is a good example. It’s an eBook we’ve assembled to help managers and developers build more secure APIs. The material started with a presentation I first delivered at a recent RSA show. We updated this with best practices developed by real customers facing real challenges. The content is solid, but what I love is the final product. It’s accessible, easy to digest, and the layout is fantastic. Half the battle is delivering the message so that it’s clear, approachable and actionable. This is just what we delivered. And best of all, it’s free.

The last year has been a difficult one in security. The Snowden affair made people talk about security; this, at least, is good and the dialog continues today. But if 2013 was a year of difficult revelation, 2014 is going to be about back-to-basics security.

APIs offer tremendous business value to enterprise computing. But they also represent a potential threat. You can manage this risk with a solid foundation and good basic practices, but you need to know where to start. This is the theme of our new eBook. It offers simple guidelines, not tied to a particular technology. You should apply these whenever you deploy APIs.

I hope you find this eBook useful. As always, I’d love to hear your feedback.

Download: Five Simple Strategies For Securing Your APIs.

Sex, Lies and Acquisitions

Has it really been almost a year since my last post? I suspected I was nearing that milestone, but it’s still surprising to discover it has been so long. Blogs have a natural ebb and flow, governed as much by the irregular rhythms of the day job as inspiration. But this was a pretty big ebb. Maybe catastrophic drought is a better metaphor.

Naturally, my absence was not lost on the spammers. That curious breed who prey on dormant blogs left me with a mountain of weirdly unctuous commentary that I needed to shovel out of the way just to get to the front door. But now that I’ve finally worked my way inside, it’s time to turn up the heat, blow out the cobwebs, and get back to work.

The story of the last year, of course, is the acquisition of Layer 7 by CA Technologies. This explains my extended absence from writing. I’m no less busy than in the past, and indeed often quite a bit more, but I’ve been completely consumed with making this deal a success. So the last year is a blur of integration, customer outreach, some terrific innovations—but not a lot of writing. That changes today.

The number one question people ask—and they ask this quite a bit—is how am I doing at a large company, and more specifically, how is CA? It is a logical question, but one always delivered with a slightly raised eyebrow that really implies just give me the dirt—and the juicer the better.

I respond with the truth. And the truth, to be honest, is quite a bit less salacious than everyone secretly hopes. Everyone knows acquisitions can go spectacularly bad. The cultural explosions can power a small city through a tough eastern winter. People love to hear these bad news stories; it’s somehow wired into our DNA to revel in nasty gossip.

Fireworks are fun, but more often acquisitions simply wither. Often the combination of start-up and Fortune 500 is an impossible calculus of mismatched expectations. In a way, this is a much worse outcome, because although the end is the same, the story is more depressing.

At CA and Layer 7, we are steering clear of these all-too-common disaster scenarios. Against all odds, we seem to be finding a very effective approach that just seems to work well for everyone.

We built a great company at Layer 7, and around this a powerful international brand. This feat is hard to achieve and once there, it is heartbreakingly easy to destroy the results. Nobody is more acutely aware of this than acquirers, and they usually respond with one of two strategies, each taken to extreme. Either they leave their new prize alone, fearful of killing the goose that laid the golden egg, or they embrace it with enthusiasm and their own unique style. The former creates silos that will never come down; but the later can squeeze the vigor out of a start-up until someone notices that the empty shell isn’t moving any longer.

We are all working very hard to find the virtuous middle ground. CA recognizes that the Layer 7 team in Vancouver is a great engine of innovation. So the band stays together, and moreover has the opportunity—really the mandate—to continue to push the envelope around APIs and mobility. We all recognize that we are part of a much larger narrative now. But honestly, this is what excites us most of all.

CA is big but it isn’t overwhelming. I’ve been struck with what a small-big company this actually is. In just seven months, I feel as though I have a good handle on who all of the key players are, and I can pretty much engage anyone I need to and be taken seriously. It’s a level of engagement I never dreamed of at IBM, a company much larger in size and exponentially more complex in organization.

That said, not everything is sunshine and roses. The expense department is convinced I’m really Frank Abagnale. I have big philosophical differences with the Internet policies. And the telephone conference codes are just too long. But I suppose I can adapt.

So the truth is boring, my anecdotes are not sexy, and that’s all a very good thing. Actually a great thing. The numbers are high, opportunity abounds, and there is a sense we can affect real change when change makes sense. My stories about the swashbuckling days of Layer 7 are far more entertaining.

But to hear these, you’ll need to buy me a beer.

Cheers.
Scott

Cisco and the Internet of Everything

John Chambers, CEO of Cisco, just published a good blog entry about the potential for change caused by universal connectivity, not just of our mobile gadgets, but of pretty much everything. Much has been made of late of the so-called “Internet of Things (IoT)”, to which Cisco is upping the scope and going so far as to make a bold estimate that 99.4% of objects still remain unconnected. This of course is great fodder for late night talk show hosts. I’ll leave this softball to them, and focus instead on some of the more interesting points in Chamber’s post and the accompanying white paper.

It strikes me that there might be more to Cisco’s Internet of Everything (#I0E) neologism than just a vendor’s attempt to brand what still may be a technology maverick. Internet of Everything sounds so much better than the common alternative when you append Economy on the end, and this is how it first appears in Chamber’s post. And that’s actually important, because adding economy in the same breath is an acknowledgement that this isn’t just marketing opportunism as much as a recognition that like mobility, the IoE is a potentially great catalyst for independent innovation. In fact, Cisco’s paper really isn’t about technology at all, but instead an analysis of market potential represented in each emerging sector, from smart factories to college education.

It is exactly this potential for innovation—a new economy—that is exciting. The combination of Mobile+APIs was so explosive precisely because it combined a technology with enormous creative potential (APIs) with a irresistible business impetus (access to information outside the enterprise network). The geeks love enabling tools, and APIs are nothing if not enabling; mobile just gives them something to build.

I0E of course is the ultimate business driver—and leveraging APIs as the enabler, it equals opportunity of staggering proportion. Like mobile before it—and indeed, social web integration before this—IoE will come about precisely because the foundation of APIs already exists.

It is here where I disagree with some IoT pundits who advocate specialized protocols to optimize performance. No thank you; it isn’t 1990 and opaque binary protocols no longer work for us except when streaming of large data sets (I’m looking at you, video).

Security in the IoE will be a huge issue, and on this topic Cisco has this to say:

IoE security will be addressed through network-powered technology: devices connecting to the network will take advantage of the inherent security that the network provides (rather than trying to ensure security at the device level).

I agree with this, because security coding is still just too hard and too easy to implement wrong. One of the key lessons of mobile development is that we need to make it easy for developers to enable secure communications automatically. Take security out of the hands of developers, put it in the hands of dedicated security professionals, and trust me, the developers will thank you.

As IoE extends to increasingly resource-constrained devices, the simpler we can make secure development, the better. Let application developers focus on creating great apps, and a new economy will follow.

CES 2013 Panel: Privacy and Security in the Cloud

The Consumer Electronics Show (CES) 2013 is starting next week and cloud computing is on the agenda. You can be sure that a technology has moved out of the hype cycle and into everyday use when it shows up at a show like CES, known more for the latest TVs and phones than computing infrastructure. People don’t really need to talk about cloud any more; it’s just there, and we are using it.

Of course there will always be a place for a little more talk, and I’ll be doing some of this myself as part of the CES panel “Privacy and Security in the Cloud”. This discussion takes place Monday Jan 7 11:00am-12:00, in LVCC, North Hall N259. The panel is chaired by my good friend Jeremy Geelan, founder of Cloud Computing Expo, who honed his considerable moderation skills at the BBC.

I’m planning on exploring the intersection between the cloud and our increasingly ubiquitous consumer devices. We will highlight the opportunities created by this technological convergence, but we will also consider the implications this has for our personal privacy.

I hope you can join us.