Rational Survivability

Recent Speaking Engagements/Confirmed to  speak at the following upcoming events:

• FIRST, Miami, FL, keynote  – June 13-18
• SANS What Works In Virtualization and Cloud, Washington, D.C., keynote – August 19th-20th
• Ping Identity Summit, Keystone, CO, Cloud session with Gunnar Peterson – July 20-23
• Black Hat 2010, Las Vegas, NV, July 26-29
• Defcon 18, Las Vegas, NV – July 30-August 1
• VMworld, San Francisco, CA – August 30-September 3
• RSA Japan, Tokyo, Japan – September 6-12
• Telfonica Cloud Security Event, Madrid, Spain – September 13-16
• NIST 2010 SCAP conference, Baltimore, Maryland – September 28
• IANS New England Information Security Forum, Boston, MA, keynote – September 29
• MassTLC Security Summit, Burlington, MA – October 1
• HacKid, Cambridge, MA – October 9-10
• RSA Europe, London, UK – October 11-15
• Security at University of Michigan Summit (SUMIT_10), Ann Arbor, MI – October 18-19
• Sector, Toronto, Canada – October 25-28
• Black Hat Abu Dhabi, UAE – November 10-11
• Cloud Security Alliance Congress, Orlando, FL – November 16-17

There are a ton of venues I haven’t added here because they are directly related to customer visits that may not wish to be disclosed.  You can see the prior list of speaking engagements listed here.

[I often get a bunch of guff as to why I make these lists: ego, horn-tooting, self-aggrandizement. I wish I thought I were that important.  The real reason is that it helps me keep track of useful stuff focused not only on my participation, but that of the rest of the blogosphere.  It also allows folks to plan meet-ups]

/Hoff

I’m hurrying to polish up the next in my series of virtualization and cloud computing security presentations which I’m going to give at this year’s Black Hat conference in Las Vegas on July 29th.  I’m speaking from 10-11am on day two up next to folks like Jeremiah Grossman, Moxie Marlinspike, Ivan Ristic, Haroon Meer…quite the “power hour” as someone said on the Twitter.

At any rate, I started the series a couple of years ago with the following progression:

1. The Four Horsemen of the Virtualization Security Apocalypse
2. The Frogs Who Desired a King: A Virtualization & Cloud Computing Fable Set To Interpretative Dance
3. Cloudifornication: Indiscriminate Information Intercourse Involving Internet Infrastructure

I proudly present numero quatro:

CLOUDINOMICON: Idempotent Infrastructure, Survivable Systems & Bringing Sexy Back to Information Centricity

Mass-market, low-cost, commodity infrastructure-as-a-Service Cloud Computing providers abstract away compute, network and storage and deliver hyper-scaleable capabilities.

This “abstraction distraction” has brought us to the point where the sanctity and security of the applications and information transiting them are dependent upon security models and expertise rooted in survivable distributed systems, at layers where many security professionals have no visibility.

The fundamental re-architecture of the infostructure, metastructure and infrastructure constructs in this new world forces us back to the design elements of building survivable systems focusing on information centricity — protecting the stuff that matters most in the first place.

The problem is that we’re unprepared for what this means and most practitioners and vendors focused on the walled garden, perimeterized models of typical DMZ architecture are at a loss as to how to apply security in a disintermediated and distributed sets of automated, loosely-coupled resources.

We’re going to cover the most salient points relating to how IaaS Cloud architecture shifts how, where and who architects, deploys and manages security in this “new world order” and what your options are in making sustainable security design decisions.

It’s progressing nicely.  Hope to see you there (and at Defcon)

Here is some of the recent coverage from the last couple of months or so on topics relevant to content on my blog, presentations and speaking engagements.  No particular order or priority and I haven’t kept a good record, unfortunately.

Important Stuff I’m Working On:

• Cloud Security Alliance
• CloudAudit/A6
• Common Assurance Metrics

Press/Technology & Security eZines/Website/Blog Coverage/Meaningful Links:

• How Cloud Service Brokers Enable the Cloud Marketplace – Connecting SOA to the Cloud
• Incite 2/17/2010 – Open Your Mind – Securosis
• Fun Reading on Security and Compliance #23 – Security Warrior Blog
• From private clouds to solar panels: more control and uniqueness, but are they worth it? – Data Center Dialog
• Want to build a private cloud? – SearchCloudComputing
• What’s The Difference Between Security And Trust In The Cloud? – CSC Trusted Cloud Services
• In The Era Of Mashups, MashSSL Could Be A Savior – CloudAve
• Cloud Computing, A Primer – The Internet Protocol Forum
• On the many limitations of (network) virtual appliances – Virtualization.info
• Incite 1/27/2010: Depending on the Kids – Securosis
• Can regulators keep up with Cloud Computing? – CloudAve
• The network performance within the cloud, an hidden enemy – Reflections of the Void
• The Cloud Computing Compliance Conundrum – Data Center Knowledge
• Is over-capacity inevitable in cloud computing? – virtualization.info
• Cloud Overbooking – Part 1 – Virtually Insane
• Infrastructure 2.0: Squishy Name for a Squishy Concept – f5 DevCentral
• Top 10 Web Hacking Techniques of 2009 – Jeremiah Grossman
• On Virtualization, Clouds and Meta Orchestration – SeekingAlpha
• Forecast for 2010: The Coming Cloud ‘Catastrophe’ – BusinessWeek
• The Daily Incite – 12/28/09 – Meyer’s Choice – Security Incite
• Virtualization, Cloud Computing, And Next-Generation Security – InformationWeek/DarkReading
• My Thoughts After CloudCamp Boston 2009 – Fubardness is Contagious

Recent Speaking Engagements/Confirmed to  speak at the following upcoming events:

• Govt Solutions Forum Feb 1-2 (panel |n DC)
• Govt Solutions Forum Feb 24 D.C.
• ESAF, San Francisco, March 1
• Cloud Security Alliance Summit, San Francisco, March 1
• RSA Security Conference March 1-5 San Francisco
• Microsoft Bluehat Buenos Aires, Argentina – March 16-19th
• ISSA General Assembly, Belgium
• Infosec.be, Belgium
• Codegate, South Korea, April 7-8
• SOURCE Boston, April 21-23
• Shot the Sherrif – Brazil – May 17th
• Gluecon , Denver, May 26/27
• FIRST, Miami, FL,  June 13-18
• SANS DC – August 19th-20th

Conferences I am tentatively attending, trying to attend and/or working on logistics for speaking:

• InterOp April 25-29 Vegas
• Cisco Live – June 27th – July 1st Vegas
• Blackhat 2010 – July 24-29 Vegas
• Defcon
• Notacon

Oh, let us not forget these top honors (buahahaha!)

• Top 10 Sexy InfoSec Geeks (link)
• The ThreatPost “All Decade Interview Team” (link)
• ‘Cloud Hero’ and ‘Best Cloud Presentation’ – 2009 Cloudies Awards (link), and
• 2010 RSA Social Security Bloggers Award nomination (link) 😉

[I often get a bunch of guff as to why I make these lists: ego, horn-tooting, self-aggrandizement. I wish I thought I were that important. 😉 The real reason is that it helps me keep track of useful stuff focused not only on my participation, but that of the rest of the blogosphere.]

/Hoff

Here is some of the recent coverage from the last month or so on topics relevant to content on my blog, presentations and speaking engagements.  No particular order or priority and I haven’t kept a good record, unfortunately.

Press/Technology & Security eZines/Website/Blog Coverage/Meaningful Links:

• Threatpost – Coverage of my SecTor 2009 Cloud Security Keynote
• Can We Secure the Cloud? Can We Afford Not To? – Microsoft TechNet/Bluehat Blog
• Another Day, Another Data Loss – Gordon Haff, C|Net
• Cloud Security Raises Unanswered Security Questions – Grant Buckler, itbusiness.ca
• Of Cloud Computing & Virtualization – Oman Sultan, Cisco
• Infrastructure 2.0: Young Turks at SRI – Greg Ness
• Cloud Security – Time To Smoke Another One? – Bill Brenner, Computerworld
• Security Threats to virtual environments less theoretical, more practical – Michael Mimoso, TechTarget
• Security Showdown: Cloud Computing vs. On-Premise IT – Dana Gardner
• A6 Promises A Way To Check Up On Public Cloud Security – Tim Greene, Network World
• Cloud rEvolution: Laying the Foundation – CSC Leading Edge Forum (PDF)

Podcasts/Webcasts/Video:

• Silver Bullet Podcast – Cigital’s Gary McGraw and I chat about Cloud security
• CNET Reporter’s Roundtable – Rafe Needleman and the “Danger of Cloud Computing”
• Threapost Digital Underground – Dennis Fisher and I chat about security, disruptive innovation and Cloud security

Recent Speaking Engagements/Confirmed to  speak at the following upcoming events:

• Enterprise Architecture Conference, D.C.
• Intel Security Summit 2009, Hillsboro OR
• SecTor 2009, Toronto CA
• EMC Innovation Forum, Franklin MA
• NY Technology Forum, NY, NY
• Microsoft Bluehat v9, Redmond WA
• Office of the Comptroller & Currency, San Antonio TX
• Intercloud Working Group, GooglePlex CA 😉
• CSC Leading Edge Forum, VA
• DojoCon, VA

I also forgot to thank Eric Siebert for putting together the VMware Top 20 blog list and putting me on it as well as the fact that Rational Survivability made the Datamation 2009 Top 200 Tech Blogs list.

/Hoff

I’m loathe to upload this presentation because really the slides accompany me (not the other way around) and there’s a ton of really important subtext and dialog that goes along with them, but I’m getting hammered with requests to release the deck, so here it is.

I will be giving this presentation at various venues over the next few months as well as the second in the series titled “Cloudifornication: Indiscriminate Information Intercourse Involving Internet Infrastructure.”  

At any rate, it’s another rather colorful presentation. It’s in PDF format and is roughly 12MB.

Click here to download it.

Enjoy

/Hoff

Here is some of the recent coverage from the last couple of months on topics relevant to content on my blog, presentations and speaking engagements.  No particular order or priority.

Press/Technology & Security eZines:

• Byte & Switch: Securing data wherever it travels
• CSO Online: Hoff – Commode Computing
• Computerworld & CSO Online:  Four questions on Google App Security 
• Dark Reading: Crossing the streams virtually 
• SearchSecurity: PCI needs to address virtualization, experts say
• CSO Online: The myth of Cloud Computing 
• CSO Online: Chris Hoff – On Virtualization and Cloud Computing 
• Computerworld: How can you secure a buzzword? 
• CSO: Security Predictions – What happens next? 
• ITWorld Canada: Security admins offer their risk management pitch

Website/Blog Coverage/Meaningful Links:

• Server Zone: Cloud Ontology – to boldly go where ITIL, Grid and SOA have gone before
• Virtualization.info: Top virtualization blogs of 2008 
• VMware-land: Top 10 Virtualization blogs 
• ebizQ: Naming the part of the cloud
• IT Management & Cloud Blog: And the 2009 Cloudie Award goes to…  
• C|Net Wisdom Of the Clouds: Two ontologies shed light on Cloud Computing 
• SeekingAlpha: Peak IT – The network industry's core challenge
• System Advancements at the Monastery: Recent Cloud Postings
• Meedabyte: Be open to winds of change 
• ZDNet: Will EDoS be the next DDoS?
• Data Center Knowledge: Cloudy Day: CloudSwitch, AWS Torrents, eDoS
• SoftSecurity.com: Will EDoS be the next DDoS?
• The GridPlace.com: In Cloud Computing, a good network gives you control
• RiskAnalys.is: Penetration testing not dead, probably just pining for the fjord
• SYS-CON: How difficult is securing Cloud platforms? Services in a Cloud Computing Environment 
• Data Center Networks (Cisco): Services in a Cloud Computing Environment
• Data Center Links: January Cloud Report
• Symantec Forums: How we win at securing customers in a virtual world
• VMBlog: The Future of virtualization
• Prism: Security – A casualty in the Sovereighnity vs Efficiency tradeoff
• Securosis: How the Cloud destroys everythng I love (about Web App Security)
• CloudAve: Cloud Computing Risks – EDoS
• Elastic Vapor: Cloud attack: Economic denial of sustainability (EDoS)
• Tripwire: Regulations need to get unreal
• Blog Of Trust: Be an IF-MAP Innovator
• DevCentral: The Context-Aware Cloud 
• Law.com: Old habits persist in virtual security 
• Brian Madden: What does Microsoft Azure have to do with us?
• Securosis: Everything old is new again in the fog of the cloud
• Securosis: Cloud Security macro layers
• Telematique: Clouds, the criminal element & V12N to the rescue
• Network Security Blog: PCI Compliance – get it in writing!
• Citrix Community Blog: Hoff is still confused 
• ZDNet: Security will suffer in the financial crisis

I should note that many of my cloud computing writing is being republished over at the SYSCON Cloud Computing Journal with a self-branded mini-site: ChristoferHoff.Sys-Con.com

Podcasts/Webcasts/Video:

• Network Security Podcast Episode 131: Co-hosted with Rich Mogull
• Briefings Direct: Improved insights and analysis from systems logs reduce complexity risks from virtualization
• Virtualization.com: Video interview with Simon Crosby, Citrix CTO (not in it, mentioned) 
• Cisco Data Center Blog: Data Center 3.0 anniversary note & new products video

I am confirmed to  speak at the following upcoming events:

• Source Boston  - Boston, MA – March 11-13
• TechTarget Threat Management Decisions Summit – New York, NY – March 26
• Americas Growth Capital InfoSec Conference (keynote) – San Francisco, CA, April 20
• RSA 2009 (multiple sessions) – San Francisco, CA, April 21-24
• Virtualization Congress – Las Vegas, NV, May 4-7
• (there are others being sorted at the moment) 

I should/will be attending the following events:

• Shmoocon
• Cloud Computing Expo   

/Hoff

Here is some of the recent press coverage on topics relevant to content on my blog:

• Information Week: Virtualization Has A Security Blind Spot
• Information Week: Securing Virtualization, or is that Virtualizing Security?
• Network World: Black Hat speakers expose virtualization, OS security gaps (**NOTE: Please see here, VERY important)
• Network World/Computerworld: Black Hat spotlights virtualization, DNS issues (**NOTE: Please see here, VERY important)
• SearchSecurity (Australia): Could securing virtualised environments destroy ROI?
• SearchSecurity: Initial virtualization costs could outweigh benefits
• Computer Zeitung: Today’s Security Products Aren’t Ready For Virtualised Data Centres
• Wall Street Journal: Hackers On the Move
• Baseline: Managing Mobility In the Enterprise
• ITWorld: Pros and Cons of VMware’s New Security Guide

Podcasts/Webcasts/Video:

• Network Security Podcast: Defcon Wrap-up (*naughty language)
• Security Wire Weekly: Virtual Security Apocalypse
• DarkReading: Four Horsemen Interview after my talk at Blackhat
• SearchSecurity "Still Nameless Podcast": Rich Mogull and associated nonsense (I wasn’t on it, just in it 😉

I am confirmed to  speak at the following upcoming events:

• Forrester’s Security Forum, Boston MA, September 4-5
• [Private] Portland, Oregon, September 8-11
• [Private], Utah, October 1-2
• Day-Con II, Dayton, Ohio, October 10-12
• RSA Europe, London UK, October 27-29
• TechTarget Information Security Decisions, Chicago IL, November 5

I will be attending the following events:

• VMworld 2008, Las Vegas NV, September 14-18

/Hoff