Security Dreamer

Video: How I Evaluated Three Video Analytics Management Platforms

I performed an independent, no-money-changed-hands evaluation of three products advertising video surveillance management plus video analytics management.  Here is a short video explaining my process and what I learned from my experience with Milestone XProtect, Aimetis Symphony, and Verint Nextiva.

All three products performed admirably, but there was one standout.  A few vendors chickened out, er, I mean, decided it was not of interest to them to participate.  :)  So kudos to Milestone, Aimetis and Verint for being proud of their products - as they should be.

DreamerGear Evaluation of Aimetis

DreamerGear Evaluation of Milestone

DreamerGear Evaluation of Verint

DVTel shows me an impressive command center software design

If we limit the conversation just to the technology, you'll hear me sing the praises of DVTel.  The command center console is attractive and intuitive and very functional.  I especially liked the simple, centralized management of video, access control, perimeter sensors and the flexible reporting capabilities.  DVTel's iSOC v6 is a refreshing reinvention of the standard command center interface.

Steve Speaking at ISC West in Vegas

I'm going to be a part of two sessions at ISC West in Vegas this year.  I hope you'll come and cheer (or jeer).

The first is called DI01: Identity Analytics: Managing Risk at the Door
3:00PM - 4:00PM (Tuesday, March 31, 2009)
Come to this session if want to hear why I think the access control product (and its manufacturer) you are working with today may inadvertently leave you high and dry as customer preferences and requirements change. 

The second is a panel discussion with a couple folks, including Ray Cooke from IBM.  We'll explore some competing and sometimes complementary paths to creating business value with security technology.

DI42: Physical Security Information Management
3:00PM - 4:00PM (Wednesday, April 01, 2009)
This panel presentation will answer the question what is PSIM? Providing examples on how it is being used today and how to deal with the technical challenges to implementation. Coping with different generations of legacy systems and dealing with the many different communications protocols. As well as a look to the future and impact of PSIM.

Please tell your friends and plan to come to both.  I'd love to see you and hear your comments.

Protecting the crown jewels with clear thinking and a little help from your friends

I see a transformation in modern security practice.  There is a new appreciation for the primacy of data.  Certainly the financial institutions are forward thinkers in this regard, along with insurance companies and most of the heavily regulated industries and some retailers.  Apart from those folks, however, I think there is a lot of awareness about the bad things that can happen.  Many purchase decisions today, however show signs that the tail is wagging the dog - so many vendors are pushing data loss prevention solutions, then it MUST be a badwagon I should jump on.  If I don't, I might end up on the front page next to TJX.

A CISO at a Fortune 500 telecommunications company in the US said his organization is improving three classes of security activity: prevention, detection and corrective action.  In a phone conversation he reminded me that a few years ago, data classification was all the rage.  But the point was well taken, he said.  We all needed to step back and say "wait a minute. What are we really trying to protect here?"  One key to success he discovered was asking his legal department for help.  "Take a look at the records retention guidelines that legal departments crank out.  You'll find an excellent starting point for identifying the most important information in your organization."  It is just a start, but it's better than most IT security folks can do by themselves. 

First in a series of podcasts - a new era of technology sales

Well, there were a few technical difficulties, and I picked up some annoying static on my little Sony Digital Recorder, but all in all I'm very happy to present the first podcast of 2008.  My conversation with Dan Dunkel, sales guru and President of New Era Associates, explores how new technologies are forcing changes in sales and channel strategies, and what makes a successful security technology sales person.   Pelco, Honeywell, Cisco, IBM, Vidsys, Quantum Secure, and other vendors are discussed.

The podcast is 23 minutes.  Enjoy!Download podcast_1__dan_dunkel.mp3

crafty or clueless - Sony fails to learn its lesson the first time

When the story broke that Sony was loading unauthorized rootkits on the PCs hosting the Sony USB memory stick, I was baffled.  Surely all the idiots were fired last time this happened - when it was discovered that rootkits were loaded from Sony DVDs.  Either Sony engineers are supremely stupid, thinking we wouldn't object to a rootkit installed on our machines, or they are supremely stupid by thinking that we are supremely stupid - which we ain't.
read up on this Wired magazine blog, or on engadget.

It'll take me awhile to digest all the technology I observed (and all the yummy Israeli food I ate), but here is a sample

Here are a few of the companies I had the pleasure to visit while in Israel.

Applicure Technologies www.applicure.com
Web application security software.
Applicure’s dotDefender software-based web application firewall is a solution for web application protection when appliances are not attractive or are less applicable. Small and mid-sized companies will likely prefer dotDefender’s simple online download, straightforward installation and its moderate pricing compared to the more complex architectures of appliance vendors like Imperva, F5 or netContinuum. However, dotDefender will be even more attractive to web hosting companies looking for security add-on services like web application protection to upsell to their customers.

Persay Ltd. www.persay.com
Voice Biometrics
Real time and recorded voice analysis for authentication. When a call center employs a Persay product like Vocal Password™ 6.0 users may opt to enroll their voice as one factor in a multi-factor authentication event. About 300,000 Bell Canada customers did just that as soon as they called in to set up over-the-phone account management. This is just one of Persay’s impressive line of practical and accurate voice biometric solutions.

ControlGuard Ltd www.controlguard.com
Endpoint device security
ControlGuard Endpoint Access Manager is a powerful, mature software solution for controlling the use of removable storage devices. Employees are forever attaching USB memory sticks, iPods, PDAs, phones and whatnot to their PCs. Security administrator my use Endpoint Access Manager to set up quite specific granular rules for who may use what devices with which types of files when. The product also records all activities related to data on removable media for forensic reference.

Bio-Guard www.bio-guard.net
Biometric access devices
The company manufactures a line of devices utilizing fingerprint readers such as a door lock, door controllers, and time and attendance devices.

A one-stop security shop in Israel (more along the lines of kiosk-on-Diezengoff than SuperSol, but useful anyway)

Mr. David  Hava, the CEO of MIW, Ltd. (Managing Investments Worldwide) explained how his business development firm came to invite Eleanor and me to Israel. Over coffee (café afouk, naturally) he described MIW as the coordinator and manager for a few technology consortia. The I-Safe group is one, focused as you might imagine on security, and consisting of just over a dozen companies. The slogan for the I-Safe group is “One Stop For All Your Security Solutions.” (That reminds me, for a few years when I was much younger I worked as a locksmith at Chicago’s Security Shop whose slogan was the same.) At first glance through the list of companies I saw only IT and network security firms. If this is one stop for all my security, where is physical security? Where is homeland security? A closer inspection turned up Sdema Group, a consulting firm offering physical security risk assessments, information security best practices consulting, and employee background checks.

I’ll let you know later this week if the biometrics vendors in the I-Safe group qualify in my mind as physical security solution providers or if they are stuck in an infosec mentality.

The idea of the consortium is to qualify for government support monies, share marketing expenses, and collaborate on business development. No direct competitors may belong to the same consortium. For example, Safend is not in the I-Safe group because ControlGuard is already a member – both being device security vendors protecting against data leaks to USB sticks and other peripherals.

Day One in Israel: Time waits for no man - nor I for a late driver

I arrived in Israel on Friday, the first day of the Israeli weekend, hoping to enjoy the luxurious Shabbat before starting a rather intense run of meetings bright and early Sunday morning through Wednesday afternoon. No sooner had I landed, however, than I discovered a leisurely Shabbat may not be in the cards. No driver. Usually, when I come to Israel my hosts send a car to meet me. Don’t get me wrong, I don’t mind taking a taxi. It’s easy and at 120 shekels (about $30) cheaper than most airport-to-downtown rides. But you just expect that if you are being invited to a city for a special event that a car would be waiting.

Instead, I was waiting. But not for much time. After about 15 minutes of lingering in the meeting area of Ben Gurion, and scanning for drivers outside, I gave up and took a taxi. Later I found out that my hosts had indeed sent a driver who apparently lost track of the time.

In my twenty or so trips to Israel – trips I have enjoyed to an extent that is hardly describable – I have come to understand a bit the Israeli conception of time. You can imagine a country that lives an entire 200 year history crammed into 50 action-packed years that time would be quite relative. In Israel, people are either in a tremendous hurry, or in absolutely no hurry at all. There does not seem to be a middle ground.

At the hotel, the front desk checked my reservation and saw I was scheduled only for one night. Again, a very different conception of time. :-\ I protested that I have a confirmation number given to me by my hosts confirmed through Thursday. The desk said they would look for a room and would call me “soon.” “When?” I asked, “Tonight?, Tomorrow?” “Soon,” was the reply.

They say that on Shabbat (Saturday) there is no time. You can certainly feel it. Israelis take their Shabbat seriously. It is a day which even the least religious person sets apart to be different – time with family, with friends. Stopping time for a day every week seems like an excellent recipe for sanity.

I spent my Shabbat in Israel waiting for the hotel mess to get straightened out (“breakfast is not included?!” sidebar>you can’t appreciate how important a point breakfast is until you’ve experienced the epicurean indulgence of an Israeli hotel breakfast), then a good book, quite a few cups of café afouk (literally upside down coffee, similar to a cappuccino) and a swim in the bath water warm Mediterranean.

Tomorrow morning, my colleague Eleanor Dallaway, an editor for Elsevier magazines in London, will join me for four days of meetings with each of the I-Safe cluster of companies.

Brought to you by the letter 'V' - three vendors in Boston show me how to do security smarter

I had a lovely trip to Boston this week and spent time with three vendor, each starting its name with the very fashionable letter V.  Take and minute and check out these sharp companies.

VidSys - Probably the coolest technology on the planet for viewing surveillance video seamlessly and easily from any source.

VideoIQ - the Bionic Woman of the intelligent video game. Better, faster, stronger (and pretty darn sexy - not Lindsey Wagner Sleep Number Bed burnt out sexy (yikes!), but Michelle Ryan playing NBC's Jaime Somers sexy.)

Verdasys - You thought you know what data security was all about?  Think again.  The misunderstood data leakage vendor has just been teasing us with its powerful approach to data management.  The real story is in the underlying platform.