The annual RSA Conference, now in its 20th year, will be rocking this month as the security industry gathers in the week long extravaganza of product introductions and security experts arguing cloud and mobile computing security issues.
Industry executives stepping into the limelight at the show will include Scott Charney,Microsoft‘s corporate vice president for trustworthy computing. Charney will be posing the idea of a “collective defense for Internet health” that might involve a new type of computer check-up to detect botnet or other malware code, and what might be social and political implications. The Pentagon’s deputy secretary of defense, William Lynn, is expected to speak about the Defense Department’s cybersecurity strategy — and ask for assistance from industry to develop technologies against adversaries trying to get into sensitive networks.
Other keynote speakers will be Enrique Salem, president and CEO of Symantec; Bill Veghte, executive vice president, software and solutions, enterprise business at HP, expected to discuss what HP will be doing to innovate with its recent acquisitions of ArcSight and Fortify; and Tom Gillis, Cisco‘s vice president and general manager, security technology business unit, likely to discuss Cisco’s security strategies in mobile and cloud computing.
But far from the hoopla, the RSA Conference — which began two decades ago as a modest gathering of cryptography experts invited to a conference of their peers organized by what was RSA Data Security (now part of EMC) — still remains a place to explore some of the latest thinking about public- and private-key encryption.
And this year a good place to start would be at the Oasis KMIP Interoperability Demonstration, where members of the industry group Organization for the Advancement of Structured Information Standards (OASIS) will be demonstrating secure communication of key-management information across vendor product boundaries using products based on the OASIS Key Management Interoperability Protocol v. 1.0.
KMIP is an industry specification developed by OASIS participants, including IBM, HP, EMC/RSA and nCipher (acquired by Thales), among others, for policy-based centralized control over “cryptographic material, public/private keys, certificates, all kinds of materials with cryptographic keys that need to be managed,” says Robert Haas, manager of storage systems research at IBM’s Zurich Research Lab.
Managing encryption keys, wherever used in storage and database systems, servers and hosts, or elsewhere, has always been hugely difficult — and the complexity has sometimes been called “the Achilles’ heel of cryptography,” Haas adds.
The KMIP v. 1.0 specification appears to be the best shot so far to create a standard for multivendor interoperability in key management, Haas points out. The demonstration at the RSA Conference will show how it’s possible to do tasks such as generate keys, locate existing keys, and retrieve, register and delete keys across vendor client/server boundaries using products from SafeNet, Emulex, RSA/EMC, Cryptsoft, IBM, HP and High Density Devices.
The topic of interoperability in highly sensitive security environments will be taken up by Michael Denning, general manager, security customer solutions unit at CA Technologies, who will host a panel discussion with executive directors from Raytheon, EADS, and Northrop Grumman. The focus will be on use of data-sharing technologies developed by the Transglobal Secure Collaboration Program, the group of corporate and government participants fostering secure means to share sensitive information in the aerospace and defense organizations across international boundaries.
Meanwhile, a number of announcements related to mobile data security, next-generation firewalls and intrusion detection and prevention are expected, including what is said to be the first commercial implementation of the Suricata specification fostered by the Open Information Security Foundation, regarded as a competitor to open-source Snort, which is shepherded by Sourcefire.
Specifically under the OISF banner, the ThreatMeter 10 Gbps IDS/IPS appliance from nPulse will be showcased, based on rule-sets from company Emerging Threats as well as supporting technology from Napatech.
Other product demonstrations will include a joint demonstration of how the Tufin SecureTrack firewall-management audit and compliance product for the first time will support a next-generation firewall, in this case the NGFW line from Palo Alto Networks. This means that using the Tufin firewall-management tool could make it easier to migrate from a traditional port-based firewall to a next-generation firewall such as Palo Alto’s, that can work based on application-level controls. Palo Alto and Tufin will be demonstrating how this works at both their booths at the show. CA Technologies will be showing how its SiteMinder Web-access control product gains expanded and advanced security authentication through integration with security-policy enforcement technology from Arcot, a company it acquired late last year.
