RSA is best venue for “theme divination”, a strictly non-scientific process of absorbing huge amounts of hype in the vendor expo halls and the sessions in order to predict what the industry will be obsessed about in the next year. Naturally, people will still be patching windows 2008, changing firewall rules and updating passwords as well as do many other 1990s-style security tasks, but the minds of many will be elsewhere…
But where? I am slightly ashamed to admit that NO THEME came to me after I soaked up all the hype in the vast RSA vendor halls last week. To be sure, there were themes see below but I failed to arrive at The Theme .
What have I noticed overall?
There was a decent amount of “ automate ” and “ automation ” of security, with some “ orchestration ” mixed in (all “powered” by the security skills crisis). Confusion about automation will be with us for a while… In fact, this item would be as close to a year’s theme as I was able to get hey, even NAC vendors rebrand as “security automation vendors”
As a matter of fact, many vendors mention the security skills crisis or security team capacity problems I’ve seen this on UEBA, EDR, and of course SOAR vendors. Some vendors insist that automation is the answer, some that analytics/intelligence is, while others focus on workflow improvements. Along the same line, artificial intelligence (AI) messaging was in the air like an annoying dung fly. But then again, unlike AI, dung flies actually exist … Unlike other observers, I ‘ve seen less endpoint and less EDR noise given that I detected “the return of the endpoint” back in 2013 , this is not shocking. Maybethe pendulum will now swing back to the network? People are launching new Threat Intel Platforms (TIP) which is hilarious , given the size of this “market.” The two leading players probably have enough business… but do we need 3-5 more?! Threat detection message is still going strong, as security spend continues to leak from prevention to a balanced mix of prevention / detection / response (of course, there is always that one village idiot who promises to prevent all the unknown threats…why do they never learn?) Deception vendors were also out in force, but of course their voices were drowned by all the continuingsecurity analytics clamor (hey…even log management vendors are now “security analytics”, because….eh…because SECURITY ANALYTICS!!! ) I did notice yet another vendor that used “ moving target security” as their slogan. It seems that both vendors using this idea are quite dissimilar, but they are worth a mention as a potential candidate for “paradigm expansion”, if not truly paradigm shift in security. A phenomenon I pointed inmy RSA 2015 blog has gotten even worse: I’ve seen way too many vendors who are barely a feature , but probably not a product and certainly not a business. What is worse, there were plenty of vendors that felt like random bundles of features , just like Oliver said here and Idid here. Yes, somebody somewhere needs exactly that bundle, but most of them are never going to be mainstream…. A few things I expected to see very little and indeed they were NOT there: IoT security we all know that there is no money in IoT security yet (“By year-end 2020, IoT risk and security needs will add an average of 2% to the total IoT project costs, up from 0% today .”) Insider threat Icontinue to insist that very few truly care about it. Finally, the show serves as a good reminder that “security market consolidation is B.S.” Well, as somebody said “it is consolidating, never consolidated” we had a fair number of acquisitions, but also a hugely expanded number of vendors (some say no longer 800, but more like 1200-1500 security vendors our there)
To close this off, I wanted to quote my buddy Dave :
Hands down, the biggest steaming pile of horseshit from #RSAC this year is “AI”. No, $vendor , you DON’T have it. And @anton_chuvakin agrees!
― Dave Shackleford (@daveshackleford) February 18, 2017
There you have itHope you enjoyed RSA! See you next year!
Past blog posts related to RSA conferences: