Log Management Summit Wrap-Up
As I mentioned before, I had the opportunity to speak about OSSEC at the SANS Log Management Summit 2007.
In case you've never been to one, these SANS summits are multi-day events filled with short user-generated case studies. In this case, the log summit was scheduled alongside the Mobile Encryption Summit, and the attendees were free to pop back-and-forth, which I did.
The conference opened Monday with a keynote by SANS' CEO Stephen Northcutt. Somehow, despite my four SANS certs, three stints as a local mentor and various other dealings with SANS, I'd never heard him talk. He's quite an engaging speaker. This time around, he was talking about SANS' expert predictions for near-future trends in cybersecurity. There were no shockers in the presentation, but it was a good overview of where smart people think things are headed in the next 12 months.
My favorite presentation on Monday, though, was Chris Brenton's talk, entitled Compliance Reporting - The Top Five most important Reports and Why. As you know, I've been doing a lot of work recently on NSM reports, and although log reporting isn't quite the same, the types of things that an analyst looks for are very similar. I got some great ideas which may show up in my Sguil reports soon.
On Tuesday morning, I gave my own presentation, "How to Save $45k (and Look Great Doing it)." This is the story of how we bought a commercial SEM product, only to find that it didn't really do what we wanted, and replaced it with the free OSSEC. Bad on us for not having our ducks in a row at first, I know. To be totally honest, it wasn't so easy to get up in front of 100 people and say, "You know, we made this really expensive mistake", but sometimes you have to sacrifice for the greater good. ;-)
My favorite talk on Tuesday, though, was Mike Poor's Network Early Warning Systems: Mining Better Quality Data from Your Logging Systems. In this talk, he presented a bunch of free tools to help you keep an eye out for storms on the horizon (to use the ISC's metaphor). Some of the tools were more like websites (Dshield.org, for example), and some were software. He even provided several detailed slides showing OSSEC alerts, which was a nice compliment to my own presentation.
The level of vendor spending on an event is in direct proportion to the number of security managers and CSOs in the crowd. Judging by the vendor-hosted lunches and hospitality suites, there were a bunch of them in San Jose this week. I attended a couple of vendor lunches, and I have to say that I was quite impressed with Dr. Anton Chuvakin's Brewing up the Best for Your Log Management Approach on Tuesday. He's the Director of Product Management at LogLogic, so I was expecting a bit more of a marketing pitch, but in reality he delivered a very balanced and well-thought-out presentation exploring the pros and cons of buying a log management system off-the-shelf or creating your own with open source or custom-developed tools. I think it was the most popular of all the lunch sessions that day, too. I came a few minutes late and had to sit on the floor for a while before additional tables and chairs arrived!
Overall, I think the summit was a good experience for most of the attendees. Many of the talks were more security-management oriented, and I cannot tell you how many times speakers said completely obvious things like, "You need to get buy-in!" or "Compliance issues can kill you!". Still, there was real value in having the ability to sit down with someone who's already gone through this process and learn from their successes (or in my case, mistakes).
SANS has promised to post the slides from each of the tals online. Once I find them, I'll link to them here. I'm not sure if that will include Dr. Chuvakin's talk or not, but I hope that will be available at some point as well.
Update 2007-04-30 09:33: SANS has posted the presentations on their site. This bundle includes all the slides that were printed in the conference notebook, including the one from the famous Mr. Blank Tab.
Update 2007-04-30 10:35: Daniel Cid points out that the slides for the concurrent Encryption Summit are also available.
4 comments:
What was the attendance like? I didn't hear about it ahead of time and thought about going for Tuesday but the $2145 for 2-days of workshops/talks seemed, well, insanely ridiculously high.
Looking forward to seeing a few of the articles but since a large number of the presenters are vendors I think I'll save myself the $2K and just have them come in to spend time with me personally while they pitch me.
Was Mike's talk the same old NEWS from last year's Log Management Summit?
I don't have official attendance numbers, but it looked like about 250 - 300 people total, with about 100 or so being in the log management track and the rest in the encryption summit.
Also, just to be fair, most of the presenters were end users, not vendors, though there was one particular talk that I'm pretty sure was written by the vendor. Other than that, though, it really wasn't a sales-fest.
Also, Richard, I don't know if it was the same NEWS talk from last year, since I wasn't there. Maybe it has been updated since?
Richard, it was an updated version of the talk I gave last year. From your original blog post last year... it seems that you understood my talk, but didnt "get it". There is no NEWS about network early warning systems... as I said in my talk... there is nothing new about what Im going to say. Most people just dont do any analysis. Now, what I dont like is that you post shit like this just to be confrontative. I mean... are you still presenting your OLD TCP/IP Weapons School? or talking about your OLD NSM stuff... come on. Be a bit more zen mr Tao. Follow the way. Be the way.
Post a Comment