RSA Conference Europe 2005 - 2nd Day Morning

Second report from RSA Conference Europe 2005 in Vienna. This morning I attended the keynote sessions which were again opened by David Taylor. He praised the speech of Arthur Coviello - to which I do not agree. Then Jayshree Ullal of Cisco introduced their Self-defending networks idea. I was rather disappointed by the lack of actual vision. She also confused in one slide the time to fix a vulnerability with the time a vulnerability is exploited in large scale (with regards to sober and nimda). The methods how Cisco wants to defend networks seem very similar to the not very successful methods we use today. They do have some vision regarding management of policies and networks, but integrating this into one common platform will yet create another new risk. Some of the stuff Jayshree talked about were mere buzzwords without further meaning: "http or https based attacks" or "XML applications" - what is that supposed to mean? Any application using XML? The best part was the picture she draw regarding pacman gobbling up bad packets inside network devices like switches and routers. I was really hoping for better and especially more in-depth information on how the current issues can be tackled, but the vendors just continued to promote their solutions as the one to solve all issues once they're ready. The very same critique applies to Nico Popp from Verisign which announced a partnership with Ebay and Paypal to promote OTP tokens for authentication to these services. The next session was a panel discussion between different CIOs on supporting the CEO agenda. The common sense was to create awareness for Information Security and then come up with compelling plans to implement effective measures.