Security Experts:

RSA Conference 2012 Preview Part 2: Getting The Most from Your Conference Experience

RSA Conference Insider

It’s here. RSA Conference 2012. For those of you preparing to venture off to San Francisco next week for the biggest IT security conference of the year, the SecurityWeek team has prepared a preview to help you navigate through what can be an overwhelming conference at times, and help you get the most out of your conference experience. (Also Read RSA Conference 2012 Preview Part 1: Topics and Trends)

I’m relatively new here at SecurityWeek, but I’m not new to the world of marketing and vendor perspective. Likewise, I’m no stranger to the life of an IT administrator just trying to work the grind and keep it together.

Security is neither easy nor cheap, and conferences like RSA are a solid opportunity to learn, network, and sell. That is, only if you use it correctly and don’t get overwhelmed.

I’m going to be blunt and attempt to explain RSA from a reporter’s perspective – one who attends looking for a scoop and information – and from an IT guy’s point of view.

This year marks the 20th Anniversary of the RSA Conference (RSA for short). It’s come a long way from the small user group meeting that it was two decades ago. Truly, it is the world’s largest security event. If a vendor hopes to make it in the market, they know they need to spend the money and attend and/or present the show. It’s a harsh reality, but one that exists and cannot be overlooked.

The reason for this, is you dear reader. Your organization, your staff, your business model, and more importantly, your budget, are ultimately the only reasons these vendors are there. They honestly want to help you succeed and protect your business, but they’re in business too!

With that said, the value of RSA resides entirely within you. What do you want from the conference? If you’re going to RSA in order to learn about the latest threats, then the first place to look is the conference schedule, and the talks being presented. However, keep in mind that some talks are vendor driven, so you will hear more about their products than you will about the latest threats and trends. This isn’t always the case, but it happens.

It’s easy to let marketing terms such as APT, targeted attacks, and advanced or state-sponsored malware spook you. However, you can’t stop a targeted attack. Many of you know this already – you’re experts after all. FUD – Fear Uncertainty and Doubt – is king when it comes to pitching a given solution. I see it constantly in PR pitches, and I don’t doubt for a second that you see or hear it in sales pitches. Its part of the game, so to speak, and the nature of the Information Security world overall, so one just deals with it and moves on.

However, the same methods you use to avoid sales FUD will help you navigate RSA too. If you’re looking to learn about the newest threats, attend a few talks on the topic – and talk to the vendors on the expo floor and see what they are saying. However, the best advice and information will come from your peers. In the years that I have attended RSA, I’ve gotten more credible and valuable information from attendees – working folk like myself – than I have from vendors.

You, because you live in the trenches, are the perfect source to tell me about the daily IT struggle and the hassle of compliance and budget management. Vendors are aware of some of the issues, but you live with them daily. Focus on this, and take advantage of the cocktail hours and vendor parties to mingle and network with others in your shoes.

For the most part, people at RSA love to mix-it-up and are all too happy to trade war stories. The fact that there is free food and drink is a bonus.

If you are attending RSA to learn about the latest technologies, again the vendors are just one source. Talks are another source. You’re peers are likely the best source. What are they using? What did they use originally? Why did they change?

When talking to vendors, use the same FUD avoidance that you would use in a sales pitch, and question the perspective vendor on what they can do to align themselves to your organization. A security vendor needs to be more than a SLA and support / maintenance contract. They should be a strategic partner that the business can grow and evolve with over time.

No two vendors are alike, even if they share the same market space, and your organization will have unique needs that must be met. So, with that said, consider your needs first and what the vendor can offer second, aligning that to the future that you’ve got in mind when it comes to security.

This year, in addition to the aforementioned topics, you’re also going to hear about mobile threats (such as the BYOD risk) and cloud security. If this isn’t what you’re here for in the first place, ignore it. However, if this is something you’re looking for, there are some real gems this year. Don’t take my word for it however, as I’m not the only one who thinks so.

“Up until now most of what we’ve seen was marketecture or cloudwashing, but merely printing a pretty pamphlet or tossing your existing product into a virtual appliance doesn’t make a real cloud security tool,” noted Mike Rothman from Securosis. “Of course we see plenty of make-believe, but we see the emergence of new and exciting tools designed from the ground up for cloud security.”

Rothman also adds: “Our biggest problem is that we still need more people who understand practical cloud architectures, but most of the people I meet at security conferences are more interested in writing policy. Unless you know how this stuff works you won’t be able to tell which is which – it all looks good on paper. But here’s a hint – if it’s the same product name as an appliance on your network, odds are it’s an old product that’s been dipped in a bath of cloudy paint.”

On the mobile side of things, if you’re at RSA to secure your mobile environment, or learn how to secure it in the first place, remember the rule: The solution has to meet your organization’s individual needs, and the vendor should be partner material in the long run.

Lastly, I’ll talk about one last theme. Next Gen (anything). If a vendor uses Next Gen in any context, it’s a safe bet that you can ignore the term, because it’s a title and not a magic bullet. Consider the product, and again the vendor too, and match them to your own needs. Remember, Silver Bullets only work in the movies, not security.

No matter what you do at RSA, I implore you to network first and foremost. It’s a valuable tool, and one that is priceless when it comes to defending the network and company.

The protection earned by learning from your peers can never be replaced by a shiny box. Why? Because your peers – like you – have been forced to pull miracles out of a hat for years without any shiny boxes and almost no funding for security whatsoever, and besides who doesn’t like to swap war stories?

One last tip—wear comfortable shoes, as the parties and the conference will require a good deal of walking. Your feet will thank you. Trust me on this.

Have a great show!

- Steve

(Also Read RSA Conference 2012 Preview Part 1: Topics and Trends)

RSA Conference Insider

 

 


view counter
Steve Ragan is a security reporter and contributor for SecurityWeek. Prior to joining the journalism world in 2005, he spent 15 years as a freelance IT contractor focused on endpoint security and security training.