Value Added Resellers: Trusted Advisor or Used Car Salesperson of Tech?

Let me kick this off with a little background as to how and why I decided to write on this subject. I believe it was late 2014 or early 2015 and I was working for F5 Networks. During one of our Quarterly Business Reviews, we had a guest presenter from Gartner come in and talk about Mode 1 and Mode 2. Couple of items that stuck with me over the years:

  • Embrace change or you will fail
  • 1 in 10 top tech companies will not be around 10 or 20 years from now.
  • Mode 1 is legacy
  • Mode 2 is the future (the cloud)
  • Hybrid (Bimodel IT) will be adopted sooner than later and Mode 1 will be completely retired

This meeting was terrifying for me, I recently started this job and F5 Networks sole business model was Mode 1; traditional and sequential, emphasizing on safe and accuracy. The reassuring part to all of this was, in my particular patch (Arizona and Nevada), Mode 2 adoption was speculated to take 5 or more years to be adopted. This was ideal for me, enough time for me to hone my skills and make a move later down the road if F5 wouldn’t embrace change.

Continue reading Value Added Resellers: Trusted Advisor or Used Car Salesperson of Tech?

Executing Security at Scale

Raise your hand if you’re using any or all of these technologies:

  • NGFW
  • IPS/IDS
  • URL Filter
  • Antivirus
  • DLP
  • Sandbox
  • VPN
  • DDoS Mitigation

Pretty much all of us, right? Now raise your hand if you are decrypting SSL/TLS outbound.

While HTTP/2 doesn’t require SSL/TLS, it will use it by default if it is available. Oh by the way, all modern browsers have supported HTTP/2 since January of 2016. Factor in the efforts of Let’s Encrypt, the adoption of SSL/TLS has skyrocketed in the past few years and will continue to grow. Hell, even this shitty blog is using TLS 🙂 If you aren’t decrypting SSL/TLS you have to ask yourself, what good is my NGFW, IPS, Antivirus, etc if I am completely blind to it? The answer is simple, it isn’t good, in fact it’s terrible. You are bound by the constraints of legacy security, source/destination and ports. It’s like locking a screen door. It will keep the flies out but it won’t stop any real threats.

Continue reading Executing Security at Scale

Bots and users beware, Google’s reCAPTCHA goes invisible

When CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart)  first came out I think we can all agree that it was a giant pain in the ass but some times it was comical.

About 9 years ago (who knew it was older than the original iPhone?), reCAPTCHA was released and got ride of the puzzle solving by simplifying the process to a check box.

Continue reading Bots and users beware, Google’s reCAPTCHA goes invisible