Forget "Security Theater." The "Security Circus" is in town...
I wrote this some time ago and decided that I didn't like the tone as it just came out as another whiny complaint against the "man." I'm in a funny mood as I hit a threshold yesterday with all the so-called experts coming out of the woodwork lately, so I figured I'd post it because it made me chortle.
They Shoot Horses, Don't They?
To answer what seems to be a question increasing in frequency due to the surge in my blog's readership lately, as well as being cycled through the gossip mill, I did not change the name of my blog from "Rational Security" to "Rational Survivability" due to IBM's Val Rahmani's charming advertisement keynote at RSA. ;)
One might suggest that Val's use of the mythological reference to Sisyphus wasn't as entertaining as Noonan's "security as the width of two horses' asses" keynote from a couple of years ago, but her punchline served to illustrate the sad state of Information Security, even if it also wanted to make me shoot myself.
Val's shocking admission that IBM was "...exiting the security business," that "...information security was dead," and that we should all celebrate by chanting "...long live [information] sustainability!"
This caused those of us here at Rational Survivability HQ to bow our heads in a moment of silence for the passing of yet another topical meme and catchphrase that has now been "legitimized" by industry and thus must be put out of its misery and never used again.
You say "tomato," I say "tomato..."
Yeah, you might argue that "sustainability" is more business-focused and less military-sounding than "survivability," but it's really about the same concepts.
I'm not going to dissect her speech because that's been done. I have said most of what I have to say on this concept in my posts on Information Survivability and honestly, I think they are as relevant as ever.
You can read the first one here and follow on with the some more, here.
For those of you who weren't around when it happened, I changed the name of my blog over six months ago to illustrate what is akin to the security industry's equivalent of an introduction at an AA meeting and was so perfectly illustrated by Val's fireside chat.
You know the scene. It's where an alcoholic stands up and admits his or her weaknesses for a vice amongst an audience of current and "former" addicts. Hoping for a collective understanding of one's failure and declaring the observed days of committed sobriety to date, the goal is to convince oneself and those around you that the counter's been reset and you've really changed. Despite the possibility of relapse at any moment, the declaration of intent -- the will to live sober -- is all one needs.
That and a damned good sponsor.
And now for something completely different!
That was a bloody depressing analogy, wasn't it? Since this was supposed to be a happy occasion, I found myself challenged to divine an even worse analogy for your viewing pleasure. Here goes.
That's right. I'm going to violate the Prime Directive and go right with the patented Analog Of Barnum & Bailey's Circus:
What Information Security has become is the equivalent of a carnie's dancing poodle in the circus tent of industry.
Secretly we want to see the tigers eat the dude with the whip, but we cheer when he makes them do the Macarena anyway.
We all know that one day, that little Romanian kid on the trapeze is going to miss the triple-lindy and crash to the floor sans net, but we're not willing to do anything about it and it's the tension that makes the act work, despite the exploitative child labor practices and horrible costumes.
We pump $180 in tokens into the ring toss to win an $11 stuffed animal, because it's the effort that counts, not the price.
We're all buying tickets, suffering through the stupid antics of the clowns piling out of the tiny little car in the spotlight hoping that the elephant act at the end of the show is going to be worth the price of admission.
At the end of the night, we leave exhausted, disappointed, broke and smelling like sweaty caramel apples and stale pretzels...wondering when they'll be back next year so we can take the kids.
See, I told you it was awful. But you know what's much worse than my shitty little clown analogy?
Reality.
Come one, come all. Let Me Guess Your Weight!
So in today's time of crappy economics when money is hard to come by, it's now as consumers that we start to pay attention to these practices -- this circus. It's now that we start to demand that these alleged predatory vendors actually solve our business problems and attend to our issues rather than simply recycle the packaging.
So when life hands vendors a lemon, they make marketingade, charge us $4.50 a pop and we still drink it.
Along those lines, many mainstream players have now begun to work their marketing sideshows by pitching the supposedly novel themes of sustainability, survivability, or information centricity. It's a surreptitiously repentant admission that all the peanuts and popcorn they've been selling us while all along we ooh and ahh at the product equivalents of the bearded lady, werewolf children and the world's tallest man still climax at the realization that it's all just an act.
At the end of the night, they count their money, tear down the tents and move on. When the bearded lady gets a better gig, she bails and they bring in the dude with the longest mustache. Hey, hair is hair; it's just packaged differently, and we go to ogle at the newest attraction.
There's no real punchline here folks, just the jaded, bitter and annoyed comments of someone who's becoming more and more like the grumpy folks he always made fun of at bingo night and a stark realization of just how much I hate the circus.
/Hoff
