Exabeam: A Remarkable Claim
October 25, 2022
I read “Exabeam New Scale SIEM Enables Security Teams to Detect the Undetectable.” I find the idea expressed in the headline interesting. A commercial firm can spot something that cannot be seen; that is, detect the undetectable. The write up states as a rock solid factoid:
Claimed to be an industry first, Exabeam New-Scale SIEM allows security teams to search query responses across petabytes of hot, warm and cold data in seconds. Organizations can use the service to process logs with limitless scale at sustained speeds of more than 1 million events per second. Key to Exabeam’s offering is the ability to understand normal behavior to detect and prioritize anomalies. Exabeam New-Scale SIEM offers more than 1,800 pre-built correlation rules and more than 1,100 anomaly detection rules that leverage in excess of 750 behavior analytics detection models, which baseline normal behavior.
The write up continues with a blizzard of buzzwords; to wit:
The full list of new Exabeam products includes Security Log Management — cloud-scale log management to ingest, parse, store and search log data with powerful dashboarding and correlation. Exabeam SIEM offers cloud-native SIEM at hyperscale with modern search and powerful correlation, reporting, dashboarding and case management, and Exabeam Fusion provides New-Scale SIEM powered by modern, scalable security log management, powerful behavioral analytics and automated TDIR, according to the company. Exabeam Security Analytics provides automated threat detection powered by user and entity behavior analytics with correlation and threat intelligence. Exabeam Security Investigation is powered by user and entity behavior analytics, correlation rules and threat intelligence, supported by alerting, incident management, automated triage and response workflows.
Now this is not detecting the undetectable. The approach relies on processing data quickly, using anomaly detection methods, and pre-formed rules.
By definition, a pre formed rule is likely to have a tough time detecting the undetectable. Bad actors exploit tried and true security weaknesses, rely on very tough to detect behaviors like a former employee selling a bad actor information about a target’s system, and new exploits cooked up in the case of NSO Group in a small mobile phone shop or in a college class in Iran.
What is notable in the write up is:
The use of SIEM without explaining that the acronym represents “security information and event management.” The bound phrase “security information” means the data marking an exploit or attack. And “event management” means what the cyber security professionals do when the attack succeeds. The entire process is reactive; that is, only after something bad has been identified can action be taken. No awareness means the attack can move forward and continue. The idea of “early warning” means one thing, and detect the undetectable is quite another.
Who is responsible for this detect the undetectable? My view is that it is an art history major now working in marketing.
Detecting the undetectable. More like detecting sloganized marketing about a very serious threat to organizations hungry for dashboarding.
Stephen E Arnold, October 25, 2022
IBM Data Governance Tools
October 21, 2022
Confused about data governance? Just rely on IBM. That is our takeaway from a write-up at TechRepublic, “An Overview of IBM Data Governance Solutions.” Author Aminu Abdullahi begins by describing IBM’s top data tools, though whether “top” here means most popular or most heavily promoted is unknown. First up is Cloud Pak, a cloud-based AI platform made to gather and analyze data from multiple sources. OpenPages both guides users in protecting sensitive data and manages compliance issues. To wrest BI insights from data, users can turn to InfoSphere Optim. Then, of course, there is everything Watson. The post explains the framework that pulls it all together:
“As an organization grows, it’s important to have a plan to protect and manage data. The IBM data governance framework is a set of best practices that helps businesses create an overarching strategy for managing the life cycle of their data. IBM’s data governance practice framework includes four types of control:
- Ensure: Controls for guiding work.
- Assure: Controls for doing work.
- Insure: Controls for operating.
- Reassure: Controls for continuity.
These controls allow companies to identify, protect, manage, monitor and report on their data. They do this by working with their business leaders, functional heads and IT teams across the organization to create unified standards for how companies should use information from creation through disposal. For example, the Identify phase will help establish roles and responsibilities for stakeholders within the organization; Protect will provide guidelines for how to store all types of data securely; Manage can help ensure high-quality information; Monitor can give insight into what’s happening with information assets. Finally, Report covers tools that generate comprehensive reports on all aspects of data management. The framework helps build an environment where accountability and responsibility are clear across the enterprise.”
So IBM is a one-stop shop for responsible and profitable data management, if you will. The post concludes by noting these tools have received rave reviews from current users. We wonder, though, how many of those users have any basis for comparison. We ask, “Can’t Watson do this?”
Cynthia Murrell, October 21, 2022
The Google Virtual Private Network Is Sufficiently Unprivate So Google Can Show You Ads
October 20, 2022
Ads are as American as apple pie for Internet users. Ads allow companies and smaller businesses to make a profit from their products and services. Usually, ad revenues help keep products and services free. Large tech companies, like Google, Apple, Amazon, and Facebook, have other income streams than ads, so ad blockers are not harming their bottom lines. Google, however, is counting every red cent, because they are pulling the plug on VPN ad blockers says Blokada: “Google Cracks Down On VPN Based Adblockers.”
Under the guise of improving performance and security, Google has revamped its developer policy for the Play Store. The changes go into effect throughout the remainder of 2022. Changes to VPN ad blockers take effect in November 2022:
“One of the main policy changes concerns the VPN Service which will take effect on November 1, 2022: Google claims to be cracking down on apps that are using the VPN service to track user data or rerouting user traffic to earn money through ads. However, these policy changes also apply to apps that use the service to filter traffic locally on the device. Apps such as Blokada v5 and Duck Duck Go. Specifically the policy does not allow for ‘Manipulating ads that can impact apps monetization’.”
Blokada is a popular ad blocked for mobile and VPN services. The new Google Play Store policy sounds like it would hurt Blokada users, but its developers found a way to circumvent it. Blokada no longer requires a local VPN, instead, it uses cloud filtering. The advantage to cloud filtering, other than not violating Google policy, is it does not affect network speed, device speed, or battery life.
Other VPN users will be viewing ads, lots of ads, if they do not find their own Play Store policy loophole. Google will probably find a way to prevent these loopholes because innovative Google has improved the GoTo, Overture, and Yahoo systems, of course.
Whitney Grace, October 20, 2022
Metazuck: An All Too Common Response in Silicon Valley Land
October 17, 2022
“How TikTok Ate the Internet” is a business school write up which contains some interesting data; for example:
The web’s most popular app [TikTok] has reshaped American culture, hypnotized the world and sparked a battle between two global superpowers…TikTok’s website was visited last year more often than Google. No app has grown faster past a billion users, and more than 100 million of them are in the United States, roughly a third of the country. The average American viewer watches TikTok for 80 minutes a day — more than the time spent on Facebook and Instagram, combined.
I think this means is that TikTok is the next big thing… after almost a decade in the gloomy bedrooms of teens.
Fortune Magazine explains “Mark Zuckerberg admits he missed a social networking trend that led to the TikTok boom.” How is this possible? Easy. Facebook or the Zuckbook just missed the next big thing. Money and legal woes can distract I suppose.
Now the Zucker wants to catch up. One article has the interesting title “Meta Has Burned $15 billion Trying to Build the Metaverse — And Nobody’s Saying Exactly Where the Money Went.” The write up focuses on using money to leap frog the next big thing. Okay, that may work, but I don’t think tech gurus on the way down can buy their way back up.
What’s my view of the Zucker’s situation? Think about a person watching a hauspex chop out a goat’s liver. The spectacle and the solemnity of the event fuels the hope that the desired outcome will be foretold. Sure it is.
In terms of Silicon Valley, the idea is that money divines the future. How does one deal with TikTok and a decided lack of enthusiasm for spending time in a cartoon without legs or a way to send a text?
Money.
Let’s take a helicopter to 3,000 feet and check out the lay of the Silicon Valley method.
- Spending money to “apply” technology is the best way to fix a problem. Is the logic, “Hey, this worked for the iPhone, and it will work in the TikTok situation.”
- The mental frame for solving problems ignores soft factors like users who want and need to use the TikTok content experience. Social graphs and knock off service. Thank you, no.
- The cloud of misperception is “a certain blindness” which is touchingly centered in Silicon Valley it seems from my helicopter.
Is the problem China and super algorithms?
First, TikTok’s method is not that sophisticated based on our examination of the system. Sure, the surveillance stuff is good, but that’s old hat in the intelware game. Everyone attributes technological wizardry to TikTok. Some influence? Sure. But the drip of digital anesthesia is easier and more fun when administered in the somewhat negative post Covid world.
Second, the Chinese government is not exactly the world’s most progressive institution. Bureaucrats recognized an opportunity to inject content and took it.
Third, the Silicon Valley mindset arrived late and the high speed train had departed the station. Buying a train does not deliver a way to catch up. What about building a rocket ship?
Net net: Long shot.
Stephen E Arnold, October 17, 2022
Silicon Valley Follies: Fodder for a Video Series
October 14, 2022
Quite an interesting few days.
First, Microsoft demonstrated “meta” thinking in two ways. The friendly company bonded with the real Meta (the Zuckbook in my lingo) to put the legless electronic game thing in Teams. Yeah, cool. Read more in “Meta Platforms: Microsoft Partnership and New VR/AR Device.” The Softies announced a consulting chestnut. Microsoft moved from selling Word (a standalone app), to flogging Office (a bundle of apps which contained Word), and now to Office 365 (a subscription to a collection of apps). That in consultant speak is “popping up a level” or a meta-move (not to be confused with Zuck think, please). Read more about this thinking and branding play in “Microsoft Office Will Be Replaced by Microsoft 365 As Part of Its Ongoing Refresh.”
A second interesting development was Google’s illustration of tightly integrated coordination among its operating units. The company killed Stadia, the earth shaking online gaming platform. You can read about one incisive strategic move in “When Stadia Dies, It’s Taking Its Platform-Exclusive Game Outcasters with It.” Then Google announced Chromebooks set up for online gaming.” You can read about this easy-to-understand complement to the termination of Stadia in “Google Introduces Chromebooks Geared for Cloud Gaming.” Definitely a clever chess move.
But the highlight for me was management acumen at Amazon and Google. “Google Datacenter Contractors Claim Retaliation for Talking Workers’ Rights” reports:
Amazon has also been fending off attempts by its workers to unionize. It stands accused of harassing union organizers, according to a consolidated complaint filed earlier this month for which it was due to lodge a response last week. The workers allege that in the months before the failed unionization attempt at its LDJ5 warehouse on Staten Island in May, they were harassed for displaying pro-union material in their downtime, among other things. Amazon told us at the time: “These allegations are completely without merit and we look forward to showing that through the process.”
And the Google followed what appears to be a similar management playbook. The article says:
The union is claiming that when Allied Universal was brought in as a replacement for a previous security contractor for Google Data Centers, workers were allegedly told they were no longer entitled to the minimum standard of benefits Google guarantees for all extended workers. Google uses the term “extended workforce” to refer to contractors, contract workers, and independent companies who work for the search giant.
True or false? Who knows. I enjoy the discussion of these management-staff and management-contractor interactions. Slick stuff.
The spirit of the science club (the metaverse avatars will have legs soon) and the thirst for power (monopolies anyone?) are alive and well. Despite the downturn in Silicon Valley’s fortunes, the spirit of the mythical land of unicorns is thriving.
Stephen E Arnold, October 14, 2022
Cyber Security: The Stew Is Stirred
October 12, 2022
Cyber security, in my opinion, is often an oxymoron. Cyber issues go up; cyber vendors’ marketing clicks up a notch. The companies with cyber security issues keeps pace. Who wins this cat-and-mouse ménage a trois? The answer is the back actors and the stakeholders in the cyber security vendors with the best marketing.
Now the game is changing from cyber roulette, which has been mostly unwinnable to digital poker.
Here’s how the new game works if the information in “With Security Revenue Surging, CrowdStrike Wants to Be a Broader Enterprise IT Player” is on the money. I have to keep reminding myself that if there is cheating in competitive fishing, chess, and poker, there might be some Fancy Dancing at the cyber security hoe down.
The write up points out that CrowdStrike, a cyber security vendor, wants to pull a “meta” play; that is, the company’s management team wants to pop up a level. The idea is that cyber security is a platform. The “platform” concept means that other products and services should and will plug into the core system. Think of an oil rig which supports the drill, the pumps, spare parts, and the mess hall. Everyone has to use the mess hall and other essential facilities.
The article says:
Already one of the biggest names in cybersecurity for the past decade, CrowdStrike now aspires to become a more important player in areas within the wider IT landscape such as data observability and IT operations…
Google and Microsoft are outfits which may have to respond to the CrowdStrike “pop up a level” tactic. Google’s full page ads in the dead tree version of the Wall Street Journal and Microsoft’s on-going security laugh parade may not be enough to prevent CrowdStrike from:
- Contacting big companies victimized by lousy security provided by some competitors (Hello, Microsoft client. Did you know….)
- Getting a group of executives hurt in the bonus department by soaring cyber security costs
- Closing deals which automatically cut into both the big competitors’ and the small providers’ deals with these important clients.
The write up cites a mid tier consulting firm as a source of high value “proof” of the CrowdStrike concept. The write up offers this:
IDC figures have shown CrowdStrike in the lead on endpoint security market share, with 12.6% of the market in 2021, compared to 11.2% for Microsoft. CrowdStrike’s growth of 68% in the market last year, however, was surpassed by Microsoft’s growth of nearly 82%, according to the IDC figures.
CrowdStrike’s approach is to pitch a “single agent architecture.” Is this accurate? Sure, it’s marketing, and marketing matters.
Our research suggests that cyber security remains a “reaction” game. Something happens or a new gaffe is exploited, and the cyber security vendors react. The bad actors then move on. The result is that billions in revenue are generated for cyber security vendors who sell solutions after something has been breached.
Is there an end to this weird escalation? Possibly but that would require better engineering from the git go, government regulations for vendors whose solutions are not secure, and stronger enforcement action at the point of distribution. (Yes, ISPs and network providers, I am talking about you.)
Net net: Cyber security will become a market sector to watch. Some darned creative marketing will be on display. Meanwhile as the English majors write copy, the bad actors will be exploiting old and new loopholes.
Stephen E Arnold, October 12, 2022
Wonderful Statement about Baked In Search Bias
October 12, 2022
I was scanning the comments related to the HackerNews’ post for this article: “Google’s Million’s of Search Results Are Not Being Served in the Later Pages Search Results.”
Sailfast made this comment at this link:
Yeah – as someone that has run production search clusters before on technologies like Elastic / open search, deep pagination is rarely used and an extremely annoying edge case that takes your cluster memory to zero. I found it best to optimize for whatever is a reasonable but useful for users while also preventing any really seriously resource intensive but low value queries (mostly bots / folks trying to mess with your site) to some number that will work with your server main node memory limits.
The comment outlines a facet of search which is not often discussed.
First, the search plumbing imposes certain constraints. The idea of “all” information is one that many carry around like a trusted portmanteau. What are the constraints of the actual search system available or in use?
Second, optimization is a fancy word that translates to one or more engineers deciding what to do; for example, change a Bayesian prior assumption, trim content based on server latency, filter results by domain, etc.
Third, manipulation of the search system itself by software scripts or “bots” force engineers to figure out what signals are okay and which are not okay. It is possible to inject poisoned numerical strings or phrases into a content stream and manipulate the search system. (Hey, thank you, search engine optimization researchers and information warfare professionals. Great work.)
When I meet a younger person who says, “I am a search expert”, I just shake my head. Even open source intelligence experts display that they live in a cloud of unknowing about search. Most of these professionals are unaware that their “research” comes from Google search and maps.
Net net: Search and retrieval systems manifest bias, from the engineers, from the content itself, from the algorithms, and from user interfaces themselves. That’s why I say in my lectures, “Life is easier if one just believes everything one encounters online.” Thinking in a different way is difficult, requires specialist knowledge, and a willingness to verify… everything.
Stephen E Arnold, October 12, 2022
Elastic: Bouncing Along
October 12, 2022
It seems like open-source search is under pressure. We learn from SiliconAngle that “Elastic Delivers Strong Revenue Growth and Beats Expectations, but Its Stock is Down.” For anyone unfamiliar with Elastic, writer Mike Wheatley describes the company’s integral relationship with open-source software:
“The company sells a commercial version of the popular open-source Elasticsearch platform. Elasticsearch is used by enterprises to store, search and analyze massive volumes of structured and unstructured data. It allows them to do this very quickly, in close to real time. The platform serves as the underlying engine for millions of applications that have complex search features and requirements. In addition to Elasticsearch, Elastic also sells application observability tools that help companies to track network performance, as well as threat detection software.”
Could it be that recent concerns about open-source security issues are more important to investors than fiscal success? The write-up shares some details from the company’s press release:
“The company reported a loss before certain costs such as stock compensation of 15 cents per share, coming in ahead of Wall Street analysts’ consensus estimate of a 17-cent-per-share loss. Meanwhile, Elastic’s revenue grew by 30% year-over-year, to $250.1 million, beating the consensus estimate of $246.2 million. On a constant currency basis, Elastic’s revenue rose 34%. Altogether, Elastic posted a net loss of $69.6 million, more than double the $34.4 million loss it reported in the year-ago period.”
Elastic emphatically accentuates the positive—like the dramatic growth of its cloud-based business and its flourishing subscription base. See the source article or the press release for more details. We are curious to see whether the company’s new chief product officer Ken Exner can find a way to circumvent open-source’s inherent weaknesses. Exner used to work at Amazon overseeing AWS Developer Tools. Founded in 2012, Elastic is based in Mountain View, California.
Cynthia Murrell, October 12, 2022
Google: Business Intelligence, Its Next Ad Business
October 11, 2022
Google has been a busy beaver. One example popped out of a ho hum write up about Google management’s approach to freebies. The write up “Google’s CEO Faced Intense Pushback from Employees at a Town Hall. His 2-Sentence Response was Smart Leadership” contains a rather startling point, if the article is accurate. Here’s the passage which is presumably a direct quote from Sundar Pichai, the top Googler:
Look, I hope all of you are reading the news, externally. The fact that you know, we are being a bit more responsible through one of the toughest macroeconomic conditions underway in the past decade, I think it’s important that as a company, we pull together to get through moments like this.
Did you see the crazy admission: “being a bit more responsible”. Doesn’t this mean that the company has been irresponsible prior to this announcement. I find that amusing: More responsible. Does responsibility extend beyond Foosball and into transparency about alleged online ad fraud or the handling of personnel matters such as the Dr. Timnit Gebru example?
But to the business at hand: Business intelligence. Like enterprise search and artificial intelligence, I am not exactly sure what business intelligence means. To the people who use spreadsheets like Microsoft Excel, rows and columns of data are “business intelligence.” But there must be more than redos of Lotus 1-2-3?
Yes, there are different ways to “do” business intelligence. These range from listening in a coffee shop to buying data from a third party provider and stuffing the information into Maltego to spot previously unnoticed relationships. And there are, of course, companies eager to deliver search based applications to make finding a competitor’s proposal to a government agency easier than figuring out which Google Dork to use.
“Google Days It’s Cracked the Code to Business Intelligence” explains that the Google is going to make BI as business intelligence is known to those in the know the King of the Mountain. I noted this passage:
In business intelligence [BI], “there was always this idea of governing BI and of self-service, and there was no reconciliation of the degree of trust and the degree of flexibility,” Google’s Gerrit Kazmaier told reporters last week, ahead of the Google Cloud Next conference. “At Google, I think we have cracked that code to how you get trust and confidence of data with the flexibility and agility of self-service.”
This buzzword infused statement raises several fascinating ideas. Let’s look at a couple of them, shall we?
First, the idea of “governance.” That’s a term to which I can say I don’t know what the heck it means. But the notion of “governance” and “trust” is that somehow the two glittering generalities are what Google has “cracked.” I must say, “What’s the meaning, Gerrit Kazmaier?”
Second, I noted three buzzwords strung together like faux silver skulls on a raver’s necklace: Trust, confidence, flexibility, and agility. To me, these words mean that more users want a point-and-click solution to answer a question about a competitor or the downstream impacts of an event like sanctions on China. The reality is that like the first buzzword, these don’t communicate, they evoke. The intention is that Mother Google will deliver business intelligence.
The solution, however, is not one Google crafted. The company’s professionals could not develop a business intelligence solution. Google had to buy one. Thus, the code cracking was purchased in the form of a company called Looker. The appeal of the Looker solution is that the user does not have to figure out data sources, determine if the data are valid, wrestle to get the data normalized, run tests to determine if the data set meets the requirements of a first year statistics class problem, and figure out what one needs to know. Google will make these steps invisible and reduce knowledge work to clicking an icon. There you go. To be fair, other companies have similar goals. These range from well known US companies to small firms in Armenia. Everyone wants to generate money from easy business intelligence.
Google is an online advertising business. The company wants to knock Microsoft off its perch as the default vendor to business and government. The Department of Defense is going to embrace the Google Cloud. I am not sure that some DoD analysts will release their grip on Microsoft PowerPoint, however.
Can a company trust Google? Does Google have a mechanism for governance for data handling, managing its professional staff (hello, Dr. Gebru), and ensuring that automated advertising systems are straight and true? Does Google abandon projects without thinking too much about consequences (hello, Stadia developers and customers)?
My hunch is that reducing business intelligence from a craft to a mouse click sets the stage for:
- Potential embedded and intentional data bias
- Rapid ill-informed decisions by users
- A way to inject advertising into a service application and personalization.
Will the days of the free car washes return to the Google parking lot? Will having meetings in a tree house in the London office become a thing again? Will Google displace other vendors delivering search based applications which engage the user in performing thoughtful analyses?
Time will provide the answer or rather Looker will provide the answer. Google will collect the money.
Stephen E Arnold, October 11, 2022
The Confessions of Saint Ad-gustine
October 7, 2022
I read an interesting and at times amusing “confession.” A crime? No, more like soft fraud.
The write up is called “A Lot of Waiting, Watching and Partying while Rome burns’: Confessions of an Ad Tech Exec on the Third-Party Cookie Delay.”
I learned:
Ad tech is probably the least customer empathetic industry… it seems like there are a lot of agencies not asking pointed questions because they don’t want pointed answers. It’s kind of like, “I didn’t hear that,” like they want to take things at face value out of either ignorance or self preservation.
Perhaps the fraud is not that soft: Less Charmin and more casino. The players are the house (co-owned by some well known Big Tech outfits), the middle facilitators (the anonymous ad tech expert perhaps), and the people with money to buy ads stuffed in front of the users who presumably will buy something).
The write up presents:
But it feels like you’re in the middle of a river with a very strong current heading in a very specific direction. At best, you’ll be able to hold on to this rock for a while. It’s not like where it was before. You’re never going to be able to get to where you were before. Anyone that tells you they can get you there is probably lying or doing something illegal. It’s only a matter of time before you fall asleep and let go of the rock.
I think this means people or something will die or just smash a leg or jaw. Death of injury. Nice.
Is there a bright spot in online advertising? Sure, it wouldn’t be an anonymous revelation without some hope. Saint Augustine counted on a higher power, maybe a bit like a Google-type outfit?
Here’s the cloud with the silver lining:
It’s not all doom and gloom. There are people doing interesting things, working to incrementally fix stuff. But it’s only a matter of time. People aren’t going to be like, “You know what? Less privacy is a great idea!” Consumers are never going to do that. No one is ever going to be happy about that. I would like the industry to get over its own delusions and meaningfully embrace something that works for publishers, works for ad tech companies, works for advertisers and level-set expectations as a new norm.
Moving. Will the confessions of Saint Ad-gustine be studied for centuries? Sure, ad tech wizards are into centuries as long as the inventory is sold and replenished in seconds.
Stephen E Arnold, October 7, 2022
-
- Subscribe to Beyond Search
Feature archive
News archive
-
