Share via

RSA 2008 - Day 3: Breakfast with the MSAT and Cruising the Expo

  • Article

RSA2008

Who Doesn't Like Breakfast?

Sort of a slow day here at RSA today. My guess is that all those parties sort of took their toll on the majority of the attendees. I got up early to catch up on some schoolwork (yes....the quest for the elusive MBA continues, even when I'm traveling.....) and then headed down for breakfast with Thomas Dawkins, the guy on my team who handles Microsoft's partnerships with the industry associations like ISSA, ISACA, ASIS, etc. He also is single-handedly responsible for the creation of one of the best security tools you'll find: The Microsoft Security Assessment Tool. If you haven't had the opportunity to check out this tool....go get it...it's one of the most comprehensive security business tools you will find. Here's the summary from the download site:

The Microsoft Security Assessment Tool 3.5 is the revised version of the original Microsoft Security Risk Self-Assessment Tool (MSRSAT), released in 2004 and the Microsoft Security Assessment Tool 2.0 released in 2006. Security issues have evolved since 2004 so additional questions and answers were needed to ensure you had a comprehensive toolset to become more aware of the evolving security threat landscape that could impact your organization.

The tool employs a holistic approach to measuring your security posture by covering topics across people, process, and technology. Findings are coupled with prescriptive guidance and recommended mitigation efforts, including links to more information for additional industry guidance. These resources may assist you in keeping you aware of specific tools and methods that can help change the security posture of your IT environment. There are three assessments that define the Microsoft Security Assessment Tool:

  • Business Risk Profile Assessment
  • Defense in Depth Assessment (UPDATED)
  • Mid-Market Security Core Infrastructure Operations Assessment (NEW)

The questions identified in the survey portion of the tool and the associated answers are derived from commonly accepted best practices around security, both general and specific. The questions and the recommendations that the tool offers are based on standards such as ISO 17799 and NIST-800.x, as well as recommendations and prescriptive guidance from Microsoft’s Trustworthy Computing Group and additional security resources valued in the industry.

After completing an Assessment, you will gain access to a detailed report of your results. You may also compare your results with those of your peers (by industry and company size), provided that you upload your results anonymously to the secure MSAT Web server. When you upload your data the application will simultaneously retrieve the most recent data available. To be able to provide this comparative data, we need customers such as you to upload their information. All information is kept strictly confidential and no personally identifiable information whatsoever will be sent.

Like I said....good stuff.

The Expo: Day Last

When you speak at as many conferences as I do, you tend to get a bit jaded with the overwhelming amount of vendors that seem to be trying every single gimmick to get you over to their booth. I know these companies pay a LOT of money for the spaces that they get, and the want to maximize the traffic that moves near their area. It's all about marketing, I s'pose. This year I saw a lot of Guitar Hero III, booth babes, security game shows, whack-a-virus (like whack-a-mole) and tons of other lights and shiny objects. Of course, the big vendors (Microsoft included) had the prime real-estate, but it was good to see some of the smaller companies, as well as non-profits and colleges getting some room as well. Good turnout, but I really didn't want to spend another day wandering through the cavernous Expo Hall with over 2,000 security vendors. I decided to head back to my room to get some actual work done.

Tomorrow is the last day for me here (unless American Airlines cancels my MD-80 home to Dallas, which means I'll enjoy another day in San Francisco). I plan on hitting the sessions on virtualization security, as well as one on the criminal underground and the recent threat landscape there. It should be a good one. Oh yeah.....one of the BEST THINGS about RSA is that ALL...of the session decks are handed to you on a 2GB USB device when you register. You always have all the slides, so if you miss a session or want to email the speaker later....you can. Genius!

NBC's The Office started back up tonight, so that was not to be missed as well!

Comments