Interview with Alan Shimel
Alan Shimel is the Chief Strategy Officer at StillSecure.
About StillSecure
StillSecure delivers network security solutions that protect IT business infrastructure. The integrated StillSecure suite includes solutions for network access control, vulnerability management, and intrusion detection/prevention (IDS/IPS). StillSecure manages and reduces risk from network attack and noncompliance for some of the largest organizations in the healthcare, financial services, government, and education sectors.
Ravi> Alan can you elaborate a little more about StillSecure?
Alan> StillSecure is a 6 year old company. Early on we decided to build suite of security products based on a layered security process. Making better firewall or better anti-virus gateway was not what we thought was needed, instead we decided to focus on the following suite of products:
Strata Guard (IDS/IPS): The product is about 4 years. Strata Guard leverages open source components Linux kernel and Mysql plus some of our own proprietary features in an easy to use, efficient solution.
VAM (Vulnerability Management): This product ships with a Nessus scanner but can also work with multiple third party scanners. VAM automates network discovery and scanning, manages remediation through verification and reporting.
Safe Access (Network Access Control): The product uses a “guilty until proven innocent” access model to protect the network. Endpoints are quarantined initially, once the endpoints pass the test they are moved into the regular network. The hottest area we are seeing today is the Network Access Control market.
Ravi> I read on your website that Strata Guard significantly reduces false positives – I am impressed, how does Strata Guard accomplish this?
Alan> False positives are the biggest problem around IDS/ IPS. Rather than build a new IDS engine we used Snort and leveraged our resources to focus on how to reduce false positives, make IDS/IPS more effective while reducing admin time.We have several layers of technology that help reduce false positives:
QuickTune: We start by analyzing your network to enable/disable certain rules as they relate to your network environment. This eliminates the bulk of false positives an admin would see.
Intelligent Profiling: Signature matching coupled with the ability to correlate factors such as time of day and the IP an attack is originating from provide the ability to identify real attacks vs. false positives.
Accessible Device Protection: Network awareness allows Strata Guard to know where devices are plugged in and where inbound attacks are targeted.
Vulnerable Device Protection: Working with our vulnerability management product, VAM, Strata Guard is able to maintain an awareness of which devices on the network are most vulnerable to attack.
All of the above technologies give us the ability to drill down from the following process: first taking action if I see an attack, second to focus on an accessible device and third to take action on a vulnerable device. This level of correlation certainly takes us a long way to eliminate false positives.
Ravi> Strata Guard seems to do everything, it uses signature based detection and anomaly detection, it comes as a software as well as an appliance?
Alan> Strata Guard uses a Snort IDS Engine. Snort is primarily a signature based IDS engine. A few years ago signature based engines were clearly dominant as we listened to the market and to the customer. Recently, anomaly detection techniques have been refined and moreover customers demand quality. If one IDS/IPS does signature based and the other IDS/IPS does anomaly based, correlation between them will be a challenge. The future of IDS/IPS is blended approach like we use in Strata Guard. It does not mean we do as good a job as a pure-play behavior based solution, detecting behavior anomalies alone but we built in key behavior anomaly and protocol analysis ability. By this, customers get the best of both worlds.People who argue signature vs. anomaly is like fighting one religion vs. the other religion; it’s a no win situation. Also, Strata Guard comes as a software appliance (CD) as well as a pre-loaded appliance that provides flexibility for our customers.
Ravi> There 600+ security startups out there, how does StillSecure differentiate itself from other startups?
Alan> In fact there is800+ security startups. StillSecure has a strong pedigree. This is the fifth venture backed company for Rajat Bhargava, our CEO. Rajat has a strong record of success. I too have been involved in many companies and together we know what it takes to build a successful company. We lived through hard times in the market like the bubble burst and 9/11 which forces us to become stronger. Most security startups have a point solution (or just have one product). StillSecure, on the other hand, has a suite of products built around what we call our Enterprise Integration Framework. We interoperate and integrate with third party products and have more than a single API. The whole framework uses HTML/Java, XML API’s which helps to leverage existing investments. A good example of this is our Vulnerability Management Platform, VAM, which is not just a scanner but an entire management console acting with other third party scanners. StillSecure targets medium to large enterprise corporations as well as government private and public sectors. We are seeing phenomenal growth with each of these verticals.
Ravi> What is your vision about StillSecure in five years?
Alan> I wish I had a crystal ball Ravi. Obviously, we did not build this company for a quick exit. We wanted to build a great company. The market keeps changing and evolving and we would like to expand the suite to offer more products to fit these evolving needs. We would also like to make the products even more interoperable.
Ravi> Thanks a lot Alan. I wish you and StillSecure continued success!
If you would like to know more about StillSecure please visit www.stillsecure.com. Alan has an interesting blog, check it out at http://ashimmy.typepad.com/