Michael Davis

So you’ve built a software and service inventory platform that supports both Windows and Linux endpoints through the use of a lightweight agent, but you want to expand market share for it and seem cool & hip with the micro-segmentation crowd.  What are you to do?  Well if your name is Cisco and the product is Tetration you add in the ability to orchestrate the host level firewall be it IPTables or Windows Defender Firewall. 

Now I hear you saying, “Doesn’t Cisco already have a micro-segmentation offering with ACI?”.  And yes, they do but it is tied to rather expensive Nexus 9K series hardware.  So, in a rather un-Cisco like move rather than tying the product to an expensive piece of proprietary hardware, with Tetration one can deploy the management plane on hardware, as a VM or utilize a Cisco managed SaaS service.  This is due to a break from the micro-segmentation model used by ACI where policy enforcement is done at a layer above the protected host.  With Tetration an agent (boo! hiss!) gets installed on every protected host, be it Windows or Linux, to turn policy statements crafted at the management plane into rules in the native Windows Firewall or IP Tables.  This comes with the inherent limitation of only being able to do layer 4 port/protocol security policies with a twist of being able to tell which process is listening or transmitting the traffic.

To automate the process of rule creation as new hosts come online Tetration utilizes policies built around tags.  In theory this is great and provides for a more devops path to security.  But in reality, it takes a fairly mature organization to have their security policies implemented in such a way that applying tags works.  Especially when you start integrating with other environments such as VMware vSphere or border firewalls with their own sets of tags.  Agreement across the board on what a tag means and what attributes are associated with it is critical.

Where Tetration gets interesting, and IMO provides real value, is with the agent installed on every protected host you are provided an inventory of every system.  This inventory includes software (and version) installed, currently running processes, and historically run processes.  So, you can know which of your web servers are vulnerable to Apache Struts bugs and where in your environment you still have SMBv1 running. The inventory data can also be shared with 3rd party tools through a REST API or via Kafka.

I see value in Tetration, but more for mapping out application dependencies and inter-relationships than for providing security.  Whether the value justifies purchase all depends on Cisco’s licensing of the product which is historically one of Cisco’s weak points.  Products typically are priced at a premium, and support renewals are akin to walking barefoot across a bed of salt and broken glass.  It will be interesting to see what sort of foothold Cisco is able to gain with Tetration in what is becoming a crowded segment of host based micro-segmentation with Illumio, Guardicore, Edgewise Networks, and others having a head start.

Thank you to Remi Philippe, Rob Tappenden, and Tim Garner of Cisco for their presentation on Tetration at Security Field Day 4.

If you talk to me about conferences much you’d probably start to call me a broken record for how much I espouse the virtues of the communities that can grow amongst conference attendees.  I regularly tell people that the real value isn’t in cramming a schedule full of sessions (which will generally be recorded) or spending all day on the expo floor loading up on vendor swag, but in meeting and talking with fellow attendees and learning from each other’s experiences.  So attending a conference like Spiceworks’ SpiceWorld, which one could argue is a conference built around a community, was a great experience.  From the opening keynote where CEO Jay Hallberg recognized several community members for contributions, including giving out Spicie Awards to four who went well above and beyond helping others, and other executives attributing product enhancements to user feedback SpiceWorld marched to the beat of it’s own marching band.  Another interesting bit about the conference was a group called The Spice Buddies whom are volunteers that make a point to befriend first time attendees and help make the most of their time at the show.  While oriented primarily toward the SMB crowd, with all but 55 of the 1,000+ organizations and businesses represented falling into that category, I would encourage anyone to attend if the opportunity presented itself.

During my time at SpiceWorld I was afforded the opportunity to speak with CEO Jay Hallberg, SVP of Product & Engineering Manish Dixit and Exec. Director of Products Francois Caron about Spiceworks, the evolution of the company and community, and where the company has been and is headed.  I’ll spare the history lesson, but suffice it to say the execs realized that their first product (an ad supported inventory application) was not where the future of the company lay.  The realization that acting as a trusted broker between the growing community of users and vendors who wanted to sell to those users was the turning point for the company.  From this extended building additional free, ad supported, applications based on user feedback and more recently beginning to offer some apps as a SaaS offering.  The most recent bit of user driven development sees the release of a common code base version of their Help Desk app for cloud and on-prem, allowing for feature parity and faster updates for all users.  The move to SaaS offerings of their existing on-prem applications, and working toward single code bases is the focus going forward.  As a company, Spiceworks is setting the groundwork to reposition themselves as an IT marketplace similar to how Zillow is one for realtors and home buyers.

Thanks again to Touchdown PR and Spiceworks for the invitation to SpiceWorld, and the hospitality during my visit.

This past July Spiceworks surveyed around 800 technology buyers across North American and European markets across a variety of segments for their 2019 State of Future Workplace Tech report.  Among the findings are high levels of interest in deploying IoT, edge computing, artificial intelligence and block-chain based solutions by 2020.  In positive current trends, organizations of all sizes are increasing investments in both security training for employees and tools.  Read the full report here and the press release below.

Also announced today at SpiceWorld Spiceworks also announced a free cloud based inventory application that integrates with their existing cloud based Help Desk and Remote Support applications.  It will scan all IP enabled devices on a network giving the usual inventory details such as OS, hardware details and installed software.  To get started with Spiceworks Inventory head over here, or continue reading below for the full press release.

Spiceworks announced today the integration of A.I. into their platform to bring an increasingly personalized experience to the approximately 20 million people who utilize Spiceworks quarterly.  Fast Answer pages is the first application, and groups the best answers for frequently asked questions together for quick access.  To read more about how Spiceworks plans to utilize A.I. see the press release after the jump.