You are hereBlogs / FZ's blog / Tech Blogs Beginning to Pick Up HB Gary / H&W Story

Tech Blogs Beginning to Pick Up HB Gary / H&W Story

By FZ - Posted on 27 February 2011


There was lots of noise and distraction on the crowded Expo floor of the RSA Security Conference this year. After a grueling couple of years, vendors were back in force with big booths, big news and plenty of entertainment designed to attract visitor traffic. Wandering the floor, I saw - variously - magic tricks, a man walking on stilts, a whack-a-mole game, a man dressed in a full suit of armor and a 15 foot long racetrack that I would have killed for when I was 10.

The most telling display, however, may have been the one in Booth 556, where malware forensics firm HBGary displayed a simple sign saying that it had decided to remove its booth and cancel scheduled talks by its executives. This, after the online mischief making group Anonymous broke into the computer systems of the HBGary Federal subsidiary and stole proprietary and confidential information. The HBGary sign stayed up for a couple days, got defaced by someone at the show and was later removed. When I swung by HBGary's booth on Thursday, it was a forlorn and empty patch of brown carpet where a couple marketing types where holding an impromptu bull session.

It would be easy to say that the lesson of HBGary is that "anyone can get hacked." After all, the company's founder, Greg Hoglund is one of the smartest security folks around - hands down. He's a recognized expert on malware and, literally, wrote the book on rootkit programs. HBGary Federal's customers included the U.S. Department of Defense as well as spy agencies like the CIA and NSA.

Or maybe the lesson of HBGary is simply not to "kick the hornet's nest," so to speak: needlessly provoking groups like Anonymous who have shown themselves to be hungry for publicity and have little to lose in a confrontation. Maybe, the lesson is simply that, if you're going to kick the hornet's nest, as HBGary Federal CEO Aaron Barr was determined to, then at least to spend some time securing your Web- and e-mail infrastructure and following password security best practices before you commence said kicking.

But I think the real lesson of the hack - and of the revelations that followed it - is that the IT security industry, having finally gotten the attention of law makers, Pentagon generals and public policy establishment wonks in the Beltway, is now in mortal danger of losing its soul. We've convinced the world that the threat is real - omnipresent and omnipotent. But in our desire to combat it, we are becoming indistinguishable from the folks with the black hats.


Portions of the preceding article were reposted at Both posts received dozens of comments- many of which come from seemingly knowledgable sources and make very interesting reading.