Subscribe to the Free Print Edition!
Celebrating 25 Years

GCN Home > 06/20/05 issue

Dan Farmer | Network security: a devilish mess

Interview with Dan Farmer, chief technology officer of Elemental Security Inc.

By Brad Grimes, GCN Staff

In the aftermath of the Sept. 11 terrorist attacks, the Defense Department called on IT experts to help assess the security of public networks in the event of a cyberattack on the United States. Among the luminaries who converged on the Pentagon, including founders of Google Inc., Netscape Communications Corp. and Yahoo Inc., was Dan Farmer, current chief technology officer of Elemental Security Inc., former Marine, and conscientious objector to the first Persian Gulf War. He’s also the guy who arguably put network security on the map.

Today Farmer jokes good-naturedly about being the only tech expert in the room who hadn’t gotten “fabulously wealthy” off the Internet, but his influence on networking is well respected. He has spoken before Congress, co-authored a book on computer forensics and testified against the music-swapping service Napster on behalf of the recording industry (for which he received a gold record).

But perhaps most important is his relationship with SATAN, the Security Administrator’s Tool for Analyzing Networks, which he helped develop in 1995. Before SATAN, few IT administrators thought about network security or how hackers could break into their systems. Much to their discomfort, Farmer showed them.

In April, Farmer and Elemental Security introduced their first product, a program that helps network administrators set and enforce security policies. He spoke to GCN technology editor Brad Grimes.

GCN: Tell us about the origins of SATAN, the Security Administrator’s Tool for Analyzing Networks.

FARMER: In 1993 I wrote a paper with my longtime co-author Wietse Venema in which we laid out how people break into systems. Security was starting to get some interest at that time, but people really didn’t understand how it was possible to compromise systems, or how hard it was, or what the difference was between network- and host-level security. So we wrote a paper and said look, if you want to get serious about security, you need to know how people are breaking into your systems and check them out yourself, see if you can break into your own systems. As an appendix to that book we had a brief little mention that we were working on a tool called SATAN.

More news on related topics: IT Security, Defense IT, Enterprise Architecture, Homeland Security, IT Infrastructure



GCN Popup