Suggestions
David Holmes
Forrester Research Analyst for Zero Trust, Security and Risk
David Holmes is a Senior Analyst at Forrester, specializing in advising security and risk professionals on topics such as Zero Trust architecture, network security controls, and cybersecurity strategy. His expertise includes areas like SASE (Secure Access Service Edge), microsegmentation, DNS security, encryption, and DDoS protection. Holmes has been instrumental in helping organizations implement Zero Trust principles, which focus on identity-based access, least privilege enforcement, and breach assumption strategies.13
Before joining Forrester in 2019, Holmes worked extensively in cybersecurity as a software developer and strategist. He has a background in C/C++ programming, focusing on authentication, cryptography, and network protocols. Over the years, he transitioned into roles such as Principal Security Strategist at Shape Security and Security Evangelist at F5 Networks. His career includes significant contributions to research, writing, and public speaking on cybersecurity topics.34
Holmes has presented at major industry conferences like RSA and Infosec Europe and regularly contributes to discussions on the evolution of Zero Trust and its role in modern cybersecurity.12
Highlights
I've been looking into the container security space recently (for my #microsegmentation research). I kept tripping over these terms and not understanding why we had so many words for what I thought was the same thing. After talking with some brilliant people (Lee Sustar, Laudon Williams among them), I have settled on this taxonomy, for the purposes of speaking precisely.
Microservices = an architecture pattern. Serverless = a shared responsibility model. Containers = a packaging format.
What do you think? Is this right?
Last week I hinted about my very specific definition of the term platform (vs portfolio). There was an awesome debate in the thread, which Heidi Shey won with her comparison of Barbie's playhouse to a random collection of action figures. But no one put forward the key differentiation that I use my for my definition:
A platform is a system of technology components on which a third party could build a business application. If that application is one that you, as the builder of the platform, never conceived of, even better. This means that the system must be quite programmable, with rich, documented APIs, and probably an embedded programming language or ability to support third party executables. It should have integrated billing and granular logging (to support that billing) and it should be multitenant.
If you, as a vendor, have an “integrated portfolio” that has all those things except a third party can’t build a business app on it, then it's not a platform by my definition. The requirement that the system be able to run new applications means that there aren’t a lot of opportunities for a cybersecurity platform, which may be what Richard Stiennon was getting at in his blog recently (about PANW's "platform play").
If you want to give me examples of cybersecurity “platforms” that meet my definition, please feel free to educate me in the comments below.
