What Drives Security Innovation?
According to the time tracking feature of my Wii (which you can’t disable, nice parental feature), I played 3 hours and 46 minutes of Guitar Hero III last night after picking it up at Target. I have to fully admit I was skeptical of the whole Guitar Hero thing when it first came out, but it’s incredibly addictive. And not just when I’m drunk at a Christmas party. Not that I’d drink at a Christmas party and play video games. That wouldn’t be proper behavior for a non-practicing Jew. I’ve been gaming my entire life but have definitely strayed the past few years. Sure, there was plenty of compelling game content, but nothing really innovative. I don’t have the time for something like World of Warcraft, and some of the coolest games were so difficult that us mere mortals who just wanted to pick them up for an hour or two a week were totally excluded. Then comes the Wii, where the simplest of games take no learning but entertain for hours on end. Sure, the graphics aren’t that great, but that’s not the point. I’m loving that I can pick it up for 15 minutes and actually get something out of it; be it a quick game of te is, a few rounds of golf, or a couple of songs on the guitar. Nintendo rethought gaming and made it fun again. For everyone, not just the hard core. Oh wait, this is my security blog. Got it, so what the heck does the Wii have to do with security? Other than fuzzing the browser? Innovation my friends, innovation. (This post is inspired by some conversations over the past few months with Chris Hoff, based on his disruptive innovation series). Nintendo knew they couldn’t beat Sony and Microsoft head-on, so they tossed out the rules and changed the game. By focusing on casual gaming and a younger audience they didn’t fight for existing market share- they grew the entire market. Innovation in business is nearly always driven by the same need- competitive advantage. Either you innovate to create it, innovate to regain it, or innovate to increase efficiency and thus profitability. Nintendo made two major breaks with the rest of the industry- they designed a console they could sell at a profit out of the gate (MS and Sony lose money on every box and make it up with games). Then they changed the entire game interaction mechanism to appeal to a wider audience. But security follows different rules. We have very little control of the environment around us in security. As much as we like to get ahead of the game, we are responsive by the nature of our mission. Innovation is driven through three needs: Improving Efficiency: The one driver we share with the business. By increasing efficiency, we reduce costs and improve effectiveness, thus contributing to the bottom line. Responding to Threats: The bad guys are just like a business- they innovate to improve the top line, but at the expense of our bottom line. We can never fully predict their innovation, and as they come up with new attacks we are forced to respond with new defenses. Responding to Business Innovation: Just as the bad guys are looking for competitive advantage, so are the businesses we support. They adopt new technologies before we’re fully able to understand and protect them. Just when we have our program operationalized, someone comes up with a new business initiative (Web 2.0 anyone?) or internal technology. Most pundits (and startups, and investors, and…) fail to accurately predict the future of security because they fail to account for all three drivers. Most often, they look at pure threats without accounting for either efficiency or business innovation. Or, they look at business innovation solely as a threat, rather than an opportunity for security innovation (or the related problem- by the time they recognize the business innovation it’s already in production, and thus a new risk/threat). When you look at security innovation, either to predict next year’s budget or to predict the market in three years, study the world around you. Understand your business and general technology trends as deeply as the threats. Pay particular attention to business technology trends, like the consumerization of IT, that change the game. In many cases we can make decisions today that make our lives much easier when that business or threat innovation is in full swing. It’s your opportunity to get ahead of the curve and look like a freaking genius. < p style=”text-align:right;font-size:10px;”>Technorati Tags: Security Innovation Share:
