Research

When I was with IPLocks in the 2004 time frame, we were exploring the possibility of selling our monitoring and assessment suite into the government. Friends and contacts made introductions, and we began investigating if there was a need for the solution, and if so, how we would approach tackling that type of relationship. While we knew dealing with the government would be tough, we felt that any organization that is sitting on piles of personally identifiable information and literally hundreds of thousands of databases would be a natural fit for our technology. After a few months of analysis process we decided we couldn’t do it. Too much in the way of time and resources, and too much uncertainty about what we needed to do. Going through the process was simply too long and too difficult for a small company like ours to undertake. We had a technology that could solve problems in different branches of the government, but this is not like the private sector where vendor meets customer, product meets need, and we write up a contract. There are far more demands and restrictions, and the more we learned, the more we felt we will missing basic knowledge of all of the steps in the process. Or even what the process was, for that matter, or which systems integrator we should approach, we did not know if we needed to focus on specific branches of the government, nor were we even aware of all of the accreditations and certifications our product would need to go through. The risk was too great and we walked away. This is a common problem and one to be expected. I run into vendors at every trade shows who are in the same boat; a desire and a good technology fit, not a clue as to where to start. A couple years ago, my friend Robert Rodriguez helped found the IT Security Entrepreneurs forum with the intention of tackling this type of problem and provide a way to “bridge the gap” between Federal agencies and private industry. From his perspective he saw both the desire from the vendors side to participate, but also the need from the government side to have security products that were, how do I say this, from the current decade. But the process does not favor this sort of innovation, rather it is the larger firms that can afford the time and resources to last through the effort, with the smaller and mid sized vendors getting filtered out. Smaller firms with innovative technologies typically cannot compete. Various arms of the US Government are supporting this effort to address the problem by offering educational resources and contacts, and the forum’s web site will host much of that information freely to the public. If you are serious about selling to the government, there is also a conference in March dedicated to this topic, and it is well worth the $400 fee. Past events have had a number of very good speakers from the security industry, academia, DHS and the US Military, along with some very eye-opening comments from the behind-the-scenes administrators who run the procurement side of the process. Once you understand the issues from the other side of the table, it makes things a lot clearer about what you need to do and why. Plus a lot of the VC, resellers and system integrators are in attendance, and they help small firms avoid common mistakes, wasted efforts and provide some plain speaking advice on what you need to do to sell to the government. If you have ever sifted through the online tomes of government requirements written in that special form of legal-ese, you know why that is of value. Share:

Last week I talked a bit on the decision by Microsoft to kill OneCare and release a new, free antivirus package later in 2009. Overall, I stated that I believe this will be good for consumers: I consider this an extremely positive development, and no surprise at all. Back when Microsoft first acquired an AV company I told clients and reporters that Microsoft would first offer a commercial service, then eventually include it in Windows. Antivirus and other malware protections are really something that should be included as an option in the operating system, but due to past indiscretions (antitrust) Microsoft is extremely careful about adding major functionality that competes with third party products. Not everyone shares my belief that this is a positive development for consumers. Kurt Wismer expressed it best: i doubt you need to be a rocket scientist to see the parallels between that scenario and what microsoft did back in the mid-90’s with internet explorer, and i don’t think i need to remind anyone that that was actually not good for users (it resulted in microsoft winning the first browser war and then, in the absence of credible competition, they literally stopped development/innovation for years) … what we don’t want or need is for microsoft (or anyone else, technically, though microsoft has the most potential due to their position) to win the consumer anti-malware war in any comparable sense… it’s bad on a number of different levels – not only is it likely to hurt innovation by taking out the little guys (who tend to be more innovative and less constrained by the this is the way we’ve always done things mindset), but it also creates another example of a technological monoculture… granted we’re only talking about the consumer market, but the consumer market is the low-hanging fruit as far as bot hosts go and while it may sound good to increase the percentage of those machines running av (as graham cluley suggests) if they’re all using the same av it makes it much, much easier for the malware author to create malware that can evade it… That’s an extremely reasonable argument, but I think the market around AV is different. Kurt assumes that there is innovation in today’s AV, and that the monoculture will make AV evasion easier. My belief is that we essentially have both conditions today (low innovation, easy evasion), and the nature of attacks will continue to change rapidly enough to exceed the current capabilities of AV. An attacker, right now, can easily create a virus to evade all current signature and heuristic based AV products. The barrier to entry is extremely low, with malware creation kits with these capabilities widely available. And while I think we are finally starting to see a little more innovation out of AV products, this innovation is external to the signature based system. Here’s why I think Morro will be very positive for consumers: Signature based AV, the main engine I suspect Morro runs on, is no longer overly effective and not where the real innovation will take place. Morro will be forced to innovate like any AV vendor due to the external pressures of the extensive user base of existing AV solutions, changing threats/attacks, and continued pressure from third party AV. Morro will force AV companies to innovate more. Morro essentially kills the signature based portion of the market, forcing the vendors to focus on other areas. The enterprise market will still lean toward third party products, even if AV is included for free in the OS, keeping the innovation pipeline open and ripe to cross back to the consumer market if Since the threat landscape is ever evolving I don’t think we’ll ever hit the same situation we did with Internet Explorer. Yes, we may have a relative monoculture for signatures, but those are easily evadable as it is. At a minimum, Morro will expand the coverage of up-to-date signature based AV and force third party companies to innovate. In a best case scenario, this then feeds back and forces Microsoft to innovate. The AV market isn’t like the browser market; it faces additional external pressures that prevent stagnation for very long. I personally feel the market stagnated for a few years even without Microsoft’s involvement, but it is in the midst of self correcting thanks to new/small vendor innovation, external threats, and customer demand (especially with regards to performance). Morro will only drive even more innovation and consumer benefits, even if it ever fails to innovate itself. Share: