Dark Reading just posted my column for this month, entitled, “11 Truths We Hate To Admit”. Due to a miscommunication with my editor it reads as if I still live in Boulder, Colorado. I’m really down in Phoenix, but spent most of my adult life in Boulder.
DR is a fun publication to write for- they want us to poke the industry with a stick and get people thinking. Nothing I wrote is any big surprise, but they aren’t the kinds of things we tend to publish.
If it doesn’t piss at least a few people off I didn’t do a good job writing the article, although so far the reviews are mostly positive. Damn.
Here’s a snippet:
1. Signature based desktop antivirus is an addiction, not effective security. AV is often the single biggest security expense in an organization, yet it’s one of the least effective. Gateway AV is still a reasonable investment to filter out known garbage, but desktop AV needs to seriously improve its heuristics and other non-signature techniques if it is to protect us. Independent reports indicate current AV products are full of gaping holes, and many organizations experience extensive downtime from bad signatures and poor performance. At least today’s malware doesn’t grind your computer to a halt at noon every Wednesday. 2. The bad guys beat us because they’re agnostic and we’re religious. The bad guys are always innovating for competitive advantage, but innovation isn’t something large organizations or industries do well. We get wrapped up in our own little religious battles over PKI, IDS, standards, AV, whoever we work for at the time, and what’s worked for us before. We become too personally tied to pet projects we’re experienced with — and can’t let go of. 3. Antitrust concerns force Microsoft to weaken security. Host security companies take out full-page ads in the Wall Street Journal and threaten to go to court when Microsoft adds security features that might tread on their turf. Thanks to some poor past behavior by Microsoft, these tactics work. But if it weren’t for the antitrust problems of the past, we’d all have free anti-spyware and AV in Windows, forcing those other companies to compete on merit.