Peter Christy

Trend Turns 20

Trend Micro celebrated its 20th anniversary and held its first industry analyst meeting in NYC. The discussion was anything but backward looking. Trend is taking a sharp (and interesting) turn in their A/V strategy having decided that modern attackers can't be defended against with a client-focused solution -- the attackers are getting too clever at creating dynamic and polymorphic attacks which makes signature files grow without bound, signature file updates intolerable, and the desktop client bloated and slow. Trend's solution is to move more of the analysis and mitigation into the cloud, evolving from a signature file solution to an on-demand analysis solution in which the client queries a cloud service to evaluate a threat not in a local cache. It seems one more piece of evidence of how rapidly SaaS is coming on us. The event gave me a chance to sit down and chat with Trend's charming and energetic founder and CEO -- Eva Chen. I asked Eva how Trend came to be in the A/V business. It's yet another story of ambitious entrepreneurs adapting plans to find the market. Their first idea was terminal emulation software into China, but they knew that without some form of protection their IP (and business) would soon dissipate so they developed a "dongle" that would descramble part of the program if properly attached to a licensed computer. Then they just focused on the dongle/protection business. An early customer complained to Eva that the dongle was damaging their software, and when she investigated she found the residue of one of the earliest viruses to blame, not the dongle, and so they went into the A/V business (and the rest is history as the old saying goes). Trend is an amazingly distributed company (Eva in Pasadena, the CTO in Germany, the head of Enterprise in Boston). It was a real treat to have them all assembled in one place.

Microsoft's Assault on Identity Management

At TechEd Microsoft announced Beta 3 of Identity Life Cycle Manager Version 2, hardly an earthshaking announcement given that the product won't ship for quite a time, but a great opportunity to talk to the ILM team and better understand their current plans. That was pretty eye-opening. First, MS quoted respectable research that says that Active Directory is used as the primary directory in 92% of the F1000. I love confusing market statistics. It would be another thing entirely to say that 90% of F1000 enterprises used AD (and much less interesting). 92% is a pretty stunning number and that context I think that ILM will also be a pretty big thing pretty quickly. A modern identity management system consists of a set of different directories and a scheme for keeping their contents coordinated, typically by use a meta-directory system that understands which subordinate directory is the authoritative source for information that is then shared with others. For example, HR is authoritative for new employees while something in the network assigns them IP addresses. ILM has a meta-directory and coordinates AD and other directories as well. What is innovative in ILM is that the operation takes IT out of the picture except where IT the authoritative source for directory information. For example, HR would provision a new employee record, their manager would define their role and then owners of various assets and services would approve their use based on the role they play. Historically IT would own and run the directory infrastructure and be responsible for making changes. The problem with this design is that IT is rarely the authority for directory information. With ILM business rule and workflow can be specified that define the constraints and process for making directory changes. Microsoft has lots of interesting business rule and workflow mechanisms to bring to bear. In most cases the change approval process is run via forms though the Exchange email solution. The solution design (driven by individuals and the organization, not IT) sounds right, and given Microsoft's dominance already in the core directory business will ILM be the next domino to tip in the favor of Redmond?

Where's Oslo?

(not to be confused with Where's Waldo -- my adorable Corgi) The faithful reader might remember my comments from TechEd 2007 where Microsoft rolled out Dynamic IT, and when I asked Muglia "So Bob, where's the beef?" his answer, in brief was "Oslo," a major effort lead by Robert Wahbe and the Connected Systems part of STB, to improve the ability to build "process led, model driven" complex application structures. Mu's passion made the topic very real, and I've been waiting patiently (not) to see the details. I had hoped Oslo would be out'ed at Mix08, and when that didn't happen at MMS 2008, and when that failed at TechEd 2008. At the TechEd 2008 analyst meeting details of Oslo were still missing, so of course I cornered Mu during a coffee break and asked "So where's Oslo?" Mu rolled his eyes as only an SVP of software development and explained with a somewhat pained face that the Oslo architecture team liked to get things really right so there had been a few unplanned iterations, but that Oslo was alive and well in Redmond and would see the brilliant light of day at PDC 2008 later this year in LA. Am I just the ultimate Microsoft analyst groupie keeping the faith while marketecture is spun into my face, as my network friends believe must be true? Perhaps, but of course I think not. Microsoft is way ahead of the market in having specific plans for addressing the incredible complexity of modern applications ("process led and model driven" maps pretty directly into "lower cost of ownership" in the big picture). I still believe that Oslo will turn out to be important in this context, but I guess I have to wait some more to understand precisely why.

Google Courts Developers

Google held its first full blown developer meeting recently in SF (Google I/O) packing in a big crowd of very bright (and young) geeks (can you imagine how out of place I felt without by iPhone?) The event was informative in any number of ways. Along the lines of "it might be really significant maybe" it was interesting to note that Google couldn't do either registration or feeding very well (certainly not to Microsoft's refined standards) -- do you think it's curious that a company with 2 million servers can't do registration in time for the keynote? More consequentially, in his keynote Google's VP of Developer Relations (and some other stuff) -- Vic Gundotra -- gave a strangely evangelical talk, speaking of how the community had built the Internet, not companies. For a company like Google that prints money this religious fervor all seems somewhat strange until it struck me that Google, unlike Microsoft, doesn't have a lot of experience monetizing software development (most of Google's programming effort is given away and the benefit accrued in advertising delivery). In stark contrast Microsoft (where Vic spent 15 years) understands intimately how their partners, ISP's and VAR's make a buck and how their efforts make Microsoft a lot of money. When Ballmer bellows "I love you!" at a developer conference it may sound corny but I have no doubt that he really means it. I think like the registration and feeding of large crowds, Google doesn't quite have the developer value chain sorted out.

White Listing and Trust

At the Trend Micro analyst meeting Eva Chen was very honest and straightforward about the fact that traditional A/V protection works because someone "dies" (gets infected) so the rest of the tribe can "live" (be protected). For attacks that hit large populations the statistics work out reasonably for this approach but as the attacks get more targeting things look worse. If a malware is specifically designed to get you personally ("SpearPhishing") then the fact that someone has to die doesn't work at all. White listing of files (having repositories of software that is known to be safe) and refusing to execute anything but white listed files is one solution approach. There are major pump priming problems with the approach (not workable until the white lists are comprehensive) but we already know two white list service vendors (SignaCert and Bit9) and various tools to catalog and categorize executables within an enterprise. When questioned Eva thought the approach had merit over time but wouldn't work now. In a recent briefing Kaspersky Labs had more or less the same answer. Let me give you another way to think about the problem. Given the smarmy network we all use, it seems unlikely to be that we can find protection that works transparently and perfectly. A scheme like white listing only works if both software providers and users are motivated to make it work. Think of it like joining a subset of the network that value trust enough to put some effort in. Will there be problems? Will you sometimes be frustrated because software you trust and want to use won't be on the white list? Absolutely! But is that frustration justified by being able to live in a cleaner and safer network (albeit not perfect)? I for one would certainly like to experiment with the concept (trusted email is an analogous idea that we've never been able to collectively reach critical mass).

Structure 08 (the Invisible Elephant in the Room)

GigaOM held an interesting, sold out one day meeting on the emerging Cloud. There was only one flaw, or in fact I am completely over the hill and deluded (a possibility). To listen to the discussion here, Microsoft isn't a player (to be fair to the rest, Microsoft does an amazing job NOT talking about their Live plans). It seems to me that this is at first blush a two-horse race -- Google and Microsoft. SaaS isn't a children's crusade. Eventually it takes huge CapEx and OpEx investments to play. It isn't at all clear that even a $1B player like SalesForce has the financial chops to survive against the big players with big resources. Let's say this was an interesting exploration of ideas but without anyone obviously asking the pivotal business questions. Oh to be one of those "other" analysts that doesn't want to be bothered by the business bits...