Peter Christy

Cisco / IronPort -- A Spam Inflection Point?

I was going to write a depressed tirade for the newsletter about how little apparent industry cooperation exists against spam. Then, in the middle of my funk, Cisco announced the intention to acquire IronPort. What’s exciting about that (potentially) is Cisco’s dominance in enterprise network (they aren’t allowed to say that but I am) and IronPort’s reputation information. IronPort has exploited reputation information from the beginning and it’s my belief that it provides the most important single factor in practical spam control. What, I ask, would happen if that reputation information was all of a sudden broadly available to Cisco switch and router users? In theory that would be exciting and meaningful, although there are no shortage of reasons why it might not happen, including but not limited to: (1) the acquisition not going through, (2) Cisco really operating IronPort as an autonomous division and not aggressively commingling the technology and (3) the Cisco network guys thinking it’s a bad idea. In the past some of Cisco’s most distinguished engineers have argued eloquently (if wrong) that associating reputation with IP numbers is bad thinking. I guess I’ll just have to wait and see, and keep that depressive tirade fresh and ready to use.

Rootkits, the next Big Thing?

Do you remember the spam investment wave where any new twist on Bayesian filtering could get funded? What about the spyware wave? In both those cases the question was primarily when the big security companies could get adequate solutions to the problem, much less the need for new technology.  We're at the same place with root kits, those nasty infections where the malware clever buggers the operating system so that any detection system that uses the operating system will be fooled. Has the stock of brilliant computer science PhD's just gone up or are we only waiting for the giants to catch up with the threats?  Our rent money is on the latter, but then we're known to be old fogies and may have missed the boat again.

Content Delivery 2006

John had a chance to attend the Akamai Industry Analyst Day (and BoSox game) and Peter missed it when leveled by a back-to-school virus. As recompense however, Peter had a wonderful meeting with Paul Sagan and Mike Afergan. Paul has been at Akamai from the beginning and CEO for some time now. I've had great discussions with Paul in the past on some of the litigation that Akamai ended up in the middle of (and the broader question of patent protection) and it's always great to see him. Mike has inherited the impossible task as Akamai CTO filling the shoes of founder Danny Lewin.  Mike is definitely out of the Danny mold (went back to MIT to do a PhD on Computer Science and Game Theory) and comes closest to replacing Danny and the great discussions I had with Danny during the hey day.  Akamai is a unique company because of how much they understand about the actual operation of the Internet (that's where it all started at MIT) and they are my authoritative source on the state of the Internet. Compared to the Analyst Day and ignoring Fenway Park for the moment, I think I ended up with the better encounter!

Peeling the EMC Onion

In our last issue we mentioned an interesting EMC product called Infoscape targeting content discovery.  Last week, EMC held a briefing to introduce the NLayers offering within the context of the evolving SMARTS product line. Anyone who is not impressed with what can be done using network information should take a look at this offering.  NLayers' market success was based on what the product could do by just lurking and looking at network traffic.  Big companies like GE under compliance pressures found great value in a system that could quickly create an "as built" model of the existing software infrastructure without getting buy-in from the 100 or so different department that would be needed with more explicit approaches (ones that required suitable access permissions). In this mode of operation NLayers sniffs network traffic and builds the software configuration model based on what is seen. The product offering can do more if given permission to access file data or if agents are placed on servers, but even in lurking mode the reaction from many is probably "How the f*& did it do that?" The question they should probably be asking is "What else can you do with that data?"

Back to the Future

For those of us who have tracked Internet caching more or less from the beginning, it marks the end of an era to see Blue Coat (nee CacheFlow) acquire the caching business from NetApp. NetApp got into the caching business by buying Peter Danzig's company; Peter can reasonably be thought of as one of caching's founding fathers because of the Squid proxy code he had created earlier in academia that formed the beginning for many commercial offerings. The deal included some additional financing which allowed Blue Coat to make the acquisition and put some money in the bank perhaps to make another big move.  The NetApp product team in India stays with NetApp so Blue Coat is really buying access to the NetApp customer base along with the product line, an attractive target given NetApp's blue ribbon filer customers. Although we doubt that Blue Coat will revert to the CacheFlow name, with this acquisition and Blue Coat's latest product announcements the business has swung a lot back from security to the use of advanced proxy technology for acceleration -- sort of déjà vu all over again.