Peter Christy

The Red, White and Black

Our friend Oliver Friedrichs from the Symantec Security response team pointed us at his blog and that in turn pointed at a recent meeting at CMU and an interesting paper he's authored all on the chilling topic about how our various email and Web vulnerabilities can be brought to bear to distort US elections. Given the attention that has been paid to the real but still somewhat obscure notion of tampering with voting machine, this unnerving analysis moves up the food chain and talks about spying on the participants and manipulating the perception of the voter by employing tools like Phishing and Spyware that are unquestionably real. Reading about this stuff makes one think about disconnecting the network and retreating to the woods. Oliver is knowledgeable and hardly an alarmist -- it's worth reading

What Happens in Vegas Gets Blabbed

In a rare IRG show of force John and I both graced the Symantec analyst meeting held as part of Vision. As the mega players (MS, Cisco, EMC) invest heavily in security it has to make you wonder what happens to the traditional security vendors. When we attended Vision a year ago the John Thompson vision was good but it didn't seem to trickle down very far. This year John's vision was charismatic and engaging (as always) but the discussions from the next few layers much more coherent. The theme is risk management broadly. It's a nice way of tying a lot of their stuff together, and clearly becoming top of mind in IT management (Symantec nicely held a CIO Summit in parallel and exposed a lot of interesting CIO's and other customer senior IT management). Our old pal Enrique Salem from Brightmail was the master of ceremonies for all of Vision in his new role as Group President of Sales and Marketing (it's a challenging and highly important job) and it seems to suit him well (despite the fact that his first stint was in the early '90's as Peter Norton's 8th programmer). It's still a little hard to get your arms fully around what Symantec wants to do when it grows up but it's clearly growing up and we're both curious to see where this all goes.

A Month of Kernel Bugs

Our friends at Symantec produce a regularly interesting set of reports as part of the Deepsight™ service. A recent one analyzed the results of a month long study of reported kernel bugs and was particularly interesting. One of the summary graphs at the end shows where the 30 discovered bugs were found (reprinted here with the kind permission of Symantec).  As a regular reader knows part of our mission is to help understand key strategies from the likes of Cisco and Microsoft. Microsoft has been investing time and effort really trying to improve security. As this chart shows few of the kernel bugs were discovered in Windows, which doesn't surprise Microsoft but probably isn't what a lot of Silicon Valley Engineers would have guessed.

Symantec Introduces Security 2.0

So what do you do if you're Symantec and you realize that that Microsoft's investment in system security is almost sure to disrupt your add-in consumer business (as much as you would never say that in public)?  What Symantec introduced in mid October is the most creative response we've seen yet and is aimed at making a quantum improvement in the trustworthiness of the network and network based transactions of many forms.  In this case the high level reasoning is pretty sound. In contrast to Microsoft, Symantec has a brand that expresses security. And Symantec has a large population of paying subscribers with whom they have a non-trivial trusted relationship (know enough about the person to get paid regularly for the service). The idea is to build an identity service that provides real monetary value to both the business (e.g. a bank) and ultimately to the user. Realizing that even with their brand and customer base they don't have critical mass for this, Symantec has partnerships with other big companies. It's a most interesting idea although only time will tell if they can actually get to critical mass.

Don't Try to Understand It -- It's Just Magic!

Our favorite device in the "Magic" category is the Turntide system that Symantec acquired just after acquiring Brightmail.  We had a chance to catch up with Carlin Weigner recently (Symantec's Mr. Spam now that Enrique has been called to even bigger challenges). After some struggles productizing Turntide, Carlin now reports the much sought after market traction. If you don't know what we're talking about, the Turntide box sits in an incoming mail stream and builds a model of the reputability of each mail server sending mail.  As a server's reputation diminishes, the Turntide box throttles what they receive from that source. What's really clever about the approach is that since the Turntide box never rejects or quarantines a message (just slows its arrival) it never loses good mail (zero false positives). After the acquisition, Symantec was able to improve the Turntide offering by leveraging all the Brightmail spam detection and reputation capabilities.  Prior to that, each Turntide box independently determined the spaminess of senders using only local Bayesian algorithms with the resulting limitation that it took a lot of protected mailboxes to tune up the reputation. Leveraging the Brightmail algorithms and services a Turntide box can be more effective with many fewer mailboxes in back of it. So you turn on the box and after awhile 70% of your incoming mail volume just doesn't show up anymore (magic!). Carlin reports the biggest problem is that when the service renewal comes up some of the customers, noting that they don't get much spam any more, don't renew. Of course with the box off it isn't long before the mail volumes rise dramatically again illuminating the mistake in reasoning (Carlin denies that a Symantec controlled BotNet fed with subscription renewal information had anything to do with it).