Feb

7

Norton Antivirus Inventor on Wasted Time in Security

Posted by Keith McMillan

February 7, 2008 | Leave a Comment

Dark Reading is covering the Computer Forensics show in Washington DC, and has this  article on a presentation by Peter Tippett, the guy who invented what would become Norton Antivirus, exec at Verizon, and chief scientist at ISCA. Tippett’s point is that security departments need to be smarter about what they focus their time and effort on:

“You can’t always improve the security of something by doing it better,” Tippett said. “If we made seatbelts out of titanium instead of nylon, they’d be a lot stronger. But there’s no evidence to suggest that they’d really help improve passenger safety.”

Hallelujah, brother! I’m a pragmatist, and I believe that you have to carefully evaluate your level of security, because 100% secure is probably too expensive. There’s a definite point of diminishing returns for security, and it’s different for every application you’re going to build.

Now, I haven’t seen the complete  text of the presentation. Tippett cites a number of things that he thinks we should not be doing:

For example, today’s security industry focuses way too much time on vulnerability research, testing, and patching, Tippett suggested. “Only 3 percent of the vulnerabilities that are discovered are ever exploited,” he said. “Yet there is huge amount of attention given to vulnerability disclosure, patch management, and so forth.”

It’s rather short on things that he thinks we should be doing, unfortunately, citing only a single example. As a result, the article comes off as a bit of a “geez, we need to do this better” without any concrete recommendations as to how to go about improving. How is unfortunately what most folks need…


Comments

RSS feed | Trackback URI

Comments »

No comments yet.

Name (required)
E-mail (required - never shown publicly)
URI
Your Comment (smaller size | larger size)
You may use <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong> in your comment.

Blogroll