Q&A: Symantec, McAfee CEOs have differing views on security landscape
Thompson, DeWalt discuss strategic directions
January 02, 2008 (InfoWorld) -- In early December, InfoWorld sat down with Symantec Corp. CEO John Thompson and David DeWalt, chief executive of McAfee Inc., and asked them about the strategic direction of their companies and where they see different aspects of the IT security market heading in 2008 and beyond.

Each of the interviews took its own course, but we made an effort to ask the two executives about many of the same issues.

What follows are a sampling of each CEO's comments on issues related to the rise of data protection, consolidation in the security market and competitive issues between the two industry leaders and their many rivals.
Over the past year in particular, we've seen a relative sea change in the security market as customers have shifted their focus toward data protection versus more-traditional methods of defending endpoints and network assets. How has this forced a strategic change in direction for your companies -- in particular as smaller vendors in sectors including data-leakage prevention (DLP) make claims that they are better suited to deal with this shift?Thompson: The reality is that we have had great insight about what information was flowing around in an organization for years. The fact that we were doing virus protection was interesting, but what was more interesting was depth and breadth of intelligence network around the world, which has been telling us about where viruses and worms are coming from, what hacker attacks are occurring, where spam is originating and what keywords people are using to bypass filters

There's a great deal of insight that's associated with that intelligence network that Symantec has that should make this shift toward information-based security easier for us than any smaller company that doesn't have that breadth.

Furthermore, customers have the expectation that we and others who have been trusted providers for them will evolve as their needs evolve. Certainly, that's been the case in the more traditional security technologies. If [you] look at what AV [antivirus] technology does today versus what it did five years ago, it is light-years different.

We should use the metaphor of the evolution of the past to apply to the problems of the future, and we've certainly evolved our business over the last 10 years to be very different in terms of its focus and our ability to solve problems for customers that 10 years ago probably didn't exist.DeWalt: Actually, I see it as a huge advantage to being a big company. Managing data and data security is a pretty strategic thing for corporations, when I think about who they would trust as an adviser in these situations. With either a start-up [that] may be dedicated to only [DLP], or someone with a thousand people in support, you get a level of service related to companies like Symantec and McAfee that isn't there with the others. We're already running in most large corporations on the endpoint.
Adding another endpoint agent from a small company versus going with McAfee isn't as attractive to these customers. We offer cost optimization, centralized management and other benefits that you can't get from smaller companies.

The reality in the security world today is that we are seeing more cost-optimization requirements. So, how do you look at a company like us that has AV, antispyware, HIPS [host intrusion protection] and NAC [network access control], and how will you add DLP and encryption as an agent, versus adding someone else's products? We look to acquire the best of breed to do that -- to make sure that we have the best technology to fit into our suite -- and offer centralized management with single-agent control to every desktop.

That's the big company game we play, and you have to recognize that turning the ship isn't necessarily about building a technology from scratch. Data security meeting endpoint security, meeting perimeter security is an important component of why people would trust a larger vendor.

DLP is obviously an area where both companies have made significant investments over the past year, with Symantec's acquisition of Vontu and McAfee's acquisitions of Onigma and Safeboot. Could you describe your strategies around DLP and why it has become such an important element of data security?

Thompson: The first thing we have to ask ourselves is if this is a problem that customers would like for us to help them solve. If so, is there a technology already in place in the market that has already garnered the hearts and minds of its users? Clearly, that was the case for Vontu, which was unquestionably the market-leading solution for DLP.

Our view is, if this is a problem that customers would look to Symantec to help them solve, why not see if we can acquire the best technology to be able to do that?

The question of DLP as a stand-alone platform or as a feature will be answered in how customers want to solve the problem. If customers are willing to dedicate resources to the problem as an isolated area of activity, that probably functions as a stand-alone product.

However, if they view that solving that problem is a part of another business process, then it would behoove us to make that feature part of a broader suite.

DLP over time might become part of a broader digital rights management strategy for an organization. Now, that's a big theme that goes well beyond what Vontu does today, but if you believe that the currency of business today is as much about information as it is about cash, having a clear understanding of where digital content is and who has rights and privileges to use it is a very important topic for a lot of companies today.

DeWalt: McAfee and Symantec have clearly addressed DLP in very different ways.

We see DLP having two important problem-solving areas: intellectual property protection, and the management and monitoring of information loss via endpoints.

We believe that most DLP events occur through insiders, through endpoint devices. Not people e-mailing out the source code, but copying it onto a USB drive and walking out with it. Is it more practical to e-mail the source code over the network or copy it to a 60GB drive in a matter of second?If you look at where the problem is, you'll see that the protection of intellectual property is the most important issue and that secondly, it's about compliance [with] data-privacy reporting components.

With Safeboot, encryption is already proven as a strong approach for data privacy and breach management, and it is best served when the customer can prove no loss of data when they lose a mobile device, that they have no need to report that incident.

If you can address those two problems, you can address the bulk of the issues on the marketplace. It will be up to customers to determine which approach they think is better: a network-oriented appliance tool, as with Vontu, or protection at the endpoint, which is where we have invested.

What we have compared to Vontu is apples to hubcaps, literally entirely different technologies. Vontu is primarily a network gateway appliance that is matching rules. There's no host to classify content, but [there is] primarily an appliance to look and monitor for data loss.

That's a totally different thing than Safeboot, which is whole-disk encryption for mobile devices. Symantec has no encryption technology in its entire portfolio, so the technologies are not even in the same hemisphere. Symantec bet that monitoring network traffic is the future. We bet that doing it at the endpoint is more of a safe, compliant way to address this.

Our philosophy is protecting all the endpoints, including all types of mobile devices, and every access point through those endpoints, including removable storage. That's where our DLP strategy will be centered, and we feel the growth of Safeboot proves that we're making the right bet.

Symantec could be right too -- maybe we're both right -- because it's not like Vontu is doing poorly either.

Your smaller rivals, and some industry analysts, like to say that large companies such as Symantec and McAfee do not innovate, that they only acquire innovation through mergers and acquisitions. How does that strike you, and why do you think they are wrong?

Thompson: I think people might argue inappropriately that the sustaining innovation mission that any company with a large base of users has is forgotten about. We already have the 2008 versions of our products in marketplace. Is there any innovation in there at all? We certainly think so.

There is a very important mission that we cannot overlook, and that is we have a bunch of customers who have an enormous amount of expectation of us being able to continue to deliver new features, functions and capabilities for them that will migrate seamlessly from what they do today to what their needs might be tomorrow.

We spend 15% of our revenue on research and development not because we want to spend it, but because we have to maintain some stream of innovation in order to be able to serve the needs of our existing customers.

If you look inside the company, our Symantec Research Labs facility has delivered incredible innovative capabilities such as generic exploit blocking, or the ability to see vulnerabilities and create a signature to block an attack before the attack occurs. That's all about innovation. The fact that we are an acquisitive company means that we are open to people who have fresh ideas or a new view of the world.
The security world has evolved so rapidly over the last five years that if we were stuck in a paradigm that said we will only deal with ideas that emanate from inside the company, we would be unable to serve the needs of our customers at all. The best way for a company that competes in all the segments of the market where we compete is to use strength of our balance sheet, cash and income statement to continue to evolve.

Consider all that in backdrop of the idea that the whole software industry is consolidating around us. You cannot ignore the broader macro-trend going on in the industry itself.

There are fewer software companies today than there were a year ago; one year ago, there were fewer than five years ago; and five years forward, there will be fewer than there are today. The question is, Can you evolve a process that is relevant for your customers and relevant for your company as you think about targets that you bring into the company over time?

DeWalt: It's a myth that companies our size don't innovate. Many products are being made almost 100% in-house. Lots of the work in our new consumer technologies was an organic exercise, as with ePolicy Orchestrator. We didn't acquire anything to build that product, and if there's one product strategic to this company, EPO is that, and the list goes on.

But we also have to use the balance sheet and acquisitions because we can. It gives us the opportunity to grow. Maybe that looks externally like we don't have to innovate, but we're really doing both and making sure that we augment the strategy. It is a combination, and we have to be good at balancing both things. Companies like McAfee have gotten mature because they're good at development and acquisition.

Part of that is at blended-shore development. We're moving sustained engineering and quality assurance to offshore locations like India and China. Innovation is coming from Beaverton, Ore.; Santa Clara, Calif.; and elsewhere where core development and Avert Labs sit.

Those people don't want to do sustaining engineering on Windows 95, so we have to innovate that way so people who want to be working on the newest thing can do that.

In reality, the core of this company is focused on nothing but innovation. We do the other stuff in low-cost locations, and if we didn't do that, we would probably die.

Over the past several years, we've seen many major IT providers, including Microsoft, Cisco, Intel, Hewlett-Packard, IBM and EMC, make investments in acquiring security technologies and building their own security products. How has this shift toward the integration of security into the operating system, network and computer hardware, software, and storage changed how you will direct your own companies?Thompson: The reality is that what customers are trying to do in terms of managing access to applications and the ability to share information across the enterprise, both internal and extended, makes it incumbent upon all of us to recognize that securing that content is very important.

Many of the companies you referenced started their lives thinking that security was something that slowed down the machine, network access or their sales. They finally came to the realization that security is an enabler and not an inhibitor and that they must embrace it one way or another.

The real question becomes, Where do customers think logically about security elements? If you look at what has evolved at Symantec, we have said that it's natural that some security technologies will live and reside in the network.

Networks have become fast enough, deep packet inspection technologies have become good enough, and we assume that as time goes on more of that will occur. And the logical place for companies to do that is with the people providing network equipment, but that's only one place where you have to protect the stream of content; another is where the users interact at a desktop or server, or where it is being managed at the gateway or applications level.

We're getting out of the network side, so why compete with Cisco and Juniper and Alcatel? Why don't we partner with them and license our technologies to them because we'd like to have the scanners we have in place to become more ubiquitous, not less so? Let's move to where the user is interacting with the application or where the application is managing the digital content. And while the competition there is no less fierce, it certainly is a place where we have real strengths that we think are worthy of us doubling down.

There's also the issue of heterogeneity. Whereas someone like Microsoft is only focused on Windows, our largest customers still run mainframes, Unix, and have interests with Linux in the applications sphere. We have to address the real-world heterogeneous technologies in use within our customers, while these companies are focused on securing their own technologies.

DeWalt: One word describes our differentiation from these companies: heterogeneity.

Large companies want freedom of choice of any platform with any OS [operating system] with any technology. They don't want to get locked down with Oracle, EMC or Microsoft, which only support their own releases with their security products.

How many people have moved to Vista so far? Would you trust your security requirements to a single vendor? Microsoft can tell you they will throw in security capabilities, so there's a battle between big vendors doing pieces of the stack versus pure-plays.

This goes back to conversations of best-of-breed small vendors versus best-of-breed large vendors, and it is turning into best-of-breed security versus gigantic companies with some security in their strategy.

We bet that the cross-platform approach wins out. To support all is better than just supporting one vendor, whether for storage, the OS or routers. Cisco is not exactly supporting Juniper anymore.

Our goal with heterogeneity is to create freedom of choice for customers to leverage, and we don't think that many of them want to get locked into one vendor.

Q&A: Microsoft's new multicore-computing guru speaks out

November 26, 2007 (Network World) -- Supercomputing expert Dan Reed, who saw the birth of the Web browser at the University of Illinois at Urbana-Champaign, is joining Microsoft Research as director of scalable and multicore computing.

This serious college basketball fan is tearing himself away from the hoops heartland surrounding North Carolina's Research Triangle to lead Microsoft's efforts in multicore technology and next-generation data centers. "I watched Mosaic come up out of the ground, and I watched my students go off to start-ups, and I promised myself that if the surf was up again that I was going to grab my board and get in the water," Reed told Network World's John Fontana, during a chat about Reed's move from academia and what he says could be a coming revolution that rivals the development of the Web.

What drew you to Microsoft? There are very few places in the world that have the combination of world-class research capability and the market influence and the resources to be game-changing players in a period where there is this much ferment with multicore and large data centers.

The other more broad question is, "Why industry after having spent a life in academia?" And the answer is that the problems of this ilk [multicore, large data centers], the opportunities to profoundly influence their decision, is actually much larger right now in the industry space than it is in the academic space.

What are the unique challenges multicore computing presents to a software development company such as Microsoft? We have hit the power and clock-frequency wall, so large-scale multicore is coming. To continue to ride the performance advantages from that parallelism on chips, we have to rethink how we develop software. How we develop code that runs in parallel and uses those processors has implications for a whole new set of developments but also for the existing software base. So for a software company like Microsoft, it is about developing new applications that take advantage of that parallelism, because there is a whole new set of application opportunities.

What's your plan of attack? I will be doing two things. My position is in MSR, and some of the issues associated with that are research-related. But many of them are deeply product-related. So I will not only be engaging people on the research side, but I will also be working with the product groups and also working with Microsoft's external partners, like chip vendors, because this is not just a software issue; it is a hardware issue as well.

So for a set of ongoing projects that I expect to follow, Microsoft has several activities under way. If you saw recently, the plan is to start shifting the tool set to something called F#, the functional language based on the common runtime system, which is one of the early products to allow us to exploit the on-chip parallelism.
There are other things like transactional memory. One of the things that is true about this problem is there isn't a single silver bullet.

Microsoft Research Director Rick Rashid told me last year that technology transfer is a "full-contact sport." Do you plan to play? Absolutely, that is what I have done my entire professional life. The process of taking ideas and pushing them out into the marketplace is something that I have done for a long time. Intel has shipped product based on software that I developed as a researcher in academia.

You said in your blog that scalable and multicore computing are among the most interesting technical problems in computing. Can you, in layman's terms, tell us why? There are two questions there. One is the scalable and one is the multiple cores. This is probably a once-in-20-year opportunity to rethink some fundamental things about the way we design processors and the way that we support software.

The other piece is the rise of large-scale data centers and cloud computing's software as a service. The scope and scale of these data centers is beyond anything we have conceived of building before. This aggregation of information and the ability to deliver computing in response to remote requests is the biggest thing that is happening since the Web.

So, you put these two things together and we are about to realize the infrastructure to support the computing equivalent of the electronic power grid. When I was at Illinois, I saw the Web browser Mosaic born, and as I look at this space happen -- multicore, Web 2.0, data centers -- that same sort of confluence of excitement and opportunity is there.

For users who know nothing about this technology, where will they experience its benefits? They are going to see performance go into warp drive. And not just on the desktop, but mobile devices, because you can deliver high performance at low power and obviously that is a big issue in the mobile space. Some of the technologies that rely on vision and speech recognition and nontraditional interfaces beyond keyboard and mouse. Those kinds of interfaces need the kind of power that multicore will deliver.

How will you divide your time between research and product? I will divide my time between three things. It is a logical division rather than a division between research and product. The group of things to work on are minicore, large-core multicore systems, a clean-sheet look at next-generation data centers, so soup-to-nuts from chip-level issues up through system integration [and the] software stack to support some of these next-generation apps.

The second is large-scale environment, thermal and power management to go with what you do if you want to build a 200,000-square-foot, 50-megawatt data center. The third thing that I will be doing is to finish work on national science, technology and information policy. I have done a lot of that over the last few years on the President's Council of Advisors for Science and Technology, and I am also chair of the umbrella organization that represents all of the academic and industrial research labs in computing in North America.

Vista SP1 Release Candidate targets performance, reliability, security
The anticipated death of the Kill Switch, though, isn't part of this RC
December 06, 2007 (Computerworld) -- The just-released Windows Vista SP1 Release Candidate (RC), like the previous beta, does more to improve the internal plumbing of Windows Vista than it does to make any major changes to the interface. SP1 RC targets performance, reliability and security, leaving the operating system's features and functionality largely intact, with the exception of allowing users to substitute an alternate search tool for the one built into Vista, and removing the Search link from the Start menu
When the final version of SP1 (currently slated for next year) is released, the big news will be the death of the so-called Kill Switch, which Microsoft prefers to call "reduced functionality mode." Whatever you call it, though, the elimination of the switch will be good news. Currently, if you don't activate your retail copy of Windows Vista after 30 days, your desktop turns black, and your icons and the Start menu vanish. You can't open your files (although you can copy them). You're able to use a Web browser for only an hour before you get logged off.

The same thing happens if Windows Vista decides that you've installed it on a different PC than your original one, and you ignore a three-day grace period for contacting Microsoft. Vista might also decide it's been installed on a different PC than the original if you make a substantial number of hardware changes to your original PC.
In the shipping version of SP1 (though not in the current RC version), the Kill Switch will become more of a "Nudge Switch." You'll be frequently reminded that you need to activate Windows, and the desktop background will turn black. Try to change it to another background, and an hour later Windows will turn it black again. In addition, you won't be able to download signed drivers and optional updates via Windows Updates, although you'll still be able to get critical security updates. Not a pleasant experience, certainly, but at least you'll still be able to use the operating system.
For more details about the Kill Switch and new antipiracy measures baked into SP1, read our article "Microsoft to beef up antipiracy checks in Vista SP1
Changes since the previous beta
Not much has changed in the RC version of SP1 compared to the previous beta, although there are slight differences. Installation on my 1.83-GHz Core Duo laptop took under an hour; the previous beta took an hour and 15 minutes. The previous beta didn't clean up after itself, and left about 1GB worth of files in a folder that was no longer needed after installation. RC, on the other hand, deletes that directory and files.
A bug I found in the previous beta still remains: On my home network, which uses a Linksys WRT54GX4 router, I couldn't connect from my SP1 RC test machine to any other Vista PCs on my network. And I couldn't connect from Vista PCs to the test machine, either. However, I could connect to XP machines, and from XP machines to my test machine. That bug appears to be an isolated one, because other reviewers have been able to connect to Vista PCs on their networks.
Overall, in RC, Vista seems a little zippier when it connects to XP PCs. Copying files between PCs seems faster, and the time estimates that Vista gives for how long that copying will take seem to be more accurate.
Microsoft claims there have been other, minor changes as well, including a reduction in the size of stand-alone installers. It says that the RC stand-alone installer packages with 36 languages are 50% smaller than the previous beta, and the stand-alone installer packages with five languages are 30% smaller. In addition, the company says, disk space required for installation has decreased, and in RC, if SP1 discovers there's not enough space to install, it will tell you how much extra space you need. Microsoft also claims that the installation is more reliable, with a higher percentage of successful installs.
Same changes for Windows Vista
Otherwise, the RC version of SP1 offers the same changes to Vista that the previous beta did. One of the biggest changes is in the way search works. For example, you can now use a third-party search technology, such as Google Desktop Search, as your default search engine, by choosing Start --> Default Programs --> Set your default programs. You'll see a screen that allows you to change which search tool to use by default.
In addition, if you choose Start --> Default Programs --> Associate a file type or protocol with a specific program, you'll see a new entry in the protocol section, called Search. It lets you configure which program opens when you click on a file that uses the Windows Search protocol.

In addition, the Search link has been removed from the Start menu, and when you enter a search in the Start menu search box and results appear, the names of the links to additional searches have changed from "See all results" to "Search Everywhere."
If you want more information, Microsoft offers an overview of Windows Vista SP1 desktop search changes in its Knowledge Base.
There are a variety of other small changes to Vista that still appear in the RC version, including to the Disk Defragmenter, which now lets you choose with volumes to defragment, and to BitLocker, which lets you choose which drives to encrypt.
Where Vista goes from here
Microsoft is about to ramp up the beta program for RC SP1. It is now available for subscribers to TechNet and MDSN, and it will be freely available for anyone via Microsoft's Download Center the week of Dec. 10, 2007. Microsoft is still targeting the final release of Vista SP1 for the first quarter of 2008.
If you're looking for more information about SP1, check out these resources