The Myths of Security

Appendix A. Epilogue

Many people in the security industry like to preach gloom and doom. It makes them money and people usually end up believing what they’re selling.

I guess I’ve been doing the same in this book, preaching gloom and doom. But instead of preaching that the customer is hosed, I’m preaching that the security industry is hosed—I don’t think customers are hosed at all. Security issues are, right now, an inconvenience (and in the enterprise, maybe an expensive inconvenience). They aren’t a ruinous problem.

When I started working on this book in mid-2008, I’d recently left McAfee to work on a startup. Now, in the last few days of working on this book, I’ve been brought back into McAfee.

Lots of people have asked me some variation of the question, “Do you feel dirty being back at a big company?” The obvious implication is that they think McAfee sucks (typically, that all big companies suck).

Actually, I like McAfee, and am proud of where it is. In the time from when I first started until now, it has essentially gone from middle-of-the-road to best in terms of the quality of its AV solution. Almost all of its security technologies are world-class compared to its competitors. And it’s well on its way down the path to implementing some of the grander visions I talk about in this book, such as the move to security in the cloud.

McAfee is phenomenal for meeting enterprise needs, an area that I’ve tried to avoid as much as possible in this book, but one that is incredibly important ...