The Myths of Security

Chapter 45. An Open Security Industry

At first blush, it may look like the security industry is pretty open. For example, plenty of companies provide AV by running a ton of AV programs in the cloud and then claiming a program is bad if some number of other AV programs agree that it’s bad. Personally, I’m surprised no companies have been sued over such AV “voting” schemes. And while the industry might tolerate this kind of situation, it generally doesn’t encourage openness.

There is a tremendous amount of duplication of effort in malware fighting/signature writing across the major vendors. All the companies have dozens of people writing signatures for the same thing. And most of the signatures just amount to simple pattern matching; there’s not much intellectual property that’s any sort of rocket science. In the meantime, the amount of malware out there is exploding, and no single vendor can grow fast enough to keep up.

While I’ve argued for a better way of doing things, it is also true that the world would be better off with a standard signature definition language and shared signatures so we’re not duplicating effort. This is not as far-fetched as it seems, either. All the major AV vendors already share malware samples with one another on a daily basis. We all get the malware the other guys find. Why duplicate the drudgework?

Instead, let’s have the industry compete on the merits of how the players actually do security, and the end user experience. Let’s not put unnecessary barriers ...