Signature-based security is no longer effective

Dark Reading – sister site of Light Reading which had been source of much rumor and information when I was in networking market – has recently reported that malware is reaching epidemic level. It sites reports from two security firms, PandaLabs (research arm of anti-virus company, Panda Security) and AV-Test (an independent anti-virus software testing organization). Key statistics are the followings.

  • Number of malware has increased 5 to 10 times in 2007
  • Average of 3000 new variation of malware each day in 2007
  • Approximately 72% of networks with more than 100 workstations and 23% of home users are currently infected with malware even with operative antivirus or other signature-based tools in place
  • Approximately 5.5 million different malware files identified in 2007 – 5 times as greater than 2006
  • 118,000 different malware files in 2 weeks of January in 2008

All these numbers indicate that signature-based approach to computer and network security is no longer effective and cannot scale. While signature-based solutions have worked fairly well so far, they have one fatal weakness; no known signature, no detection and thus no defense. And as the numbers show, the rate at which malware is created is clearly overwhelming signature-based security companies.

Pros and cons of outsourcing software development to India

So, I am winding down on my pursuit of the startup. I had to. My saving level is dangerously low, and I have a family to support.

And, this outsourcing to an Indian software company was a BIG mistake, too. What it came down to is the heart and soul put into the work. They will do a job to meet the spec, but as any software engineer knows, there are million ways to write a code, and these guys will write the minimum or take the shortest path to meet the spec. That doesn’t mean they will think about efficiency or quality of the code. So, quality of the code is always questionable. But, again the biggest problem is that these guys will not go above and beyond. Just do the minimum to meet the spec and that’s it.

When I told many people that I was going to outsource the coding, they thought I was crazy. It’s core of my business, and you should never outsource something that’s core to one’s business. That’s so true, because I just learned it hard way and also it is clearly said in the book I am currently reading, Living on the fault line by Geoffrey Moore. Well, actually at first, I didn’t think the website was the core, but marketing strategy was, because writing a website is so trivial and anyone could do it. I wanted to do it cheaper and faster, and concentrate on good marketing so that I can attract critical mass of users. But, it was the core. In consumer website space, user experience is everything and the website that was built by this Indian outsourcing company – which by the way had developed other social networking sites before – had the worst user interface. So, I basically told them to stop the development since I want to cancel the project. Of course, they weren’t happy about it, but there was really no point in going on. The website developed by them was so inferior to current competitors.

Recently I had to research open-source social networking platforms, and I was surprised to find so many. And, they all looked really good. I remember distinctly that I searched for such platform in October of 2006, and there really weren’t much. I found a few that I’d have to buy, but no social networking…. Though, I am not sure if I would have time to develop the site myself even if I found a suitable open-source social networking platform. The learning curve would have been too steep. That was actually another reason I decided to use an outsourcing company….., but it turned out to be probably worse.

Ah, well…. You live and learn and move on.

Also, another thing that I learned was that most of the successful startups were founded by engineers and geeks, not by business or marketing people. I’d better go and hit programming books!

What makes a company great?

It was my junior year in college that I picked up this free issue of BusinessWeek. It had a special section about Silicon Valley, and reading it was like an epiphany. It was amazing to read about unconventional folks, mavericks, and renegades were truly shaping our world. They were because after the industrial age, we live in formation age and these companies were creating innovative software and hardware that were fueling and driving information age. I wanted to be one of them, creating a company that would change the world and perhaps make a lot of money on the side. But, I wasn’t sure how I would go about doing it. I was naive and still trying to figure out my place in this relatively new world, having immigrated to US just about seven years ago.

Well, I had an opportunity to work for startups in the Silicon Valley, and it was during this time that I became fascinated with high-tech marketing, thanks to VP of Engineering at Caspian Networks who recommended Geoffrey Moore’s Crossing the Chasm. He is now founder and CEO of Ethernet fabric company. Since then, I wanted to move onto product marketing area, but the opportunity didn’t arise until 2004.

I had a chance to work for Samsung Electronics in Korea. It wasn’t an easy decision. It took me three months to decide. I’ve heard some horror stories about harsh treatment from jealous colleagues and cultural shock experienced by Korean Americans who went to work for a company in their mother land. Also, they were going into a very tough market, router market where Cisco owns 70% market share in all segments and 95% in mid-range segment. Other big telecommunications companies like Nortel, Alcatel and Lucent tried to challenge Cisco, but all failed. What I liked about Samsung was that it had huge amount of cash. If Samsung were in the game to win, it was going to be a long battle that would require lots of cash.

But, what I faced was quite dismal. Samsung, a large company in all aspects with 200K+ employees worldwide, truly exhibited everything you could expect from a large company. Working there was living the words of Clayton Christensen‘s Innovator’s Dilemma. And we are not even talking about a disruptive innovation. Actually, most of the leading Samsung products happen to be with sustaining technologies instead, like more dense memories or phones packed with more and more advanced features. Clayton Christensen’s definition of disruptive technology is not radically different technology, but entirely different application of current or new technology targeting entirely different market.

I am a Korean American, and I am somewhat passionate about Korean companies. In the back of my mind, I thought my high-tech marketing knowledge with heavy experiences in data networking and in startups, I could make a real impact and be the real change agent at Samsung. It didn’t happen, and I could spend another full post on why. At any rate, in the light of iPhone’s huge initial success, selling out 500K units last week, I wondered how come no Korean company, with heavy chips on their shoulder and arrogance could not create such “iconic” product that people could get really passionate about. Other foreign companies have done it. Sony certainly has done it…., many times with Walkman, Playstation, etc. According to Tony Seba and in his book, Winners Take All, success of Apple’s iPod could be attributed to creation of “whole product”. iPod was only successful with iTune application and iTune store by providing users a complete digital music experience. iPhone might actually fail because of poor experience with AT&T. Wireless carrier matters a lot to create “whole product” of a cellular phone since poor cellular quality will hinder users from positive experience.

I think it’s useless to exclaim R&D or technical strength if you cannot exploit it and lose in the market. To win in the market, you have to know the market. Peter Drucker once said that “The aim of marketing is to know and understand the customer so well the product or service fits him and sells itself.” Perhaps the problem with these Korean companies and why they have not been able to create an iconic product is that they do not know the market.

Do you dare to predict the future?

“I think there is a world market for maybe five computers.”

  • Thomas Watson, Chairman of IBM, 1943

  • “There is no reason anyone would want a computer in their home.”

  • Ken Olson, President, Chairman, and Founder of Digital Equipment Corporation, 1977

  • 640k ought to be enough for anyone.

  • Bill Gates, 1981

  • What the hell is [a microprocessor] good for?

  • Robert Lloyd of IBM’s Advanced Computing Systems Division, 1968

  • I see little commercial potential for the Internet for at least ten years.

  • Bill Gates, 1994
  • Software is the king

    I wish someone had told me about it early, perhaps before going to college. I have been working for about 10 years now with most of experiences in data communications, and it’s been pretty obvious to me that real value of a system resides in software, not in hardware. In the communication systems, what determines reliability is usually their OS and software in general. Hardware matter, too, but only up to certain point. And, it’s relatively easy to reach a reasonably robust hardware product. The real art of creating value is really in software. I wish I have known this before. While I started my freshman year as a CS major, but later I changed to EE because I didn’t like to spend too much time in front of a computer.

    Anyhow, the two pillars of data communications industry is Cisco and Juniper. When Juniper first came out, its software took much different path from Cisco. Cisco’s IOS used to be this humongous, non-modular piece of code and changes in the one part of IOS may easily break different part of IOS. It was somewhat synonymous to MS Windows OS, where the backward compatibility requirement has hindered it from introducing much better OS for a while. Also, their approach was similar where Cisco IOS would support any network protocols under the sun like DECnet and Appletalk, while Juniper only supported newer protocols. When a process within IOS fails or goes nuts, it would bring down the whole system, but not Juniper’s OS – JunOS. It was definitely smaller, faster, more reliable and more resilient. But now Cisco’s new OS called IOS XR is also modular SW, I think the playing field has leveled. Cisco is a big power house in networking which commands more than 60% market share in most of industries it has penetrated, and Juniper might forever remain as the number 2, niche player in the market (Crossing the Chasm).

    Anyhow, when I look at new innovation or innovative companies popping up, it’s not in L1 to L4 of OSI layer. It’s usually in higher level. Look at all web 2.0, social networking and SaaS (software as a service) companies taking the market by storm. Some say it’s bubble 2.0, but this time I think everyone including investors is careful about business models and revenue history/projection. Also, anything related with proprietary hardware like building ASICs takes too long and too much capital. Building software takes much less time and capital, and there are literally thousands ways to implement a feature, so it’s really up to how well the software is structured for performance as well as scalability that would make a huge difference.

    It also brings an interesting point, too. If you look at technology advancements in the last 100 years and last 20 years, the rate of advancement in last 20 years is very high. If this rate would continue, it’s mind boggling to imagine what the next 10, 20 years will bring. That’s also why benefits of proprietary and custom hardware such as ASIC or company like SUN might be in the big trouble. The system built with off-shelf components may run as fast and reliably as custom hardware. Again, the value will be on software. How well it is designed and written will make all the difference.

    I have two kids of my own, and I don’t know if I would want them to become engineers like me…, but if they want to, I would definitely ask them to go into software industry, not hardware. I suppose hindsight is always 20/20. Life’s most valuable experiences are learned from mistakes.