Anti-virus is a multi-billion dollar industry and is a necessary best-practice and due dilligence measure everyone must implement. Yet it is failing, by its own volition, spectacularly – and only delivering the least-common-denominator prevention without any signs of improvement. How can consumers of products, namely security products, guarantee better service and quality from the vendors? By forming security collectives and achieving economies of scale in security.
NATO: An Example of Collective Security
Mahatma Ghandi was a strong man, but it took the collective work of thousands making salt during the Salt March to make a statement. One person in need of high quality private insurance in the U.S. does not make a market, but millions coming together into health groups can leverage their collective purchasing power to deliver the necessary health plan at the right price. Political parties band like-minded people together to set policy and government agendas. Governments come together for collective benefit (e.g. NATO).
Collectives can make markets, demand services, set prices, deliver effective products, and change industries. They can leverage their group funding and influence to get what they need where individually they cannot.
One of the most difficult aspects of achieving information assurance and network security is that we rely, almost exclusively, on third-party vendors and service providers to achieve our goals – to deliver the technology, to block the right packets, to prevent the wrong applications from installation, to write secure code for their applications, etc. These come in the form of application vendors, anti-virus vendors, intrusion detection/prevention platforms, firewall systems, network infrastructure, etc.
Yet these vendors are simply delivering the least-common-denominator in security. They are building technology and leveraging intelligence only enough to solve the problems for the greatest number – not solving the right problems for their customers.
Mikko Hypponen, recently openly stated that they fail at their job.
“The truth is, consumer-grade antivirus products can’t protect against targeted malware created by well-resourced nation-states with bulging budgets. They can protect you against run-of-the-mill malware: banking trojans, keystroke loggers and e-mail worms.” — Mikko Hyponen in Why Antivirus Companies Like Mine Failed to Catch Flame and Stuxnet appearing in Wired June 2012
It is rare that a company, or an entire industry, will admit their faults publicly. What Mikko says is true. Anti-virus is designed to protect their customers from the most common threats – but fail at protecting their customers against the most advanced threats.
How then can customers achieve the assurance necessary to operate when the products they rely on most to protect them cannot?
Today: we define our security objectives alone, individually contract with security vendors for products (e.g. anti-virus, intrusion detection systems), and then conduct incident response and intrusion analysis in a vacuum.
What if organizations were to band-together with like-mission partners into security collectives (military with military, critical infrastructure with critical infrastructure, healthcare with healthcare, etc.). Thereby achieving economies of scale in shared threat intelligence and greater vendor support through collective bargaining.
Is the anti-virus product not delivering the protection you (and your partners in the group) need? Then take all of your money elsewhere to a vendor that will offer the level of service necessary. Maybe you need a hunting service for the most advanced adversary. Maybe you need advanced threat intelligence utilization. Maybe you need just enough support to keep the next worm from infecting your network.
With security collectives, all customers need not be satisfied with the least-common-denominator of security.
Money talks, and big money talks even louder. Threat intelligence is nice, shared threat intelligence is stronger. We need to band together into collectives to make our voices heard and demand better service based on our respective missions.