The information security industry is obviously part of the IT sector, but security companies are different from traditional software companies in many ways. If your company builds cloud services or CRM systems or search engines, you don’t have an enemy. The closest thing to an enemy would be competing companies. However, infosec companies do have an enemy. In fact, they all share the same enemy: organized online crime gangs, criminal hackers, botnet masters and offensive hackers from nation-states.
When IT experts are choosing where to work, one of the motivations to work in security is that here we can use our skills not just to feed ourselves but also to help others. This is definitely what has kept me in this industry for 30 years. As a kid, I wanted to become a doctor so I could help people. I did not become medical doctor but I’d like to think I’m doing something similar – in the world of online security and privacy.
Today, collaboration and co-operation between cyber security companies is the norm, as it should be. Companies share intelligence, malware samples and information feeds. It hasn’t always been like this though.
In the early 1990s, when antivirus companies were just starting up, viruses were spreading quite slowly. This was still the floppy time, so a new virus would spread from one country to another at the speed of people travelling and carrying infected floppies with them. This means that when an particular antivirus company would find a new virus, other companies probably did not have a copy of it. This was used early on as a competitive advantage. A company would claim that only them would detect the latest version of a particular virus – which was true, as other companies did not have a copy of the virus. Such short-sighted tactics backfired quickly, as the next new virus was found by another company – which would not be eager to share it either – and everybody would lose. The end users would suffer the most from such lack of collaboration.
Today, information sharing works much better. And it should. You see, the bad guys are pretty good in sharing information about new vulnerabilities or new ways of attacking end users. The only way for us to keep up is for good guys to share information too. Collaboration is the key.
Another lesson I’ve learned over the years is that complexity is the enemy of security. The more complex our systems are, the harder they are to secure. The more code we have, the more bugs we have. More layers of protocols we have, the more there is room for error. And in modern interconnected systems bugs and errors lead to exploitable vulnerabilities.
The best way to fight these problems is for us to work together.
About Mikko Hypponen
Mikko Hypponen works as a researcher at F-Secure. He was selected as Cybersecurity Person Of The Year 2020 by CISO Mag. Our founder Philippe had the pleasure to share a virtual stage with him for a webinar in April 2021, covering the topic of Collaborative Security. You can watch the replay here.
.png&w=3840&q=75)
