RSA 2009: Security companies should share threat data

gallery

Security companies should share data on malware and other malicious threats, but it will take time and effort to make this happen.

This is according to Gerhard Eschelbeck, chief technology officer at Webroot, who said that security companies should anonymously share threat data and information on new malware.

Speaking to IT PRO at the RSA Conference, he said that security companies did share some data, but it was only done on an ad hoc basis when researchers from the industry happened to know each other.

“It’s a technically difficult problem that needs infrastructure and work, so it’s clear what people are expected to share,” said Eschelbeck.

It could be problematic as IT security competing companies would have made their own significant investments in infrastructure and their own ways of gathering threat data.

“At the same time, every company has made investments there,” he observed. “For the overall health of the internet there is anonymous agreement that it makes sense to share data, as long it’s not personally identifiable and limited to threat data.”

Eschelbeck said that the idea of security companies sharing threat data was in its infancy and needed a lot more discussion and refinement.

“Before we even go into the technical implementation, the first thing that would need to happen is to put a framework in place on what’s expected and what to do,” he said.

Eschelbeck didn’t believe that it would be realistic to expect a security vendor to drive this kind of initiative, and that there had to be a third party to kick things off.

“A good example was raised of a similar effort from the AMTSO (Anti Malware Testing Standards Organisation). Multiple vendors came together to solve the problem of how to test malware products with each other, which is a similar challenge," he explained.

“This not only has the vendor side but also the tester side, and these guys are meeting regularly in order to define a framework and process on how to share information on how to test malware products,” he said. “An organisation like AMTSO could take a role in defining a framework.”

Email to a friend

Print this page