RSA 2009: Security companies should share threat data
Is it time for security vendors to share information they have on the latest malware?
Security companies should share data on malware and other malicious threats, but it will take time and effort to make this happen.
This is according to Gerhard Eschelbeck, chief technology officer at Webroot, who said that security companies should anonymously share threat data and information on new malware.
Speaking to IT PRO at the RSA Conference, he said that security companies did share some data, but it was only done on an ad hoc basis when researchers from the industry happened to know each other.
"It's a technically difficult problem that needs infrastructure and work, so it's clear what people are expected to share," said Eschelbeck.
It could be problematic as IT security competing companies would have made their own significant investments in infrastructure and their own ways of gathering threat data.
"At the same time, every company has made investments there," he observed. "For the overall health of the internet there is anonymous agreement that it makes sense to share data, as long it's not personally identifiable and limited to threat data."
Eschelbeck said that the idea of security companies sharing threat data was in its infancy and needed a lot more discussion and refinement.
"Before we even go into the technical implementation, the first thing that would need to happen is to put a framework in place on what's expected and what to do," he said.
Eschelbeck didn't believe that it would be realistic to expect a security vendor to drive this kind of initiative, and that there had to be a third party to kick things off.
"A good example was raised of a similar effort from the AMTSO (Anti Malware Testing Standards Organisation). Multiple vendors came together to solve the problem of how to test malware products with each other, which is a similar challenge," he explained.
"This not only has the vendor side but also the tester side, and these guys are meeting regularly in order to define a framework and process on how to share information on how to test malware products," he said. "An organisation like AMTSO could take a role in defining a framework."
The case for a marketing content hub
Transform your digital marketing to deliver customer expectationsDownload now
Fast, flexible and compliant e-signatures for global businesses
Be at the forefront of digital transformation with electronic signaturesDownload now
Why CEOS should care about the move to SAP S/4HANA
And how they can accelerate business valueDownload now
IT faces new security challenges in the wake of COVID-19
Beat the crisis by learning how to secure your networkDownload now