Is security a specialist job?

GuyClapperton 0 Tallied Votes 144 Views Share

You might have seen the announcement yesterday that Microsoft is going to start offering free antivirus protection to its customers. The initial reaction is no doubt going to be reasonably positive, and speaking as someone with a family member who's been hit by a computer virus fairly recently, the easier they make this stuff for consumers, the better.

I'm a little concerned, though, by a few things about this announcement. First, let's assume this software ends up shipping with Windows eventually so everyone with a Windows PC has it. Leaving aside the damage this will do to the competition (and that's their problem, every commercial enterprise is set up at some risk) the emergence of a massively pervasive player will give the hackers and virus writers a single target to overcome - write something that gets past Microsoft and you get into everyone's computer. At the moment if you write something that gets past Symantec you get into quite a few but not every Windows computer.

The other problem is the one highlighted by the commentators in the story to which I've linked; specifically, Microsoft just isn't a specialist in the area, it's a general computing company that's pretty good at a lot of things. Frankly when it comes to my computer's security I don't want 'pretty good' - I want someone who's going to understand Firewalls, Phishing, rootkit stuff, Trojans and goodness knows what else, as well as AV. I use a well-known brand of deodorant because their name stands or falls on my personal hygiene; I use a well-known security company's suite because if my computer and others are known to have fallen victim, their business will collapse. They have more vested interests in keeping me running efficiently than anyone who just did something on security as part of a larger operation could ever have.

If this announcement means the overall security of computing, domestic and business increases, then fine. I'm just a little worried that it could lead to people ticking the box, assuming they've sorted their security out and not noticing there's a bigger picture that requires specialist help.