The World Wide World: IT Ain't Just the Web ... - Cdn.oreilly.com

ties, and good people can go bad. And the moment you start keeping people’s identities on
file, you create the risk of releasing confidential information; just ask ChoicePoint!
Yet that doesn’t mean we should all give up. All parties – vendors, access/service
providers, consumers, educators, governments – have a responsibility and a role to play.
Yes, we’re talking to you! If the private sector doesn’t take the initiative, government
will. But as we argued in the November 2004 issue of Release 1.0 on the accountable
Net, the Net’s tools themselves give individuals the means to protect themselves, while a
variety of services will let them outsource tasks such as filtering spam or managing firewalls
with as much personalization or specificity as they care to pay for. Of course, it’s
not easy, but the very visibility of the Net’s security problems are leading the way to a
solution since they make people aware of the problem and more conscious of the need to
protect themselves.
The question of responsibility for security isn’t just government vs. private sector; it’s
also “which vendor?” Microsoft’s Scott Charney represents perhaps the leading vendor
in terms of basic infrastructure; he also has experience as a government law-enforcer.
Symantec’s John Thompson represents the leading formerly pure-play IT security vendor
– unless you redefine security more broadly, which is the point. Cisco’s Jayshree Ullal
serves the part of the market that links everyone, secure or not; she sees security happening
in layers, from the depths of the network infrastructure to the top of the stack. May
they all compete vigorously to ensure our safety!
Scott Charney, Microsoft: Security from the source
“I was hired as chief security strategist originally,” says Scott Charney, now VP of
trustworthy computing for Microsoft. “Microsoft ascribes to the philosophy of, ‘Get
the right people on the bus without telling them where to steer’.” Over time, he figured
out his mission, which was not so much a corporate function, though he still
has that role, but rather “to change the very rhythm of the business – how products
get designed and tested, and how they get sold and installed.”
Charney got his training in security offline, as an English and History major with a
law degree working as a prosecutor in Bronx County. In 1991, as one of the only guys
around who knew how to program a computer, he was charged with taking on
online investigations. Within seven months he became chief of the newly created
Computer Crime Unit in the US Department of Justice (DoJ). As the leading federal
prosecutor for computer crimes, he helped prosecute nearly every major cybercrime
case in the US from 1991 to 1999. He co-authored the original Federal Guidelines
14 RELEASE 1.0 WWW.RELEASE1-0.COM