Despite IT's image of being invented by wild-eyed loners in pizza-fuelled bedroom frenzies, by far the greater part of research and development takes place in well organised laboratories staffed by teams who can easily pass for normal human beings. A good example of this approach to R&D can be found in Bristol, where HP has one of its most significant research efforts -- and where yours truly was invited last week to look over some of their work.
The laboratories -- the first HP opened outside the US -- investigate a mix of practical and theoretical developments. These range from quantum information technology through to camera design, location-based services and grid computing, but the focus of this visit was security -- as evidenced by the movie posters up in the lab windows promising to "save the Earth from the scum of the universe".
That focus is further sharpened by what HP calls the 'increasing threat velocity'. One of the first real-world dangers for commercial IT was the boot sector virus. Invented some eighteen years ago, this hops onto files on hard disks whenever the computer tries to boot from an infected floppy. It could and did spread widely, but only at the speed at which people shared floppy disks. Email-borne viruses came along 10 years later, and could spread globally in days: now, worms that attack software weaknesses can propagate through broadband-connected PCs in minutes. This connected vulnerability, together with vast increases in system complexity, attacker motivation and available resources, has fuelled a thousand-fold increase in reported incidents over the past 10 years.
One technology that HP has developed is Active Countermeasures, where the company scans for and uses security holes to deploy its own payload to vulnerable machines. This payload doesn't propagate like a worm -- it remains under the control of the company's security policy -- but can take the target machine off the network, if necessary. Before that, it warns the user to download a patch, or can restrict access to just email or a similar, safe subset of services. HP has used this idea since the Code Red worm hit in 2001, and claims great success -- it has remained relatively untouched by subsequent malware.
