Month: October 2003

Security

What Microsoft really needs to secure the perimeter

Posted on by Ed Sim

We all know that there have been a number of issues with Microsoft’s security. We have all been bothered by the daily ‘Windows Update Available’ alert. Steve Ballmer has stated that making their products more secure is their highest priority. In fact, MSFT’s CFO mentioned that security-related issues had a negative impact on its most recent quarter delaying some very large licensing deals. So what is Microsoft doing to fix this? In MSFT’s recently announced ‘Securing the Perimeter’ initiative, the company will place greater emphasis on firewalls and other network security technologies to prevent hackers from reaching vulnerable PCs. What does this mean? Well, first of all MSFT is emphasizing the importance of Defense in Depth. Defense in depth implies that enterprises must have security in every layer of a company’s infrastructure from the edge to the center where all of the data resides. MSFT is also acknowledging that patching systems and installing windows updates as a sole method of security does not work because these methods are all reactive. In fact, most people do not even install updates and patches right away still leaving many computers and servers highly vulnerable. Selling antivirus technology (via their acquisition of Romania’s GeCAD Software) will not make their OS less vulnerable. All of these technologies are all getting better but for the most part will still not catch the newest blended threat, worm, or virus. Antivirus software relies on signature updates of attacks that have already happened and with patch management most of the patches are never installed. So Microsoft is telling us that they need an early warning signal technology to allow its customers to stop an attack at the edge before it hits vulnerable PCs and Servers.

I applaud Microsoft for getting it. Windows is an old, bulky piece of software rife with holes. While security on Windows is a high priority, MSFT has finally acknowledged that a customer needs a defense in depth strategy to enhance security and that they need to push this into enterprises. By the time a worm, virus, DOS attack, etc. reaches the desktop it is too late. If we want real security we have to put proactive defense on the edge and not just in the center. The edge means that MSFT needs to take security out to the network and yes, this is where companies like Cisco dominate. We all know that routers are dumb, and that it is time to put more intelligence in them. Yes, this has not happened yet. Right now, MSFT seems to be looking at firewalls as their perimeter defense. Even if they add Intrusion Detection (lots of false positives, data overload, most technology relies on signatures) via partnership or acquisition, it will still not be enough. In order to fully round out their strategy, MSFT should look at security management software companies like netForensics (full disclosure-i am on currently on the Board of Directors) to provide real time analysis of a company’s total infrastructure from the routers and edge firewalls to the NT and IIS servers residing in the internal data center.

How does security management software help? Most corporations spend millions of dollars buying security products yet they still do not feel secure. It is the equivalent of having a building equipped with numerous cameras (security hardware) without anyone monitoring (security management software) the activity in real time. Therefore, how will anyone really know if they were attacked, by whom, when, and where? Take this concept to an enterprise and you get the same picture-lots, and I mean lots of dollars spent on security (firewalls, intrusion detection systems, antivirus, etc.) to protect a company, but if there is no software to proactively filter all of the reams of data (gigabits upon gigabits of it) from a myriad of heterogenous devices to correlate what happened and when in real time, then a company will never really know it was under attack. Well done security management software does not rely on past events to issue warnings. For example, netForensics was able to catch SQL Slammer while it was happening. It was able to view anomalous network activity gathered from various devices like firewalls and intrusion detection systems and in real time correlate and send an alert to the user who could then shut off the port for Slammer. Of course, if one could shut that data stream off automatically as soon as it detected an issue (prevention), that would be even better. While netForensics can do this to a certain extent, many customers are afraid of having machines completely take over security control without a human filter. There is lots of buzz around prevention these days but most Chief Security Officers I speak with are not yet ready to let machines do all of the work. What happens if an automated security system causes a trader to miss a $100 million trade?

My recommendation is that MSFT should look at partnering with security management software companies so its customers can take control of their security. Adding more firewalls, intrusion detection systems, and antivirus technology alone does not make an enterprise more secure. Without a highly intelligent software layer sitting on top of and providing real-time monitoring of all of these devices and the systems and servers in an infrastructure, a company will be as secure as a building with lots of cameras and no one there to monitor it. One other reason for partnering with companies like netForensics is that MSFT has already taken a step into the management software arena with the Microsoft Operations Manager (MOM), an area they were traditionally happy to let vendors like NetIQ handle on its own.

Economy

China’s real effect on our economy

Posted on by Ed Sim

It is easy to blame China for our domestic problems. The argument from Bush and the US Goverment is that because China is keeping the Yuan artificially low against the dollar, the US is losing jobs and running a huge trade deficit. The US Government is asking the Chinese to float its currency against the dollar to help solve this fundamental problem. However, the big issue is that our economy is extremely vulnerable to China, and there is much more at stake than losing jobs to China. By keeping the Yuan low, the Chinese are keeping our interest rates low as they are huge buyers of US Government bonds (as of May 2003, China held $121.7 billion in US Treasuries ranking it 3rd in foreign ownership behind Japan and Britain). From your economics 101 days, you will remember that interest rates and bond pricing work in inverse order. Heavy purchasing of Treasuries increases the price and conversely lowers the interest rate. If China ever decides to sell these bonds it could start a massive chain reaction which would be detrimental to our economy. One of the big reasons for this is that our country is a huge net borrower, corporate-wise, individually and fiscally. All is well and good when we are borrowing at low interest rates heavily financed by foreigners. This certainly drives near term growth. Just look at how the refinancing boom has spurred incredible consumer demand over the last year. However, given the amount of borrowing that we do as a country, we are extremely vulnerable to interest rate risk.

Bill Gross, Pimco’s bond guru, paints a scenario in which a devaluation of the Yuan could trigger some nasty consequences:

“A more likely course would posit reduced Asian and U.S. purchases of Treasuries, a diversification into Eurobonds, a stronger Yen and Yuan over the next few years, more expensive U.S. imports after a lag, a sapping of consumer spending power, gradually rising intermediate and long-term rates, a declining housing market and yes a near body blow to America’s financed-based economy for all the reasons outlined in previous pages.”

So before we get too excited about domestic growth and the great performance in the stock market this year, let’s remember that our economy is not as invincible as we may think. We are potentially vulnerable to the Yuan and other Asian currencies which are indeed overvalued and need to be corrected. When this happens and how this happens will obviously determine the effects on our own economy.

Why is this important for those in technology? Even though technology stocks have performed incredibly well this year and even though Google is talking about going public next year (see an earlier posting), I just do not want us to get too excited about a return to the earlier bubble period. Some of us may have forgotten already as you can see from this NY Times piece yesterday about investors’ appetite for risky stocks. What is important is that we do not use the market as our sole proxy for the strength of our economy as it can be deceiving. Companies still have to generate meaningful earnings and cash flow. This macroeconomic backdrop certainly has implications about what types of companies I believe will have a better chance of performing during the next few years. I hope to address this topic in a future posting.

Investing/MarketsVenture Capital

Google weighs IPO next year

Posted on by Ed Sim

Yes, this is old news and much anticipated.

Just one word of caution for us venture capitalists and entrepreneurs-let’s not equate this to a return to the mid-to-late 90s IPO boom. According to many investment bankers I have met with, today’s companies, unlike yesterday’s, need to have $10-20mm of revenue a quarter, be profitable now and not in 8 quarters, come from an established and not an emerging sector, and have a valuation based on real earnings and growth and not one on revenue. One additional note-many companies from the bubble era were able to go public 1-2 years from their first round of venture capital. If you assume a 2004 IPO for Google and Salesforce.com, both would have taken 5 years from their first round of venture capital. One can argue that Google could have gone public much earlier, but the point here is that patience is key. If you look at the historical data, subtracting out the bubble period, it traditionally took 4-6 years of development from the first round of venture financing for a company to go public.

Trust me, this is great news for venture capitalists and entrepreneurs, but let’s remember that when and if Google and Saleforce.com go public next year that the world has changed and real earnings and cash flow matter this time.

Open Source

Linux on the Desktop (continued)

Posted on by Ed Sim

In an earlier post, I talk about 2004 as a year where Linux begins to make inroads on the desktop. Here is a recent article from Infoworld suggesting the same. In the article Nat Friedman, cofounder of Ximian which was recently sold to Novell, makes some interesting points.

1. It is not a David vs. Goliath battle where Linux fells Microsoft with one swift blow;
2. Desktops for Linux shouldn’t try to look like Windows.

To dive deeper into point #2, Friedman says, “What you’re doing is lying to the user. What you want to say from the outset is, ‘this is a different desktop experience, but it’s going to be easy.” On the one hand he seems to be saying this because the user experience on Linux should be better, more reliable, and more secure. On the other hand, I disagree because from a business perspective corporations usually pursue the path of least resistance. If a Linux desktop acts and feels like Windows it means that corporations will not have to train their employees on a new OS. This saves a company potentially lots of hours and $$$ and lowers the Total Cost of Ownership of the product.

Entrepreneurship

The Perfect is the Enemy of the Good

Posted on by Ed Sim

Yesterday, I was in a meeting with an early stage company reviewing the product development plan with the management team. While the plan was well thought out and defined by process, there was one major problem-it would take too damn long to get a product in GA (generally available to sell!). There were 2 problems-an overemphasis on process and a burning desire to build the ‘perfect product’ at the expense of getting to market. Let me address each problem in turn.

While having the right development process is absolutely critical, I do have concerns about early stage companies being too focused on process. An early stage company’s lifeline is to outinnovate its larger competitors. In any market worth caring about an early stage company will also find other start-up competitors as well. If a company is overfocused on process at the expense of getting to market, I guarantee that it will be climbing uphill against companies that place more emphasis on speed to market. Trust me, I have seen this movie before. At the same time, I am not advocating that you build product with no process either. Balance is key!

What I saw yesterday was also a desire to build the ‘perfect product.’ This is another crucial mistake that companies can make because you can end up overdeveloping and adding features that nobody needs. Once again, an early stage company must balance between getting the right product out with speed to market. An overemphasis on the ‘perfect product’ will only land you on a treadmill chasing your competitors’ constant barrage of new offerings. Having a ‘good product’ many times will suffice and give you the ability to have your sales people sell, bring features and functionality ahead of your competition, and get real world feedback to further improve your offering. Like an old, wise entrepreneur once told me, “The perfect is the enemy of the good.”

EntrepreneurshipGlobalization

NYC Entrepreneurs and Offshore Resources

Posted on by Ed Sim

Having met with a number of NYC entrepreneurs recently, I am refreshed to see that many of them are utilizing offshore resources to develop their products. Yes, this is not a new phenomenon, but in a city that lacks hard core developers willing to work for options instead of cash like the Wall Streeters, it is significant. New York has always been known as a strong new media capital and not known for development of real hard core software. New York is also known to have one of the greatest customer bases in the world. Combine access to customers with an ability to manage and use offshore resources effectively and you really get a good opportunity to build some interesting companies in New York.

Open Source

Time for Linux on the Desktop?

Posted on by Ed Sim

As everyone knows, Linux has grown dramatically in the server market capturing 20+% market share in a few years. Many of you also know that there have been a number of attempts to bring Linux to the desktop. Eazel founded in 2000 wanted to make a Linux GUI as easy to use as a Mac. While many of these attempts failed, I believe we are ready for another wave to bring Linux back to the desktop for the following reasons:

1. Success of Linux in server market causing enterprises to evaluate Linux on desktop;
2. Pricing-Microsoft changed its pricing model forcing enterprises to upgrade every 2 years;
3. Security-tired of those MSFT patch updates yet;
4. Functionality-it has gotten way better and easier to use and install, even office apps work on Linux;
5. Performance-do not have to upgrade hardware with software;
6. Browser becoming a platform in and of itself-more and more applications are being run in the browser as we get more and more connected to the Internet.

There are a number of companies going after this market including: Suse, Lindows, redhat, and Xandros.

As time passes, Linux is increasingly becoming a viable alterntive to Windows. That being said, it will not be for everyone like power Office users. However, I feel that in 2004 we will see some large corporations go with Linux on the desktop. Many corporations are already looking at how to segment its users and figure out who really needs Windows and Office and who can get by without it. Microsoft is already countering by saying the Total Cost of Ownership is much higher with Linux. What’s needed are management tools so that a system administrator can easily manage a multi-OS environment. If Linux on the desktop is going to be successful in the corporate market it will have to coexist with Windows. Of course, that is a different story on the international front where many countries are moving to Linux outright. Either way, it will be interesting to track this development over the next couple of years.

SaaS

ASP Part II-Siebel buys Upshot, Motiva

Posted on by Ed Sim

Siebel Buys UpShot, Motiva

If you can’t beat ’em, join ’em. On an earlier post, I commented on the return of the ASP model. It looks like Siebel is jumpstarting its efforts on the ASP side with its purchase of Upshot for $50mm + $20mm of earnout for 2003 and 2004. For an industry-changing hosted CRM play, that does not seem to be a hefty price. Let’s see what happens with Salesforce.com when and if it goes public next year. Word has it that Salesforce.com is expecting to do $100mm of revenue in 2003 while being profitable for the last 2 quarters.

Speaking of CRM, it is interesting to look at 2 other eCRM players, Kana, an enterprise vendor, and LivePerson, an ASP. At one point in time, Kana was worth $5b to LivePerson’s $300mm market cap. Today Kana is worth $105mm and LivePerson is at $135mm. The consensus analyst estimates have Kana losing ($0.54) this year and ($0.01) next year while LivePerson is forecasted to have EPS of $0.01 this year and $0.10 next year. It looks like profitability and operating leverage finally count. The luster of the ASP model seems to have returned to the public markets.

EntrepreneurshipVenture Capital

NYC 2.0

Posted on by Ed Sim

I recently spoke with Richard Adams, founder of Referral Networks, which was later sold to Peopleclick. He has started a new venture, RipDigital, which does the dirty work of converting CD collections into MP3 libraries. Basically all you have to do is place an order on the website and the company ships a box to you, you pack your CDs into the box, RipDigital does the conversion, and then ships your new library on either a DVD or portable hard drive along with your CDs. It is truly frictionless commerce. While interesting, this is not the only project that Richard is working on these days.

I have also been staying in touch with Owen Davis who co-founded Sonata (Thinking Media) with Vid Jain. Owen and Vid are back at it again with a new company, Petal Computing. Petal, according to its website, provides software that allows a dedicated group of PCs to operate like an enterprise server or mainframe. Its solutions are further optimized for the high performance needs of the financial world, including modeling, cash management, risk analysis and pricing. In other words, Owen and Vid have created cluster computing software which is highly specific and focused on the financial sector. While the cluster computing space is a competitive market with some established players, I like their approach to building the business. They have actually been working on the software for the last 2 years.

In fact, many NYC 2.0 entrepreneurs (those NYC veterans on their second venture-I hesitate to use the word Silicon Alley since that leaves a bad taste in many people’s mouths) are starting companies with a new philosophy to build businesses that uniquely solve a real customer problem. Embedded in the new way of starting companies is strong financial and product discipline. In other words, NYC 2.0 entrepreneurs have learned to keep the burnrate low until they have a great product they can sell repeatedly with feedback from living, breathing beta customers. With this philosophy, these entrepreneurs just may have a better opportunity to create some real businesses that will generate meaningful cash flow.

BTW, I placed my order with RipDigital today for 250 CDs today and will report on the finished product at a later date.

SaaS

A big week for VOIP

Posted on by Ed Sim

I have been helping a friend of mine who is moving into town get access to local resources such as carpenters, painters, and restaurants. An email I received from him today had the standard list of questions on utilities but the one that surprised me most was, “Who is your cable provider and do they offer VOIP?” This was a surprise since he is not the most bleeding-edge technical guy. In my mind VOIP really hit the mainstream this week with this email, Thursday’s Wall Street Journal (unfortunately subscription required) article about VOIP’s threat to the Bell companies, and today’s New York Times front page coverage in the Money and Business section.

While programs like Skype offer free P2P telephony over computers, services like Optimum voice offered through Cablevision and Vonage are the true groundbreakers that are bringing VOIP to the mainstream. Mainstream users do not want to be tied to their desks with computer headsets. With these services, customers can simply plug their phone into an adapter which converts analog signals to digital. There is no need to buy new equipment or even change how you use the telephone. Vonage claims to already have 55,000 lines. Since there is no competitive advantage technically in the VOIP service business, it will be interesting to see how cable companies, startups, and Bells compete with each other on marketing services and pricing. The great news is that consumers will only reap more benefits as VOIP continues to gain market share.