Progress is always made by commoditizing technology. First someone invents something new, for example the invention of the radio.. The technologies developed from the realization of one idea, leads to new ideas that use a combination of other existing technology, and with new technology...

I think the landscape has changed in this regard, moreso than before. It seems it is becoming increasingly easy to take a commodity, and use it to implement an idea.

We can now access highly powerful systems, and interact with them. Think for example about services provided by Google. We have such powerful tools, that it is possible for a small guy to implement very powerful things. Things we could have only dreamed of years ago.

The exact same has and is happening in the security world. Hackers can implement a protocol in no time, and try their ideas, without having to study a specification as thoroughly. With access to open platforms (Linux, BSD) and programming languages that are built for rapid development, modularity and power.

The freedom to tinker hasn't been better.

As we know, company security has mostly been focused on properly configuring firewall rulesets, patching of services. password security. I'd say security has been and is focused at the obvious perimeter.

As for desktops, laptops at work or at an employee's home... 'we' think of anti-spyware, anti-virus out-of-the-box solutions. But do 'we' really think about it seriously?

But the real risk of security nowadays *are* exactly those systems. We see increase in SQL injection attacks... We know these desktops and laptops are vulnerable. Yet for those systems we only consider worms as a serious threat.

Do those responsible for security? Or those who see it their duty to break into a company's network realize the opportunities here? Employees having VPN connections with the company's internal network from their laptop or home computer? Client-side attacks through mail, websites, etc.

I say, all organizations are *highly* vulnerable in this regard. There is only obscurity. What I'm suggesting.. finally after many years there is awareness about the threat of direct server-side attacks. But I see little awareness about the possibility of a *targetted* attack against internal networks *through* those client-side machines. When is the industry going to accept that a virus scanner is not a solution to this? Do we really appreciate the ridiculousness of relying a virus scanner? When a virus scanner needs to kick in to prevent your system to be comprised....

We can see daily evidence of interest in client-side attacks, and improvements as well. Think of the recent developments in rootkits for example. There is a shift towards otherwise before more difficult attack strategies to attack a private network; the client side attacks and the protocol attacks (DNS, routing protocols).

That leads me to my next subject... commodotization