Back in (Dan) Geer

February 01, 2004 — CSO — After a two-and-a-half-month hiatus following his ouster from @Stake, Dan Geer has a new job. Geer, the former CTO at @Stake, was fired after publishing a paper that was extremely critical of Microsoft, one of @Stake's clients. Now he's vice president and chief scientist at Verdasys, a startup in Waltham, Mass., that focuses on digital rights management. (He was an adviser to the company for a year previous to this.) Geer says he has no regrets about publishing the paper, and he still has plenty of opinions on information security. CSO caught up with Geer the day he was introduced as chief scientist at Verdasys, or as he called it, "My day to remind everyone that living well is the best revenge."CSO: What are your thoughts on "l'affaire de white paper" two months later?Dan Geer: It still disappoints me. Four years of dog labor. I was the hardest-working person there, frankly. No one works that hard when they have toonly when they want to. I wanted to work hard there. That's why I'm disappointed.What's different about your new job compared to the last one?To me, chief scientist is about figuring out what the future holds, whereas when I was CTO of @Stake, I was deciding what products to bring into the world.What does the future hold?At the moment, I'm interested in figuring out how we learn to measure security in every sense. It's easy to say and hard to do, and nevertheless essential. It's clear to me that some things are easier to measure than others, and we should start there, with what we can do, and work toward the harder measurements.What are some of the measurements we can do now?Take the Financial Services ISAC. [Geer's a member.] It seems you'd want to share your sanitized intrusion logs with other companies. There's no way to know if you're a target of choice or a target of chance unless you measure yourself against others. We've got that data. Now we've got to measure it.What else are you thinking about?Well, in relation to what Verdasys is doing, in the last 10 years, we've gone from protecting the Internet, to protecting a domain like .mil, to protecting a company, to protecting a machine. The perimeter has been closing in. Now it surrounds only the individual file. I think this is about the right level for the perimeter, and it's what Verdasys addresses with