After a two-and-a-half-month hiatus following his ouster from @Stake, Dan Geer has a new job. Geer, the former CTO at @Stake, was fired after publishing a paper that was extremely critical of Microsoft, one of @Stake’s clients. Now he’s vice president and chief scientist at Verdasys, a startup in Waltham, Mass., that focuses on digital rights management. (He was an adviser to the company for a year previous to this.) Geer says he has no regrets about publishing the paper, and he still has plenty of opinions on information security. CSO caught up with Geer the day he was introduced as chief scientist at Verdasys, or as he called it, “My day to remind everyone that living well is the best revenge.”CSO: What are your thoughts on “l’affaire de white paper” two months later?Dan Geer: It still disappoints me. Four years of dog labor. I was the hardest-working person there, frankly. No one works that hard when they have toonly when they want to. I wanted to work hard there. That’s why I’m disappointed.What’s different about your new job compared to the last one?To me, chief scientist is about figuring out what the future holds, whereas when I was CTO of @Stake, I was deciding what products to bring into the world.What does the future hold?At the moment, I’m interested in figuring out how we learn to measure security in every sense. It’s easy to say and hard to do, and nevertheless essential. It’s clear to me that some things are easier to measure than others, and we should start there, with what we can do, and work toward the harder measurements.What are some of the measurements we can do now?Take the Financial Services ISAC. [Geer’s a member.] It seems you’d want to share your sanitized intrusion logs with other companies. There’s no way to know if you’re a target of choice or a target of chance unless you measure yourself against others. We’ve got that data. Now we’ve got to measure it.What else are you thinking about?Well, in relation to what Verdasys is doing, in the last 10 years, we’ve gone from protecting the Internet, to protecting a domain like .mil, to protecting a company, to protecting a machine. The perimeter has been closing in. Now it surrounds only the individual file. I think this is about the right level for the perimeter, and it’s what Verdasys addresses with digital rights management. Plus, the founders here came from a biotech firm that had an incident with digital rights management. I like working with security people who are sadder and wiser.But that technology is about controlling people’s behavior onlinefor example, by not letting them copy and paste. It seems intrusive.Well, the technology doesn’t say you can’t have the file or the data in it, it says you’re accountable for what you do with it. We cannot prevent those who are truly dedicated to stealing a file from doing it. But we can keep honest people honest, even if we can’t make the dishonest honest.What do you think about the potential class-action lawsuit against Microsoft?I would love it. If the genie were in the room and granted me one wish, I would ask for one tiny, little change in the liability system. That is, if your failure to protect your systems affects me, why can’t I have a beef with you? That’s a change I’d like to see. Related content news UK government plans 2,500 new tech recruits by 2025 with focus on cybersecurity New apprenticeships and talent programmes will support recruitment for in-demand roles such as cybersecurity technologists and software developers By Michael Hill Sep 29, 2023 4 mins Education Industry Education Industry Education Industry news UK data regulator orders end to spreadsheet FOI requests after serious data breaches The Information Commissioner’s Office says alternative approaches should be used to publish freedom of information data to mitigate risks to personal information By Michael Hill Sep 29, 2023 3 mins Government Cybercrime Data and Information Security feature Cybersecurity startups to watch for in 2023 These startups are jumping in where most established security vendors have yet to go. By CSO Staff Sep 29, 2023 19 mins CSO and CISO Security news analysis Companies are already feeling the pressure from upcoming US SEC cyber rules New Securities and Exchange Commission cyber incident reporting rules don't kick in until December, but experts say they highlight the need for greater collaboration between CISOs and the C-suite By Cynthia Brumfield Sep 28, 2023 6 mins Regulation Data Breach Financial Services Industry Podcasts Videos Resources Events SUBSCRIBE TO OUR NEWSLETTER From our editors straight to your inbox Get started by entering your email address below. Please enter a valid email address Subscribe