Kaspersky: Microsoft OneCare was 'good enough'

Kaspersky: Microsoft OneCare was 'good enough'

Summary: Eugene Kaspersky, co-founder and CEO of Kaspersky Lab, explains why the security vendor has much to thank Microsoft for.


Eugene Kaspersky once told a competitor to his face: "I will eat you." The co-founder and CEO of Kaspersky Lab was certainly not into cannibalism, but was clearly hell-bent on winning over the majority market share his competitor had in the company's base in Russia.

That was in 1995, the year Windows 95 was launched. Contrary to Kaspersky's strategy to develop new software optimized for the Microsoft operating system, its domestic rival saw no need to do so. Today, Kaspersky has the pleasure of saying he had the last laugh since the tables have turned, and it is now the market leader in Russia while its competitor has less than 1 percent share.

In Singapore this week for an Interpol conference and customer and media meetings, the 44-year-old Russian spoke candidly in an interview with ZDNet Asia as he elaborated on the security strategy of rival Microsoft, as well as how cybercrime should be combated.

Q: You've been a security analyst for 20 years. What frustrates you most in the work to keep cybercriminals at bay?
Kaspersky: Understanding what we do is very important. We're not just doing business or just developing some software. We're fighting with the bad guys. It's a very complicated game because many of our opponents are high-level experts. It's very difficult to find solutions against some types of threats. It's a technological arms race.

Are you saying that people often don't understand the complexities of the work security researchers are involved in? Consumers, businesses and even governments?
Governments do understand because they are more and more in touch with these problems. Enterprises, big enterprises, some of them have dedicated teams of security experts and they really understand what's going on. Consumers generally have no clue, but they don't need to understand.

If you had the power to change up to three things in the world today that are related to IT security, what would they be?
Internet design--that's enough.

That's it? What's wrong with the design of the Internet?
There's anonymity. Everyone should and must have an identification, or Internet passport. The Internet was designed not for public use, but for American scientists and the U.S. military. That was just a limited group of people--hundreds, or maybe thousands. Then it was introduced to the public and it was wrong…to introduce it in the same way.

I'd like to change the design of the Internet by introducing regulation--Internet passports, Internet police and international agreement--about following Internet standards. And if some countries don't agree with or don't pay attention to the agreement, just cut them off.

Isn't it enough to have everyone register with ISPs (Internet service providers) and have IP addresses made known?
You're not sure who exactly has the connection. I can have a Wi-Fi connection and connect using a password, or give away the password for someone else to use that connection. Or the connection could be hacked.

Even if the IP address is traced to an Internet café, they will not know who the customer or person is behind the attacks. Think about cars--you have plates on the cars, but you also have driver licenses.

What would keep the vision of an Internet passport, Internet government and an Internet police from becoming reality?
It's expensive, and it's very bureaucratic to have all these agreements.

Governments understand that the problem is a very important one to tackle but they behave in a national way. The minds of law enforcement are still focused on national borders, but the Internet does not have borders. It's a new world in which we have to think differently. That's why I always talk about the need for not just cyberpolice, but Internet police--Internet Interpol.

"If I were Bill Gates, I'd run another company--100 percent owned by Microsoft--that produces the antivirus under a different brand."

Microsoft has just launched its Security Essentials. What's your take on the product?
(Grimaces) It's Microsoft 'TwoCare'--it's really the next generation of OneCare. I don't believe in the success of that.

Why not?
Do you believe in the success of Microsoft's antivirus? One person told me: "Yes, but three generations from now." Security is not part of Microsoft's identity. To change that takes years. Companies that want to change their brand definitions have to spend a lot of time and a lot of money, or be smarter.

Toyota was known as a Japanese manufacturer of cheap cars. When they decided to make premium cars, they used a different brand--Lexus. Microsoft can build a very secure product of very high quality, but people will not believe in the brand. If I were Bill Gates, I'd run another company--100 percent owned by Microsoft--that produces the antivirus under a different brand.

But that's a branding issue. What about the quality of the software?
OneCare was good enough. They got very good engineers, a very strong lab--all the resources were in place. From the beginning, the product was good enough but it didn't take market share at all.

But it also faced a lot of criticism from other vendors?
From us, and a bit from Symantec which said the same things as us--that Microsoft and security don't come together.

But, what was good for us was that when they announced they were going to enter the consumer market, our main competitors started to move out of that market. Some of our competitors just cut budgets for consumer product development.

We did the opposite. We allocated more resources. As a result, we're very close to being No. 1 in the retail market in Europe, and we're No. 2 in retail in the United States. We started from zero three years back. So actually, I have much to thank Microsoft for.

Topics: Security, Apps, Hardware, Mobility, Software

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.


Log in or register to join the discussion
  • Microsoft OneCare was 'good enough'

    My proposal is a security industry software licence, this will allow the government to control who uses software intended for legal penetration testing under the Computer Misuse Act.
  • Who issues the passports? Who can get them?

    Maybe we should just make ARIN assign each individual their own unique IPv6 address? Or maybe ICANN can provide for everyone to have their own personal domain name and hosting for OpenID? Do children get their own Internet Passports, and in that case who is responsible for their actions? If children have to use their parents' passport, can they look at pr0n? How do you make Internet passports work at the packet level? IP doesn't have any tagging method to identify specific packets with an individual, and there's the issue of how multiple people should use the same computer at the same time. Which legal jurisdiction will stolen Internet passports be handled by? Exactly who is going to "cut off" sections of the Internet that was built to route around damage caused by a few broken connections. There are at least 10 tier 1 peers, and each of them would have to cut off exactly the same "Axis of Evil" regions that didn't implement the one single standard form of internet passport that would almost certainly arise overnight without too much trouble or discussion or dissension. Even if the tier 1 peers cut off some segments of the Internet, that doesn't prevent anyone else from publishing a new BGP route to those previously unrouted subnets. Please, Mr. Kaspersky, while you're busy redesigning the Internet to be so much better, can you include some butterflies and ponies, too?
  • biggest problem with the internet is not anonymity

    apparatchiks/KGB agents opinions notwithstanding.

    You'd get a lot more security by simply banning Windows computers from connecting to the internet. A heck of a lot more practical, and has less side-effects. What Brian Krebs (Washington Post) said for online banking may as well be true for any kind of internet access -- dont use Windows...!
  • Microsoft OneCare was 'good enough'

    This sounds like yet another egotistical response from a corporation that does not want an operating system bundled with a credible antivirus software program. Perhaps he is attempting to plant the seeds of the idea of such a certification system, whereby antivirus creators would be the ones to monitor them via some kind of registration service?
  • Microsoft OneCare was 'good enough'

    Eugene, What about all the benefits of anonymity?

    I agree that a centralized passport authority (like certificate authorities, if they worked), would be a great benefit to some websites, but the majority of the web thrives on anonymity. Forcing people to reveal their identities would throw us back into a digital dark age. Not to mention the persecution of minorities by their governments etc.
  • Internet Passports, eh?

    Well then you should be the first to have to live with one. Well-versed idiots in ivory towers like yourself are exactly the kind of people that ruin well-established, modern democracies.

    Do you HONESTLY THINK that would solve the problem --- pardon, YOUR problem -- of Internet security?

    The truth is, the Internet wasn't designed for *anything*. It was an experiment. One that has increased knowledge and freedom around the globe. Something your firm hasn't even come close to doing. It is Microsoft Windows that wasn't designed for public use, or at least it seems that way.

    News flash to you, Mr. Kaspersky: I'd rather live in a world with greater risk of dying a terrible death because of a security breach than to have idiots like you float ideas like "Internet passports". What a world you'd create. No thanks -- I'll gladly take the viruses and spyware over that.
  • Microsoft OneCare was 'good enough'

    Just one thought: What is this guy smoking??
  • Permanent addresses

    Assigned IPv6 addresses won't work. They are logical routing addresses. That means I look at the first bits to see which turn to make at the first router, the next bits tell me about the next turn, etc. If I move to a new physical location, I must get a new address or internet routing will no longer work.
  • RE: biggest problem with the internet is not anonymity

  • RE: Internet Passports, eh?

  • Microsoft OneCare was 'good enough'

    Old news. He explain his view on Internet Passport almost one year ago (November 24, 2008) to ebizLatam. You can read the interview (in spanish) at http://www.ebizlatam.com/news/126/ARTICLE/8099/3/2008-11-24.html or you can translate it with Google.
  • Microsoft OneCare was 'good enough'

    If you can't stand the heat get out of the kitchen, passports ?, laughable
  • RE: Internet Passports, eh?

    Well said couldn't agree more. Our human rights are gradually being ripped from us and to allow this is just another attempt to gain control over the population isn't it enough that there is already license plate reading cameras and facial recognition cameras popping up everywhere to spy on us soon as you step out your house your privacy no longer exists these attempts to control EVERYTHING we do go along way to proving that it really isn't a democracy they just trying to pull wool over our eyes and make us think it's a democracy when really it's just another way of persecuting people i presume your suggesting they introduce more taxes on people well they only thing thats not taxed by money at least right now is fresh air although with all the fumes in the air it must surely be affecting our health..i could say so much more but i'll stop right there
  • Microsoft OneCare was 'good enough'

    there is a simple method avaiable, aimed at protecting ones own identity in the web. Using www.weblookon.com
    WebLookOn is a free service to all users in the web. It protects from any form of identity theft and provides many features and functions.
  • Internet Passports and Internet Data Stamps!!!!

    It is a great idea to have Internet Passports and Internet Data Stamps. This can revive the Postal Departments in many countries. Internet has created lot of revenue loss for Postal Department. Now is the time for this deparment reclaim their past glory. This may be bad news for those internet addicts who sit in public libraries writing thrash and messaging junk. This will also keep the junk/spam mail in control. Great idea!!!!!!
  • We need MORE anonymity not less

    Kaspersky's call for Internet Passports is madness. The social repurcussions are surely obvious, and it's not clear what problem it might solve.

    Most cybercrime is actually linked to an EXCESS of arbitrary identification, with inadequate safeguards. For the average user, anonymity in reality has become a luxury. The simplest credit card purchase requires an inordinate amount of identifying information to be divulged, to total strangers, who then pass it all onto third party processors no one has ever heard of. Hundreds of millions of personal records are compromised every year, fuelling a rampant black market in illegitimate IDs.

    I say to Kaspersky, anonymity would be a blessing! To solve cybercrime, we don't need any new passport, rather we need to protect the identities we already have against theft and abuse.
  • RE: We need MORE anonymity not less

    Kaspersky LOL)
  • RE: RE: We need MORE anonymity not less

    I do not agree in a virtual passport, only to protect our privacy. Who guarantees that we will become totally safe even. People just think, as the world is today and developments in the world, I do not doubt that cyber clone also the identities of people, where we stop. Not on the Internet can be happy. I prefer viruses, spam, than the virtual passport.
  • Passport Alternative -- Hardware Solution

    Don't tag the person; tag the data. Data streams can have running digital fingerprints which can be traced back to the originating device (computer, phone, mobile device, game console, etc.). When combined with so-called "tattler chips" embedded in computer motherboards, any data can thus be traced to its point of origin. If there's anything unwanted in the data stream, the offending machine can be disconnected instantly from the Internet. Bad news if you have a bot, but a very strong incentive to clean up your PC or device before petitioning for permission to reconnect to the Internet. Also very Orwellian in its Government Spying implications. You have trade-offs no matter what you do.