Feeds

Firm offers to patent security fixes

Cash from chaos

Beginner's guide to SSL certificates

The market for software vulnerabilities just got even more complex with the arrival of a firm that offers security researchers a chance to profit from their work by patenting security fixes.

Intellectual Weapons offers a revenue split with researchers who embark on what it admits is an ambitious strategy. It claims rival schemes offer only a fraction of the income its approach, which it defends as ethical, offers.

Any old flaw

Schemes such as iDefense's Vulnerability Contributor Program and 3Com's Zero-Day Initiative offer flaw finders a chance to get paid for their work. In return, security firms get the chance to add protection for upcoming flaws to their products, a useful "value-add" in the highly competitive security tools marketplace. Payments vary but tend to max out at around $10,000.

For flaw finders with the right contacts, sales to government agencies might fetch as much as $50,000 or more, depending on the vulnerability. Selling flaws direct to hackers through the underground black market in flaws offers an even greater potential (albeit illicit) reward.

Governments, much less black-hat hackers, are unlikely to disclose vulnerabilities to suppliers since the value of flaws to them is measured by their longevity and effectiveness as a tool to break into systems.

Weapons of flaw

IP property outfit Intellectual Weapons works with researchers to obtain and enforce patents relating to fixes for security vulnerabilities. The scheme works by attempting to license the fix to suppliers of vulnerable products, their competitors, and vulnerability protection firms.

Intellectual Weapons said it fully expects "major battles" in enforcing its IP, which is just as well since the firm's business plan puts it toe to toe with Microsoft's formidable team of lawyers. Security researchers need perseverance in order to stand a chance of scoring half the revenues from licensing offered by the firm.

Security researchers approaching Intellectual Weapons need to have big cajones, the firm advises. Intellectual Weapons said it developed an approach to streamlining the patent application and licensing process, but admits it is still far from straightforward.

"If this sounds too daunting, you are free to give your discoveries to your employer, help vendors secure their products for free, show off to your friends, grovel for security jobs, or sell your raw discoveries to middlemen for a fraction of their true value. We only want people who dare to play for high stakes," it said.

Intellectual Weapons is only interested in original vulnerabilities, discovered without resorting to illegality. Its preference is for security fixes that are difficult to "design around" and innovative, such that it's more likely to be granted a speedy patent. Technical elegance or other more general security imperatives don't really come into it.

The firm quotes examples of smaller firms who've come ahead of IT giants in patent fights to support its business model, which it claims is more akin to traditional "responsible disclosure" than the "patent trolls" its detractors might compare it to. The firm is yet to come up with examples of its own.

More about the firm can be found here. ®

Internet Security Threat Report 2014

Whitepapers

10 ways wire data helps conquer IT complexity
IT teams can automatically detect problems across the IT environment, spot data theft, select unique pieces of transaction payloads to send to a data source, and more.
The total economic impact of Druva inSync
Examining the ROI enterprises may realize by implementing inSync, as they look to improve backup and recovery of endpoint data in a cost-effective manner.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.