The innovation of innovation

I have been reading more than a few posts lately questioning if innovation is dead in security and what is next.  What is the "next big thing"?  That is something Brad Feld and his VC friends ask themselves all the time.  However, I have a different take on what is the next big thing and whether or not innovation is dead in security.  I think in general, innovation comes most often in the shape of combining existing technologies in ways they have not been combined before.  Only rarely does innovation involve truly new technology that has not been seen before.  Both types of innovation can be disruptive to the market and both provide ample opportunity for innovators to capitalize and profit.  People who wait around waiting and lamenting for the next big thing to come along almost always miss it.

What do I mean by truly new technology that comes along almost once in a generation or decade.  For instance the Internet and cell phones are extreme examples.  VOIP, smart phones are other examples.  In security, the firewall, the signature based IDS or AV are examples. These are all innovations that created great shifts of wealth and changed the way things were done.  But innovation more often takes the shape of combining existing technologies in new ways which make lives easier and are more efficient than what is being done before. These types of innovations also change markets and create great wealth.

An example of this, is what is happening with post-connect technology in NAC.  Clearly the early NAC systems were all about pre-connect health and posture checking.  Even todays post-connect systems have at least some rudimentary pre-connect functionality.  However, combining this pre-connect health check and monitoring traffic after logging on to the network with IDS functionality is now called post-connnect NAC.  NAC purists, including myself at first scoffed at this, saying it was not NAC.  However, the market has said, yes this makes sense.  We want pre-connect health checks and post-connect monitoring and enforcement and we call in NAC.  Nothing earth shattering in the way of technology but there is opportunity there and it was innovation.  I think we will see this again in creating actionable intelligence from data that is currently collected in SIMS today.  Again marrying existing technologies in a combination that will result in innovation.

Rajat Bhargava, my friend, partner and StillSecure CEO's greatest strength is combining existing technologies in new and innovative ways.  In his short but distinguished career he has done this time and time again and it what helps drive innovation at StillSecure.

So my message to my friends looking and wondering where the next innovation will come from in security is, not to wonder, it will come.  It will probably take the form of things you are familiar with now.  Waiting around for it is a sure fire way to miss the boat. Start looking at problems and thinking of ways to solve them with what is out there now.