Conference papers - academic vs. commercial

Will your next exposure be academic or commercial?

Information Security is an odd environment in that most of the leading edge research takes place away from academic and designated research institutions, out in the industry. As a result there is a curious approach to publishing new information that doesn't really exist anywhere else.

The InfoSec conference circuit is in full swing in the US at the moment, and with professionals and interested parties have to pick and choose the appropriate conferences to attend, some people have questioned the place of academic-focused conferences in an environment where most of the work seems to be done by the private individual or corporate body.

As the move to commercialise research continues ,and as companies reach out into more costly fields of research, more of these findings will go behind closed doors. When RSnake and Jeremiah Grossman, two noted online security experts, commercialised their skill sets, the volume of their open reporting shrank considerably. In addition, the value of the material decreased as well, as the commercial value of their skill sets precluded open discussion of material that was receiving commercial attention.

Unlike most industries, Information Security is a field where the leading edge knowledge base is in the industry and not in the tertiary or dedicated research institutions (not the same as the research groups that many companies operate). This has the odd effect that the academic conferences don't necessarily attract the best of what is happening with new research and findings.

With no academic peer review, rather only that of other industry participants, the value of new material at commercial conferences can be hard to determine. This is especially true for material that is shipped from conference to conference with little change (making it more PR than relevant new research).

An upside to this is that the peer review that does take place is almost instantaneous - there will be someone in the audience or who obtains the presentation who will immediately be able to test and evaluate the claims being put forward, something that Kaminsky's DNS vulnerability disclosure debacle shows well.

At least academics have the ability to fall back to ongoing peer review and technical criticism to help improve the quality and validity of their work. In the commercial Information Security world, disagreements over conclusions drawn from results can vary wildly and rapidly descend into messy flame wars.

Recently n.runs and McAfee engaged in such a slanging match over conclusions that n.runs had drawn which criticised antivirus vendor software security, something that McAfee took to heart.

Without a recognised arbiter or central panel to decide on an outcome, public arguments such as this are going to have to be an acceptable drawback to the otherwise positive unique research and disclosure environment that exists in Information Security.

Despite the egos present in Information Security, there is no tenure and you are only as good as your last exploit/disclosure.

Join the newsletter!


Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Follow our new CSO Australia LinkedIn
Follow our new social and we'll keep you in the loop for exclusive events and all things security!
Have an opinion on security? Want to have your articles published on CSO? Please contact CSO Content Manager for our guidelines.

Tags information securityinfosec

Show Comments

Featured Whitepapers

Editor's Recommendations

Brand Page

Stories by Carl Jongsma

Latest Videos

More videos

Blog Posts