Q. Is Guardian Digital a software-only open-source security system or do you also sell appliances?
A. Both, actually. We focus on offering customized solutions. That being said, since we started, the company has offered our services and software on a pre-configured device, if the client so chooses, as it matches their desired needs — bandwidth, users, etc.
Q. Explain why Guardian Digital’s model is different to the single-purpose appliance, which commonly is referred to as unified threat management.
A. Well, first off, I’d like to say that I might disagree with that definition a bit. I think it’s safe to say that the term unified threat management, UTM, has been polarized a little. It can be defined as the general ability to configure and maintain multiple layers and applications from the same interface, not necessarily from just one particular appliance. It typically includes a fixed set of applications in a one-size-fits-all format. Sure, unifying this functionality in one appliance can be labeled UTM, but I don’t think it’s solely defined by this.
To directly answer your question, our model is more adaptable than that of a sole, U appliance vendor. In truth, we are a service company first, offering a complete array of solutions, from the platform, to the applications, to our managed services. This can be leveraged in the form of outsourced hosting, a physical secure device or on a client’s dedicated hardware. It depends on the organization’s requirements. We aren’t constricted by the fact that we just sell a box. There’s more to it than that, and our customers appreciate the flexibility this provides.
Q. In general, how would you characterize the attitude of companies toward open-source and Linux-based security and how has this changed in recent years?
We knew from the very beginning that open source was a means to an end, since, in a way, it has been associated with an identity. Since that was, and partially still is, the case, Guardian Digital has always marketed ourselves as a specific solution to a business problem; a solution that happens to come from open source. While our business model includes open source, what differentiates us is how it’s implemented and those specific business problems we solve using it.
Initially, we drew mostly those who knew and were comfortable with open source, as many companies were hesitant. What’s changed can best be explained as de-programming. Through the last 10 years, open source has had this moniker attached to it; that of some kind of out-lying fringe of the tech-world. This is inaccurate, but it still diluted its appeal early on, and open source has grown despite it. While this image is being erased, it will still take time.
Q. What is the single biggest mistake companies make in implementing an open-source security strategy?
A. Great question. The answer to this is really in two parts. First, don’t look to a company that is selling open source — look for a vendor that is providing a solution for security, through open source. Open source shouldn’t be the selling point.
As it relates to security, the biggest mistake is repackaging a collection of different open source applications from different companies, and expecting them to ‘just work’ securely when you throw them in the same basket. That’s an illusion. True security is a process that requires integrating and engineering all applications with a comprehensive policy that must be maintained. Open source can certainly provide this cohesiveness, but it must be developed intentionally to provide it. Having a basket-full of separate open source applications with a pretty interface just isn’t enough to combat the sophisticated attacks businesses must deal with.
Q. Does it make sense for a company to have an open-source security platform, even if it hasn’t deployed open-source elsewhere?
A. Of course. Our solutions can integrate completely with any existing infrastructure quickly, the issue isn’t related to its affect on the great network. The criteria used involve is the solution the most robust security, for the most affordable total cost of ownership. We engineered EnGarde Secure Linux and its applications to be as manageable as possible, using a point-and-click interface, so the learning curve simply doesn’t exist. Our customers come to us because we have the solution to their specific business problem — the fact that it’s open source is seen as a benefit, knowing that typically no security or programming expertise is required.
Q. How many customers do you have and where are they mostly located?
A. Since our inception in early 1999, we have attracted over 500 clients in almost every international market. Most are located within the US and Canada, while we have clients in India, New Zealand, England, Kenya and Germany as well.
In addition, our EnGarde Secure Linux Community edition is a full-featured secure platform that’s built entirely from open source, like all of Guardian Digital products, and contains many of the capabilities of our enterprise offerings, and is available completely free for download. We’ve recorded tens of thousands of downloads in recent months, and untold numbers of copies distributed throughout the Internet.
Q. Is there more acceptance of open-source security in Europe than in the US?
A. Absolutely. In the US, proprietary software companies were able to really garner a lot of leverage, especially in the large businesses, and that trickled on down, especially as Linux-based companies got their start in the last 10 years. Europe wasn’t exposed to this nearly as much, and without this semi-forced standard, was more acceptable to other options. Now, Europe has realized that the cost-of-entry is much lower through the use of open source, and it’s typically implemented to be more secure and transparent than their proprietary counterparts.
Prior to launching Guardian Digital, Dave Wreski was a senior architect for UPS Worldwide, where he managed the security architecture of the company’s global data centers and the company’s Internet systems security policy.
