Is it safe yet? Not really

Throughout 2005, the tenor of the battle between malicious hackers and corporate defenders began to take a historic turn. Until relatively recently, hackers focused their collective attention on finding holes in operating-system software.

But with the increasing automation of software patching, they began turning their attention to finding flaws in desktop applications. Meanwhile, viruses got smarter, and phishing continued on its upswing.

One person whose business gives him a bird's-eye view of the terrain is Gil Shwed, CEO of Check Point Software Technologies, headquartered in both Israel and California. CNET News.com spoke with Shwed about the changing face of software security.

Q: When we last spoke, one of the things you mentioned was that individual behavior needs to be modified when it comes to security because individuals are the point of access. Has the situation improved substantially from a year ago?

Shwed: I think there's still a long road ahead of us. We haven't seen massive worm attacks yet, but in recent months, we saw some worms that were pretty scary. They didn't cause huge damage, so maybe the infrastructure is faster to react--because of firewalls or antivirus software or things like that.

Does that mean that companies are getting more serious or that they're just lucky?
Shwed: There still are many companies that run outdated security systems. They don't realize that keeping an up-to-date system is critical.

As you've watched the development of spam and phishing, do you think these are becoming more manageable problems?
Shwed: Out of all e-mail traffic, spam is still between 40 percent to 50 percent of the total--which is horrible. More needs to be done, but it's manageable. I mean, 99 percent of it gets blocked by the antispam software. Phishing is a more challenging problem because there's also the challenge involved with people, not just technology.

You mean their behavior?
Shwed: Yes. You can always find ways to fool people.

The even worse news is that they're getting smarter. Some of the early phishing e-mail was obvious, and you knew it was a hoax. But increasingly, it looks genuine.
Shwed: That's true, but remember that the big hackers of the early Internet, like Kevin Mitnick, got through because of social engineering. It wasn't because of the sophistication or lack of sophistication of the IT infrastructure.

So what do you see, then, as the big security issue for 2006?
Shwed: Companies need to build a security architecture that is ready for the unknown, not one that is ready for yesterday's threat. It may be that yesterday's threat will be back again, but it's more likely that it will be something different. What the threat of tomorrow will be, I don't know.

But being successful in the software business doesn't mean that I'm becoming the new authority on the peace process.

Even if it's not blocking them, it has to act quickly and react quickly. That's why we believe that software is a solution; that's what software is for--it's flexible. We say our next stage is universal updatability, so you keep up and run the new services that we have.

Let's talk a little about the situation in Israel. Has the departure of Benjamin Netanyahu as finance minister been affecting Israel's high-tech landscape? He had support from the establishment for some of the things he did.
Shwed: I don't think it's going to make much of a difference. I'm not trying to make any political statements, but I think that as the minister of finance, he did well. He promoted opening the economy to privatization, and there was generally good progress. I think that the rest of the government is pretty much committed to that.

What's the corporate tax right now in Israel?
Shwed: It's 26 percent, but we already have a reform move in the process that will take it to 25 percent.

By 2006?
Shwed: I don't remember, exactly--two years, three years--something like that.

Is there much business within the region between Israeli high-tech companies and some of Israel's neighbors?
Shwed: No, not much, except Turkey. But in Egypt or Jordan, there's some, but it's completely insignificant.

Let's talk about India. How is Israel going to adjust to the challenge of a much larger country with an increasingly tech-literate work force that's also less expensive to hire out?
Shwed: I think the reason Israel is successful is not because of labor rates. The issue is skills for developing new products. Israel can compete with India without having thousands and thousands of people for tasks like call centers.

What are you seeing out of India--and China, for that matter--as far as possible competitors to Check Point?
Shwed: We're not seeing any competitors for Check Point from China or India.

Do you have a sense of what IT demand is shaping up to be for 2006?
Shwed: I don't see much of a slowdown. The benchmark that we all have now is what happened between 1997 and 2000, and that was a very unusual period for economic growth. So when we say today that the economy is healthy, it's not the same. I think that high-tech companies do have to work pretty hard to justify their value.

One of the criticisms you've probably heard is that Check Point has been slow to roll out new products. Do you need to accelerate your timetable?
Shwed: I think that criticism probably belongs to two years ago. Since then, we've rolled out a lot of new products. If you look at our product portfolio today, it's hugely richer than what it was two years ago.

Are you seeing much increased competition from Cisco Systems?
Shwed: No. We have competed against Cisco for 10 years, so there's nothing new about that. Of the dozens of products they acquired over the years through acquisitions, none is a big leader. We're trying to present a slightly different alternative--one of being focused on security and offering an architecture that people can use to build an entire security solution.

Is most of your product development coming out of Israel, or is it here in the U.S.?
Shwed: Most of it is in Israel, but we have here (in the U.S.) an amazing group. By the way, we've got some research and development teams in other parts of the world--including a research center in Minsk.

A number of high-tech executives in this country have found a career in the public sphere after leaving the business world. After Check Point, have you considered some sort of career in government?
Shwed: Not at the moment. I don't know--maybe in 20 years, I'll change my mind. Right now, I'm pretty happy with what I'm doing. I'm not ashamed to express my opinion and talk about things. But being successful in the software business doesn't mean that I'm becoming the new authority on the peace process. I may have my opinions as a citizen, but it's no different than anybody else.