Desktop Search - How Content is changing the security landscape
I have been an avid user of Desktop Search tools since their inception in 2003/2004. I have used Lookout, Google Desktop Search, MS Desktop Search, and now a user of X1. These tools have gotten progressively better over the years with the exception of Google Desktop Search which was built to destroy hard drives as it does nothing but thrash your hard drive.
For example, I have 4.5 GB of email. I pretty much save everything and use search to retrieve emails. I don’t organize very much except in high level buckets like Company name etc. I had to move from Microsoft’s Desktop Search, which is integrated into Vista, to X1 because the indexing was severely slowing down my laptop. A 5400RPM hard drive that is constantly being accessed is death to a power user like myself. X1 though seems to handle things VERY well and integrates into Outlook with the use of an integrated tool bar. (FYI, go get X1 if you haven’t tried it yet)
I recommend Desktop Search to everyone because it allows you to stop focusing on “where to place this email” to “what was the content of the email about”. Searching for partial phrases, parts of attachments etc, that your mind remembered from months ago will find the email thread in less than a second. An amazing time saver.
Why is this important? It got me thinking that Desktop Search is a great example of the move to content from rigid structure. Google is the leader with their “we want to index everything” approach to business and you can see how it is paying off financially but introducing many security related concerns. Security is going to move into this content focused world as well. The next few years we will see more application “vulnerabilities” that are exploited by social engineering the user (which is a content change right) such as malware and phishing do than bypassing of a program’s structure such as a buffer overflow. The ability of an application to contain Malicious content will become the vulnerability.
Malicious content, sadly, is much harder to detect than a structure violation. Structural violation can be compared against a baseline or standard where anomalies are easily seen. Malicious content, however, is all about intent - something that humans have had a hard time analyzing for thousands of years. You may think some content is malicious and others may not so who gives the deciding vote?
The Indexing and Searching of Content is changing the world and you should start recognizing the high risks of the content within your applications, databases, and file servers.
