Peter Tippett

Background

Peter Tippett trained as a physician and biochemist before moving into computer security, and he continued to hold medical qualifications throughout his technology career. That dual background shaped the way he framed the malware problem in public: he consistently described computer viruses in epidemiological terms, arguing about prevalence, rates of spread and the cost of infection rather than about individual virus specimens.

FoundationWare and the first products

By the late 1980s Tippett was president of FoundationWare Inc., a software house based in Cleveland, Ohio. The company sold a commercial PC anti-virus product called Vaccine, which was listed at $189 in Ralph Roberts' 1988 survey COMPUTE!'s Computer Viruses — a book that had to distinguish it explicitly from a similarly named product from World Wide Data and from several public-domain programs of the same name. FoundationWare's approach was less about scanning for known virus signatures than about controlling and verifying what ran on a machine: file-integrity checking, execution control that blocked unapproved programs from loading into memory, and recovery of the partition table, boot record and file allocation table after damage.

In 1990 the company drew wider attention with a report by Tippett titled The Kinetic Replication Of Computer Viruses, which predicted that viruses would affect millions of personal computers and reach what it called epidemic proportions within a few years. Virus Bulletin devoted its May 1990 editorial to the report, noting both that FoundationWare had a commercial interest in the conclusion and that early evidence suggested the forecast might prove broadly correct. In the same editorial the magazine recorded that FoundationWare's flagship package, Certus, had been designed by Tippett in association with Mark Hosmer; Virus Bulletin reviewed the Certus package the following month.

Certus International and the Symantec acquisition

FoundationWare was reorganised as Certus International, taking its name from the product, and became one of the recognised anti-virus vendors of the period, participating in the National Computer Security Association's Anti-Virus Product Developers group alongside Symantec, McAfee Associates, Central Point Software, XTree and Fifth Generation Systems. Its later scanner was called NOVI.

In early October 1992 Symantec announced that it had acquired Certus International. Virus Bulletin reported the deal in its November 1992 issue, quoting Symantec's Rod Turner as saying the Certus technology would assist in developing a more comprehensive anti-virus solution and marked the company's entry into the systems security market. The absorption was consequential: Norton AntiVirus 3.0, reviewed by Virus Bulletin in November 1993, was described as the offspring of the Certus NOVI acquisition, and a 1994 profile recorded that NOVI's file-watch component became the product's "virus sensor" while the heart of its scanning engine was an enhancement of NOVI's "warp drive". Tippett moved to Symantec with the acquisition and was listed on Virus Bulletin's editorial advisory board under the Symantec affiliation into early 1995.

NCSA, ICSA and the security industry

In March 1995 the National Computer Security Association announced Tippett's appointment as its president and executive director. Under his leadership the NCSA expanded from anti-virus certification into broader product testing and industry coordination; in September 1995 it organised a Firewall Product Developers' Consortium intended, in Tippett's words, to bring together firewall vendors, the customers who bought the products and independent security experts. He also became a frequent conference speaker on the economics of malware, presenting NCSA virus-prevalence studies and cost models that argued anti-virus software was strongly cost-effective but was often deployed or maintained incorrectly.

The NCSA became ICSA and then ICSA.net, where Tippett served as chief scientist. In that role he was one of the most quoted analysts of the May 2000 ILOVEYOU outbreak; Time described him as chief scientist at ICSA.net and reported his assessment that the Love Bug was the biggest virus outbreak in history by at least threefold. The company was subsequently renamed TruSecure, merged with BeTrusted in November 2004 to form Cybertrust, and was acquired by Verizon Business in 2007. Tippett held senior executive positions across that lineage.

Later work

After the Verizon acquisition Tippett remained with the company, working on technology innovation and on health-care information technology, where his medical training was directly relevant. He later founded careMESH, a health-care communications company, where he is listed as founder and chief executive. Over the course of his career he also served on advisory bodies concerned with computer ethics and information technology policy.

Assessment

Tippett's technical legacy sits mostly inside other companies' products: the integrity-checking and execution-control ideas built at FoundationWare and Certus International were absorbed into Norton AntiVirus after 1992 and shipped to a mass market under a different name. His more durable contribution may be argumentative rather than technical. By insisting that malware be measured — how many machines are infected, how fast it spreads, what an outbreak costs — he helped push the security industry towards prevalence surveys, product certification and evidence-based risk arguments, an approach that later became standard practice in enterprise security reporting.

Timeline

• 1988Vaccine, a commercial PC anti-virus product from Tippett's Cleveland-based company FoundationWare, is listed among available anti-virus packages in Ralph Roberts' book COMPUTE!'s Computer Viruses.
• 1990-05Virus Bulletin devotes its editorial to The Kinetic Replication Of Computer Viruses, a report by FoundationWare president Dr. Peter Tippett predicting a global virus epidemic, and notes that FoundationWare's Certus package was designed by Tippett with Mark Hosmer.
• 1990-06Virus Bulletin publishes a product review of FoundationWare's Certus package, then priced at $189.
• 1992-10Symantec announces it has acquired Certus International, the Ohio software house developing the NOVI anti-virus system.
• 1993-11Virus Bulletin reviews Norton AntiVirus 3.0, describing it as the product of Symantec's acquisition of Certus NOVI.
• 1995-03The National Computer Security Association announces the appointment of Tippett, formerly of Symantec, as its president and executive director.
• 1995-09The NCSA under Tippett organises a Firewall Product Developers' Consortium bringing together firewall vendors, buyers and security experts.
• 1998-06Tippett, by then associated with ICSA, opens the IVPC'98 conference with a talk on the cost of computer viruses and the epidemiology of malicious software.
• 2000-05As chief scientist of ICSA.net, Tippett is widely quoted on the ILOVEYOU (Love Bug) outbreak, calling it the biggest virus outbreak in history by at least threefold.
• 2004-11TruSecure, the successor to ICSA.net, merges with BeTrusted; the combined company is incorporated in Virginia as Cybertrust.
• 2007Verizon Business acquires Cybertrust; Tippett continues in senior roles at Verizon.