Sun creates new security posts

Sun Microsystems has created two high-ranking computer security positions, naming one of its top researchers chief security officer and indicating that Sun, too, wants to elevate the importance of security.

Sun's new chief security officer is Whitfield "Whit" Diffie, a Sun employee since 1991 and co-inventor of the public-key cryptography technique used in Web browsers and numerous other software products. In addition, Joanne Masters has been named director of Sun's newly created Sun Global Security Program Office, the Santa Clara, Calif.-based server seller said Wednesday.

The announcement underscores the growing importance of computer security given a world with ever more devices connected to the Internet and ever more important information being stored on and transferred between those devices.

The announcement also indicates that Sun might be rethinking its earlier position that Microsoft's companywide security initiative deserves scorn. As recently as late March, at Sun's JavaOne conference, Sun Chief Executive Scott McNealy derided Microsoft's security when he said, "I didn't have to write a letter to all my employees and leak it to the press saying security was important."

In their new roles, Diffie and Masters will coordinate Sun security work in research, product and sales groups. They'll also work with customers to advocate Sun security products and services, and teach customers about security issues.

Diffie also will work on projects extending beyond Sun, trying to improve "the Internet's fragmented security environment" by working with security organizations, Sun said.

Diffie co-invented public-key cryptography, which encrypts and decrypts data through the combination of a publicly known "key"--which is actually a specific type of number--and a secret key. Previous encryption methods used only a secret key, which posed problems when that key had to be transmitted. Public-key cryptography also provides a way to ensure the identity of a person, since a message can be encrypted with a private key and then decrypted with the public key.