NSFocus Tracks Down Bugs for Global Computer Giants
South China Morning Post
2004-11-09

The Mainland Firm Identifies Security Holes for Hardware and Software Leaders to Fix

On its regular security bulletins, Microsoft typically acknowledges individuals or organisations that confidentially report bugs in its programmes, work with it to develop software patches, and help the company disseminate that information once the threat has been eliminated.

These parties are singled out, according to Microsoft, because they minimise the threat to customers everywhere by ensuring the company can fix the problem before malicious users even know a weakness in its software exists.

For a group of 12 Tsinghua University engineering graduates, it was the kind of pat on the back for a job well done that helped launch their careers as they set up the mainland's first specialist network security company - NSFocus.

In November 2000, Microsoft thanked the NSFocus team for identifying and reporting a security hole in its software that would have enabled a malicious user to take over a web server computer and run operating system commands on it without the knowledge of its owner.

NSFocus co-founder and president Shen Jiye said that marked the first time a Chinese technology group led in identifying a security threat in a major software program.

"We proved our technology leadership," he said.

Since then, NSFocus has discovered and notified Microsoft, Hewlett-Packard, Sun Microsystems and Cisco Systems of 28 weaknesses and security loopholes in their systems.

The Beijing-based company, with a workforce of about 180 and booked revenues of US$2.1 million in the first half of this year, maintains "the largest Chinese security vulnerabilities database" with more than 6,800 entries.

The firm is focused on supplying security appliances and services, with subsidiaries in Guangzhou and Shanghai, and branch offices in 10 other major cities in the mainland.

Mr Shen said the company needed fresh funds to expand its operations to the United States and Japan, make strategic corporate acquisitions, develop a new business line, and bolster its research and development capabilities in the mainland.

He estimated that about US$15 million in new financing would be required to realise those goals.

Its investors include Investor Growth Capital Asia, a subsidiary of Sweden's Investor AB, and Legend Capital, a fund sponsored by the Legend Holdings. NSFocus received seed capital worth two million yuan in 2000.

The ownership breakdown is Investor Growth Capital Asia, 35 per cent; Legend Capital, 32 per cent; the 12 founders, 24 per cent; and an option pool worth about 9 per cent, of which 3.7 per cent belongs to the founders.

"NSFocus presents one of the most attractive opportunities in the China network security market," Mr Shen said.

Citing figures from International Data Corp (IDC), he said the mainland's network security market was growing at more than 50 per cent a year and was forecast to exceed US$1.2 billion by 2006.

NSFocus products have been installed in some of the mainland's largest blue-chip organisations, including state-owned banks, telecommunications service providers, web companies and government ministries.

Banks and other financial services institutions are among the most intensive users of network security products in the mainland.

NSFocus also has a licence to sell to the People's Liberation Army and product certificates from the Ministry of Information Security and the Ministry of National Security.

Its network intrusion detection system leads a formidable suite of proprietary security appliances designed for mainland companies. It also works with most operating systems - including Windows, Unix and Linux - and other networking equipment.

Mr Shen said this system's "Eye of Ice" feature could detect more than a thousand methods of network attack, which similar boxes from foreign vendors could not detect.

NSFocus carries out product upgrades every six months and version enhancements every 18 months. "We also provide professional services that cover the complete security management life cycle for an organisation. As a pioneer in the network security market in China, NSFocus enjoys a significant advantage in this market," Mr Shen said.

These services include security outsourcing, centralised monitoring, emergency response and network security training. The company had about 20 service customers as of July this year.

IDC said the security services market in the Asia-Pacific region had received much attention because of enterprises' increased perception of escalating threats to their network.

IDC associate market analyst Jessie Yu said: "Asian enterprises need to focus on tackling ever-increasing threats from inside and outside their corporate networks, even after putting a solid IT infrastructure in place."

Though it was tempting, NSFocus management was not interested in selling the company lock, stock and barrel, even for the theoretical "right price", Mr Shen said.

"The company is not yet developed. We still have plenty of things we want to accomplish," he said.

Client list

Financial institutions

• The People's Bank of China
• China Construction Bank
• Agricultural Bank of China
• Chinastock.com.cn

• China Mobile
• China Telecom
• China Netcom
• China Unicom

• Ministry of Civil Affairs
• Beijing municipal tax department

• Tom Online
• Tencent
• Chinadotcom
• People.com.cn