Information Security is an odd environment in that most of the leading edge research takes place away from academic and designated research institutions, out in the industry. As a result there is a curious approach to publishing new information that doesn't really exist anywhere else.

The InfoSec conference circuit is in full swing in the US at the moment, and with professionals and interested parties have to pick and choose the appropriate conferences to attend, some people have questioned the place of academic-focused conferences in an environment where most of the work seems to be done by the private individual or corporate body.

As the move to commercialise research continues ,and as companies reach out into more costly fields of research, more of these findings will go behind closed doors. When RSnake and Jeremiah Grossman, two noted online security experts, commercialised their skill sets, the volume of their open reporting shrank considerably. In addition, the value of the material decreased as well, as the commercial value of their skill sets precluded open discussion of material that was receiving commercial attention.

Unlike most industries, Information Security is a field where the leading edge knowledge base is in the industry and not in the tertiary or dedicated research institutions (not the same as the research groups that many companies operate). This has the odd effect that the academic conferences don't necessarily attract the best of what is happening with new research and findings.

With no academic peer review, rather only that of other industry participants, the value of new material at commercial conferences can be hard to determine. This is especially true for material that is shipped from conference to conference with little change (making it more PR than relevant new research).

An upside to this is that the peer review that does take place is almost instantaneous - there will be someone in the audience or who obtains the presentation who will immediately be able to test and evaluate the claims being put forward, something that Kaminsky's DNS vulnerability disclosure debacle shows well.

At least academics have the ability to fall back to ongoing peer review and technical criticism to help improve the quality and validity of their work. In the commercial Information Security world, disagreements over conclusions drawn from results can vary wildly and rapidly descend into messy flame wars.

Recently n.runs and McAfee engaged in such a slanging match over conclusions that n.runs had drawn which criticised antivirus vendor software security, something that McAfee took to heart.

Without a recognised arbiter or central panel to decide on an outcome, public arguments such as this are going to have to be an acceptable drawback to the otherwise positive unique research and disclosure environment that exists in Information Security.

Despite the egos present in Information Security, there is no tenure and you are only as good as your last exploit/disclosure.