Does Security Need Independence?
Listen to the column "Does Security Need Independence?", or visit our Podcast Center to hear more by James Gaskin.
IBM's deal to purchase Internet Security Systems brings some real conflict of interest questions to mind. Essentially, can you trust a security company that can't control its own destiny?
ISS went from being a pretty big company to a small division within IBM (or will, when the sale is completed). Worse, IBM built many of the systems, networks, and applications that ISS normally gets bought to protect. Can you trust the IBM executive mob to let ISS function independently enough to continue to address all security issues, including those with IBM products?
Two trends could emerge for ISS over the next year. First, IBM executives could force ISS developers to focus more on IBM products than other products. They may not even have to force the issue, they could just flood the ISS development team with so much IBM inside information the developers would have less time to work on other vendor products. If coverage of non-IBM vendors slips, customers would gravitate away from ISS as a complete security solution.
Second, perception could work the other direction, and customers with IBM hardware and software could develop unrealistic expectations of ISS protections for their environment. Since IBM owns them, customers could reasonably expect ISS would have the inside track on all new and forthcoming IBM security needs. So when they suffer even a minor security incident, customers could be more mad at ISS than if the company was still independent.
Neither prospect looks good for the ISS executives trying to work within the IBM family. Speaking of family, I wonder how the Tivoli executives and developers feel about their new corporate sibling? I hope they're polite and refrain from any infighting, but no siblings can behave properly all the time.
Security isn't a technology that easily survives in an environment where non-technical executives like to "tweak" products. Can the ISS developers withstand the "help" of three or four new layers of executive management? This isn't a technology where "gut feelings" and an MBA degree bring value.
Bottom line: do you believe a huge company can nurture high-end security development? I'm not sure I do. I don't remember many improvements in PIX products after Cisco gobbled them up. I hope ISS fares better.
ITworld.com
Symantec Backup Exec 12 and Backup Exec System Recovery 8 deliver industry leading Windows data protection and system recovery. Download this whitepaper to find out the top reasons to upgrade and how to get continuous data protection and complete system recovery.
Data and system loss — from a hard drive failure, malicious attack, natural disaster, or simple human error — can happen anytime. Don’t leave your business vulnerable. Make sure you have a secure recovery strategy in place. Symantec's latest backup and system recovery technology can efficiently restore critical applications, individual emails and documents and even restore your entire system in minutes in the event of a loss.
Businesses face a growing challenge to ensure that the IT environment is properly protected. Backup Exec 12 integrates with other applications in the Symantec family of products, to complement your current data protection strategy, keep your data securely backed up and make it recoverable when you need it most.
Enterprise 2.0 Implementation
By Aaron C. Newman, Jeremy Thomas
Published by McGraw-Hill
Learn more!
Deploying Cisco Wide Area Application Services
By Zach Seils, Joel Christner
Published by Cisco Press
Learn more!
