Hundreds of vendors attempting to solve one small piece of the security puzzle makes it difficult for security professionals. Are they offering products or features?
Once a day I receive an email from a vendor that has refreshed a product line or launched a new security offering. Like clockwork, they infiltrate my inbox with pitches that are eerily similar: Help security professionals protect their assets and meet the myriad of regulations.
If it isn't enough to keep track of the 700-plus existing vendors, I have met with startups funded by venture capitalists and angel investors claiming to solve some of the newest conundrums in the security space today: securing mobile devices, protecting Web applications, managing insider threats.
The revolving door of vendors makes it difficult to see the complete landscape of security products, and how products in a particular category fit together.
I have to say in all my years covering technology I have never seen so many categories of products sliced into such narrow segments: So much so that segments actually represent what other technology markets would view as feature sets rather than full-fledged products.
As a result, the responsibility of security professionals is daunting. Tight budgets, new threats and hundreds of vendors addressing just one or two pieces of the problem have got to be an ongoing struggle.
And while vendor consolidation is taking hold, the integration of technologies
Requires Free Membership to View
SearchSecurity.com members gain immediate and unlimited access to breaking industry news, virus alerts, new hacker threats, highly focused security newsletters, and more -- all at no cost. Join me on SearchSecurity.com today!
Michael S. Mimoso, Editorial Director
into suites is only beginning to happen. What's more, typically these acquisitions and integrations take 12 to 18 months.
Even what are generally considered more mature products in the security sector are kludgy at best and utterly confusing at worst. As seen with our comparative review on SSL VPNs, "Not So Simple", these products require a great deal of administration, configuration and support. As David Strom and a team from Stanford University report, there are so many features and configurations to activate that it is easy to make a mistake or destroy other configurations with a click of a mouse. Furthermore, each of the five vendors reviewed had difficulty in supporting the most basic VPN activity of mounting a Windows file server, connecting to shared drives and opening and copying files to the network share.
Complexities and difficulties also arise when it comes to implementing encryption. While there has been pressure to use encryption because of privacy regulations, in many cases it blinds network-based IDSes, IPSes, sniffer tools and network analyzers. In our story "Obstructed View", we'll explain how to have the best of both worlds.
Meanwhile, constrained budgets may have many of you looking for open-source tools to cobble together a security platform for your organization. If this is the case, go to "Brick By Brick," where we explain how you can build an application firewall with open-source components.
Security remains fertile ground for startups and new technology; it's unlike any other IT market. Is that likely to change? Not with the fluid threat and regulatory environment security managers live in. Until then, endless vendor pitches and feature sets passed off as full-fledged products unfortunately will remain the status quo.
This was first published in September 2006