When legendary former Gartner analyst, Vic Wheatman, and I discussed our latest webinar, we tackled the issue of creating and measuring value.
After the webinar ended, my wheels kept turning as I considered some research I’d completed recently. For one thing, I learned that CEOs think security executives are excellent security managers — but downright rotten business-people.
Specifically, CEOs complain that security executives still have the mentality of “keeping bad things from happening” rather than the more business-minded approach of “adding value to the business.”
Here’s the trap. Solving a security problem under budget is not a matter of “finding the best deal.” It is a matter of solving the problem most cost-effectively. Click here for the recorded webinar. And read more HERE.
If consumers weren’t skittish enough, Home Depot recently joined the rapidly lengthening list of big box retailers experiencing sometimes prolonged data breaches: Albertson’s, Dairy Queen, The UPS Store, Sally Beauty, Target, Michael’s, Neiman Marcus, P.F. Chang’s and SuperValu.
More than a few Chief Information Security Officers (CISO) must be nervous. In fact, it may be forcing corporations who do not have a CISO to rethink that strategy. Often the CISO position is folded in with or serves under the Chief Information Officer (CIO) or even, if the CIO reports to the Chief Financial Officer (CFO), as is the case in some organizations, two layers under the seat of power. So, the person charged with security risk management may not have the authority to get things done.
With the recent spate of high profile data breaches, translating the message up the chain or even the perception that the CISO’s job is not important enough to be a direct report may not cut it anymore. Shareholders and customers want answers.
Consumers also are flocking to convenient online sites, where they have few other choices than to use a credit or debit card.
Data breaches, whether prolonged or short lived, especially those that compromise customer information, are black eyes that eventually will force consumers to keep their credit and debit cards at home. Having the man or woman in charge of mitigating IT risk fairly far down the food chain doesn’t look good, no matter whose ear he or she may have.
I hope you can catch me this week (September 19-23). Either attend a webinar on secure uses of the Cloud, or grab my lapel as I walk the show floor at ASIS in Orlando.
Here’s info on the webinar. Wednesday, Sept 22, 1-hour Webinar titled “Xerox and Cisco: Partnering in the Cloud”. I’ll be speaking along with Bill McGee from Cisco, and RG Conlee from ACS, a Xerox Company. I’ll explore the true benefits of using the cloud, understanding and mitigating the risks of the cloud, and how to best prepare for using the cloud. I hope you can join me.
At ASIS – the largest physical security professional conference in Orlando – this week I will be speaking at several private company events, but you can still find me on the floor. I’ll be excited to tell you the developments of the first venture-funded convergence consultancy I’m now heading.
Secure the Business!
What a successful SecurityDreamer Chicago Event last week! Thirty men and women from a cross section of Chicago’s IT and physical security communities, end users and service providers, gathered for a fun evening of information sharing, new research, fine art, yummy wine and stimulating conversation.
The event was held at the exquisite David Weinberg Gallery in the art district of Chicago near downtown. David Weinberg was on hand to talk about his art. The photographs lining the walls of the the three room gallery were provocative and powerful. David said his art was inspired by his childhood and colored by his years owning a technology company that he sold some years ago.
We were able to afford a beautiful and unusual venue because of our visionary sponsors, BRS Labs and Inovonics. I’ve mentioned BRS Labs in the past. I have such appreciation as a technologist for innovative companies, and BRS Labs is one of them. The company re-thinks video analytics and approaches the challenge in an entirely new way. While the “video analytics 1.0″ vendors battle it out, BRS Labs quietly amazes it’s customers and confounds its competitors with a “2.0” solution. Thank you to BRS Labs for sponsoring SecurityDreamer Chicago.
Rethinking solutions was the theme of the event. I shared some research Hunt Business Intelligence recently completed on trends in critical infrastructure technology adoptions by the largest companies in the world. It turns out that non-security executives, like CEOs and CFOs, are steadily losing confidence in security executives.
Part of the reason for that loss of confidence is that security executives continue to think like security wonks and do a poor job running security like a regular business unit. A security professional should be able to analyze, measure and create value, and not merely avoid risks.
Inovonics helps its customers create value. Its line of wireless life safety technologies, led by its flagship RADIUS product, leverages existing network infrastructures to provide superior service. Imagine integrating a wide variety of sensors, including people-location, around your facility built around a single architecture of standard wireless networking. It is life safety information management at its finest. Thank you to Inovonics for sponsoring SecurityDreamer Chicago.
We are now planning SecurityDreamer New York, SecurityDreamer Houston and SecurityDreamer Orlando (at ASIS). Drop me a note and tell me a bit about yourself if you want one of the limited invitations.
Dan Dunkel wrote a fun article in the February issue of SDM magazine. He proposed that PSIM (physical security information management) be replaced with VSIM (virtual security information management). I assume he’s joking.
Actually, if you read the article assuming he had his tongue firmly planted in his cheek, it’s a fun ride. He brings in virtualization, the IT concept of using software to emulate hardware like servers and storage devices. He also refers to the word “virtual” in the gaming sense, of creating a virtual reality environment.
Dan does a good job of making fun of computer speak in the article. His articles in SDM are always entertaining. The only thing I didn’t like about this article was the nagging feeling that he may have been serious!
PSIM as a concept emerged because end user managers of security environments cried out for a way of better managing security information. They wanted to be able to do with security data what every other business unit does with the data from their respective business units – that is, to make intelligent business decisions.
If Dan is serious that the physical security industry no longer thinks in terms of being physical, then PSIM could be easily shortened to SIM – a moniker used for a decade or more in the IT Security industry.
I attend physical and homeland security conferences frequently and I can tell you in no uncertain terms that these industries dwell almost entirely in the physical nature of security.
If Dan is simply being an apologist (evangelist?) for “the cloud” as so many bandwagon jumpers (especially software manufacturers) do these days, then I’ll make a suggestion.
The cloud is an amorphous (by definition!) concept to describe techniques of managing data. Managing data is exactly what the security executives who gave birth to PSIM wanted all along. So I suggest that if you really want to get to the heart of PSIM, and to the heart of efficient, effective security management, forget about PSIM – and certainly jettison VSIM – and let’s all talk about just the “IM.” Information management and business intelligence is what it is all about.
If you get that, you got it.
There is a problem with honesty in this security industry of ours. Far more of a problem in the physical/homeland security indsutry than IT/cyber security. the difference? Critics.
The IT/cyber security industry has dozens of knowledgeable, influential industry analysts constantly pushing end users, VARs and manufacturers, (vendors) to higher levels of performance, quality and customer service.
The physical security had none before I showed up on the scene when I directed my research team at Giga Information Group (later Forrester) to begin tracking trends in physical security in 2000. I kept thinking I would spark industry improvement in physical security and homeland security by inspiring dozens of industry analysts to cover the huge industry. Instead, vendors reacted with their panties in a bunch and most consultants I spoke to were chicken-shits, with not enough balls to tell Lenel or SoftwareHouse or Bosch when they smelled snake oil, or when product development aimed low.
So in 2005, I left my job as head of security research at Forrester and opened the first industry analyst firm in physical security – thinking for sure that THAT would start the trend.
I was partly right. A few “analysts” popped up afterwards. Forrester and Gartner dabbled in physical security half-heartedly for a few months after I left. Frost & Sullivan later beefed up their particular brand of analysis combned with their trademark (and dubious) “awards.” More on that another time. INS also started making noise.
Finally, some “serious” critics emerged. Jeff Kessler, the long-time Lehman analyst, brought intellectual rigor to financial critique of the entire industry and specific niches. And John Honovich carved a niche for himself becoming the preeminent critic of IP video solutions.
I am very grateful for John and Jeff. They largely validated my belief that the physical security industry had room for and could benefit from piercing, honest criticism. But I’m sad that there are only three of us. John critiques vendors in the IP video arena on his website, Jeff now works for Imperial Capital and focuses is on numbers, and I focus on best practices for end users. Three different niches, but it’s just crazy that a $170 bn industry supports only three guys doing real industry analysis.
I’ve criticized Frost & Sullivan and INS elsewhere, not to belabor the point here. The shortcomings of their analysis in this industry are obvious to any observer and I don’t need to harp on them. In a nutshell, I’m disappointed when any analyst relies on the word (or dollars) of manufacturers. It is an obvious conflict of interest, and the so-called analyst quickly becomes a shill for vendors, whether they intend to or not. (Hint: they usually intend to.)
If an analyst performs paid work for a vendor, it should be with the sole purpose of helping that vendor improve its products or solve specific customer problems. It should also be done privately.
For example, I’ll allow vendors to pay me to critique and plan their product development road map or marketing strategy – but I don’t write publically available white papers and will never publicly trade whatever I’ve discussed with vendor clients privately. I share my end user research findings with my end user- and investor-customers only.
Analysis should be derived from the analyst’s professional experience with the subject he is analyzing, or by analyzing the experiences of end users. I believe John touches or in some way directly interacts with with every product he writes about, and then bases what he writes on his highly technical knowledge. Jeff is similar. He performs primary research, writes his own analysis of his research based on his extensive knowledge and experience with financial and market analysis, and critiques secondary research. I talk to hundreds of end users each year and systematically analyze best practices (and worst practices) among the users of just about every kind of security technology.
I still think there is plenty of room for honest critique in the physical security industry. If only someone else with the guts would step up.
In honor of being at the RSA Conference in San Francisco this week, I figured I should at least post one IT security blog. Here is an excerpt from the “ship’s log” of my mentor Captain Phil Rosch:
I think the Security industry needs to be more proactive in terms of policing itself. I’ve spent way too much time over the past 6 months fixing machines for friends who got sucked in.
Fixing Charlie’s virus ridden computer wasn’t too hard. I found a detailed set of instructions on the Internet that fit his problem exactly so I just followed the yellow brick road. It’s easy to see how an error screen like the one crafted for the AVG 2011 could suck someone in. http://deletemalware.blogspot.com/2011/01/how-to-remove-fake-avg-antivirus-2011.html
After I blew off the virus, I downloaded Spybot Search & Destroy and Microsoft Security Essentials (both free). The Microsoft scan caught 2 Trojans and the S&D cleaned up all the spyware. The last job in the “tune-up” was to run SpinRite 6 to clean up the physical hard drive.
I really feel sorry for seniors who get sucked in by viruses and crap like you see on TV. Allen Harkleroad, a consumer advocate said “I am 100% skeptical of any advertisement that claims to be able to fix a computer online, and from the consumer complaints I have read online, in the case of DoubleMySpeed and MyCleanPC, it appears that my misgivings were completely warranted.” Allen built himself a new Windows 7 machine with nothing on it and ran all current maintenance.
Next he ran MycleanPC and it produced over 1,000 errors and took him to a page that demanded $89 for the product and wouldn’t let him lose the page.
Check out “DoubleMySpeed complaints” on Google, also MyCleanPC complaints and the CyberDefender Corporation complaints. It seems now CyberDefender is trying to hide who owns the domains they operate, however IP address/DNS lookups don’t lie. CyberDefender responded by sending a legal threat letter, claiming defamation, and demanding the removal of the original posts.