William Jackson | At last, a move to put the 'I' in IT security
Connecting state and local government leaders
RSA president Art Coviello said something interesting in his keynote address to the annual RSA conference and trade show: Security must be linked to business strategy if it is to work, he said, and that is going to mean big changes in the IT security industry.
RSA president Art Coviello said something interesting in his keynote address to the annual RSA conference and tradeshow last month in San Francisco. Security must be linked to business strategy if it is to work, he said, and that is going to mean big changes in the IT security industry.'The value of security as a standalone solution is decreasing,' he said. 'This transformation will bring an end to the standalone security industry in two or three years.'There probably is more than a little hyperbole in that statement, which was undoubtedly colored by the fact that RSA recently has gone from being a standalone company to the security division of EMC Corp. But the telling fact is that it drew no expressions of dissent, or even surprise, from his audience of 4,000 IT security professionals.For the first time that I can recall, just about everyone at the conference'industry, analysts and pundits'seemed to be on the same page. Security is a means to an end. Whether they focus on privacy or data protection, all agreed that we need to adequately protect the information that resides on our systems, rather than focus on the systems themselves.Until now, the attention of the security industry has focused on the 'T' in IT. 'We haven't focused on information security at all,' Coviello said.Traditional standalone tools that reside at the perimeter to protect networks have matured. Signature, content and policy-based filtering to block unwanted traffic and to keep bad guys out are not perfect, but incremental improvements will not fill the remaining security gaps.The perimeter is disappearing. The distinction between what is inside and outside the enterprise, what is trusted and what is not trusted, is becoming more blurred every month.So now industry is shifting its attention to the 'I' in IT.After all, the information, not the technology, is where the real value and the real threats are. Moving security forward to support mission-critical activities means incorporating security into IT products. Customers now want to see security built into the products and services they buy, rather than shop for security separately.This is not a new concept. When SANS Institute research director Alan Paller spoke, he repeated a message he's been delivering for years: Make software secure by default; don't put the onus on users to secure the software after they buy and install it. The difference is that this year, the industry seems to agree with him.Microsoft chairman Bill Gates and research chief Craig Mundie at the RSA conference described visions of a new security model in which software is designed to support security, identity and access management. Mirroring the knee-jerk reaction in physical security, perimeter security designed to keep evil-doers out took precedence in IT after the Sept. 11, 2001, attacks, Mundie said.But with the rapid growth in the number and kinds of networked mobile devices in the last six years, much of today's IT infrastructure no longer operates in an administered environment. So now we must focus on making the software that handles information more reliable.Microsoft's new Vista operating system and Office 2007 are the first major products to be released that have been developed under the company's trustworthy-computing initiative that aims to provide this reliability. Just how good a job they have done will become more apparent over the coming months and years, as hackers and analysts pound away at this software in search of flaws. But an industry consensus on the importance of reliable software with robust, easily managed security and identity controls should go a long way to advance these goals.The shift does not mean that existing security tools are going to go away anytime soon. Few if any vendors advocate getting rid of traditional firewalls, antivirus, IDS/IPS or other gate-keeping tools. But we already are seeing them becoming features in other products rather than standalone products.
William Jackson
NEXT STORY: Wyatt Kash | The security conflict