http://www.wired.com/politics/security/news/2008/04/securitymatters_0417
By Bruce Schneier
Security Matters
Wired.com
04.17.08
Last week was the RSA Conference, easily the largest information
security conference in the world. More than 17,000 people descended on
San Francisco's Moscone Center to hear some of the more than 250 talks,
attend I-didn't-try-to-count parties, and try to evade over 350
exhibitors vying to sell them stuff.
Talk to the exhibitors, though, and the most common complaint is that
the attendees aren't buying.
It's not the quality of the wares. The show floor is filled with new
security products, new technologies, and new ideas. Many of these are
products that will make the attendees' companies more secure in all
sorts of different ways. The problem is that most of the people
attending the RSA Conference can't understand what the products do or
why they should buy them. So they don't.
I spoke with one person whose trip was paid for by a smallish security
firm. He was one of the company's first customers, and the company was
proud to parade him in front of the press. I asked him whether he walked
through the show floor, looking at the company's competitors to see if
there was any benefit to switching.
"I can't figure out what any of those companies do," he replied.
I believe him. The booths are filled with broad product claims,
meaningless security platitudes and unintelligible marketing literature.
You could walk into a booth, listen to a five-minute sales pitch by a
marketing type, and still not know what the company does. Even seasoned
security professionals are confused.
Commerce requires a meeting of the minds between buyer and seller, and
it's just not happening. The sellers can't explain what they're selling
to the buyers, and the buyers don't buy because they don't understand
what the sellers are selling. There's a mismatch between the two;
they're so far apart that they're barely speaking the same language.
This is a bad thing in the near term -- some good companies will go
bankrupt and some good security technologies won't get deployed -- but
it's a good thing in the long run. It demonstrates that the computer
industry is maturing: IT is getting complicated and subtle, and users
are starting to treat it like infrastructure.
For a while now I have predicted the death of the security industry. Not
the death of information security as a vital requirement, of course, but
the death of the end-user security industry that gathers at the RSA
Conference. When something becomes infrastructure -- power, water,
cleaning service, tax preparation -- customers care less about details
and more about results. Technological innovations become something the
infrastructure providers pay attention to, and they package it for their
customers.
No one wants to buy security. They want to buy something truly useful --
database management systems, Web 2.0 collaboration tools, a company-wide
network -- and they want it to be secure. They don't want to have to
become IT security experts. They don't want to have to go to the RSA
Conference. This is the future of IT security.
You can see it in the large IT outsourcing contracts that companies are
signing -- not security outsourcing contracts, but more general IT
contracts that include security. You can see it in the current wave of
industry consolidation: not large security companies buying small
security companies, but non-security companies buying security
companies. And you can see it in the new popularity of software as a
service: Customers want solutions; who cares about the details?
Imagine if the inventor of antilock brakes -- or any automobile safety
or security feature -- had to sell them directly to the consumer. It
would be an uphill battle convincing the average driver that he needed
to buy them; maybe that technology would have succeeded and maybe it
wouldn't. But that's not what happens. Antilock brakes, airbags and that
annoying sensor that beeps when you're backing up too close to another
object are sold to automobile companies, and those companies bundle them
together into cars that are sold to consumers. This doesn't mean that
automobile safety isn't important, and often these new features are
touted by the car manufacturers.
The RSA Conference won't die, of course. Security is too important for
that. There will still be new technologies, new products and new
startups. But it will become inward-facing, slowly turning into an
industry conference. It'll be security companies selling to the
companies who sell to corporate and home users -- and will no longer be
a 17,000-person user conference.
---
Bruce Schneier is CTO of BT Counterpane and author of Beyond Fear:
Thinking Sensibly About Security in an Uncertain World. You can read
more of his writings on his website.
-==-
Let identityLoveSock take your personal information into
their wanting hands. http://www.identity-love-sock.com/
Because victims have money too.
Comments