• silicon.com
• Technology
• Security

By Jon Bernstein, 15 June 2000 00:30

COMMENT Talk of security inevitably conjures up the twin emotions of fear and cynicism. Fear fuels the purchase of devices from the burglar alarm for your home to the corporate firewall. Cynicism creeps up when the umpteenth salesman insists you simply cannot do without the latest piece of software or hardware to protect users from a devilish, but as yet unidentified, foe. The latter might help explain why, according to the latest report from Frost & Sullivan, "a whole raft" of IT administrators don't consider extra investment in Internet security products as justified. Frost & Sullivan claims this ambivalence rests with the complexity of the products on offer. Explain what they do and you solve the problem. But that ignores the human condition - a nagging feeling that every third security vendor is trying his or her luck. In an age where IT is increasingly being used to drive the business forward - and improve profit margins - the prospect of putting more and more money into that black hole called security is less and less attractive. People will pay for a firewall but is there really a market for separate intrusion detection devices? And do you really need a vulnerability detection tool when the extent and type of security threat is likely to change on a daily basis? Even in established parts of the security market - notably anti-virus software - the justification is not always simple. By definition, any vendor in this arena is always playing catch-up with the virus writers. They are judged not on their ability to second guess next week's virus, but on how quickly they can stem the tide. Paradoxically, the virus industry does its best work when it fails to work - nothing sells anti-virus software like a virus. That's why the Love Bug was a dream for Network Associates et al. As with other parts of the security equation, when things are working there is nothing to see, no tangible results. It's only when things go wrong that people see a need to invest in security.