In this week's NetworkWorld column, I go through some of the thinking behind IBM's acquisition of ISS. Of course for loyal readers none of this will be new. But if you are interested in how many Gulfstream V's or Bentley Continental GT's you could buy with $1.3 Billion dollars - read on.

http://www.networkworld.com/columnists/2006/091106rothman.html

As an analyst, talking to vendors goes with the territory. They are trying to pitch me on why they are great, and I'm always looking for additional data points to keep me in touch with the market and validate the information I'm getting from the end user side.

Most of these discussions are interesting, some even enjoyable. But then there are the ones where I want to slit my wrists halfway through and wish I had become more adept at gracefully bowing out and moving on to my next thing. I had one of those meetings this morning, and it made me think about 5 things that vendors do that consistently piss me off. This joker made every single one of these mistakes.

1. Be enamored with your technology - This guy today was in the authentication business. And he proceeded to launch into why his technology was great before telling me why customers care about what they do. Before you tell me about bells and whistles, you are better off making sure I understand that there is a need and that I agree with that.
   
   
2. Show me a meaningless demo - Once I couldn't get my arms around why his technology was different, he figured he'd launch the demo. Bad move. Besides the fact that the demo was crappy, I still didn't understand his differentiation. Any demo should map both the user and administrator experience. Show differentiation, make it clear how the stuff works and how it is integrated into a customer's environment.
   
   
3. Name dropping - There is a high likelihood that I know more people than you do. So dropping names just annoys me. I don't care if a Fortune 10 bank stopped by your booth and is "very interested" in the technology. Half the time I don't even care about folks that have WRITTEN YOU A CHECK. And if you sell an enterprise product, don't make your customer references about podunk hospital of Topeka. I'm only interested in references after I get a feel for your value.
   
   
4. Talking at me, not with me - I've been doing this a long time. You probably aren't going to tell me much I haven't seen before. Leave the PPT at home unless you are unable to tell your story (and then you should be looking for another job, no?). I like to have conversations, not listen to 30 minutes of you showing me crappy, incoherent slides and waxing poetically about how great you are.
   
   
5. Not taking feedback well - I appreciate that a vendor takes time out of their day and talks to me. So I try to add a little value and provide some constructive feedback on positioning, pricing, messaging, etc. I've sat where you are sitting and I've pretty much screwed everything up twice. So maybe I can make a suggestion that will help. You may not agree with me and that's fine, but at least listen and be respectful. Let me make my points, you may even learn something. Ultimately, you may think I'm an idiot and disregard everything I say. I'm OK with that. But I will remember if you are rude about it.

Now those 5 things are pretty consistent. But what made my meeting this morning unique was the sheer lack of class this guy showed. At one point he questioned my integrity when I disagreed with him, basically asking if I was on retainer with one of his competitors. I'm not, though I do consider some folks with the competitor personal friends.

And then he had the gall to ask if what he was telling me was going to go straight back to the competitor. To be clear, an analyst with a big mouth that doesn't know how to keep a secret is not going to be in this business for very long. At this point, I said goodbye because there were too many potential weapons within grasping distance.

But that wasn't enough for this ass. He had given me a white paper early in the meeting. Then this guy storms up to me as I'm talking to someone else across the room and asks for it back. It's pretty rare that I am speechless, but this was one of those times. I was happy to give it back because it was going to be filed in the circular bin anyway. And any other response would have probably landed me in jail. But still, to interrupt another conversation I'm having to do something petty like that was the straw that broke the camel's back.

So the wonderful thing about having a blog is that I get to share these stories. And hopefully you can learn from my pain. Now I'm going to go enjoy my weekend since I've gotten this off my chest. I hope you do the same.

I'm here at the Security Standard conference and I'm seeing the pendulum starting to swing back. What pendulum? The pendulum that swings like a metronome between security as a defense and security as an enabler. It seems to swing back and forth every 4-5 years or so. Of course, this is a "business" oriented security conference, so Black Hat it ain't. But business folks are trying to figure out how to pitch security as an enabler, that much is clear.

I'm a bit disturbed as to this trend because we've all seen this movie before. So I'll make it very very clear. Security is not a business enabler. It is a cost of doing business. You cannot do new things because of security. You do open up new revenue streams and add value to customers via new applications that reflect new (or updated) business processes. It may be ill advised to put these new business processes on the web without adequate security, but you CAN do it.

I know. Once again, I get to play Mr. Wet Blanket. Or maybe I'm just playing off of semantics. But I think the nuance is important. The first presentation by Cathy Allen, the CEO of BITS (a Financial Services roundtable group) solidified things for me. Financial sector CEOs and CIOs want to believe that security will help them get new customers and open up new revenue streams. I don't think so.

I can tell you that organizations, especially financials will LOSE customers if they have continual publicized security problems. But is that defense or offense? I say defense. E*Trade was the first to start marketing security (remember the tokens?) and that has had arguably no impact. We've seen Bank of America and Wells Fargo make statements as well. Again, I'm skeptical that there's been any impact thus far.

What about other businesses? Is anyone trying to differentiate on being "more" secure? Retailers, no. Manufacturers, no. Utilities, no. Now that I'm thinking about it, is there anyone? That doesn't mean it isn't happening, but it's not making an impact yet.

Maybe I'm just over-reacting. Or the scar tissue that I have from trying to sell PKI as an enabling technology in the late 90's is aching. Whatever it is, I am very respectful of history. And history says that when money gets tight, these "enabling" initiatives get tossed over the side.

But defense persists - which is why security became all about defense during the tech nuclear winter (2001-2003) and during the AV renaissance that drove the security business from 2003-2005. And I don't think that this time is any different - but tell me why I'm wrong. That's what comments are for.

A while back I published my OPML reading list (here), so you could get a slight glimpse of what I'm reading. Unfortuately that service is static and I'm too lazy to keep it up to date. But my friend Pito Salas, who does BlogBridge (my RSS reader) has graciously published my dynamic reading list as a BlogBridge expert guide. I'm not sure I'm the expert of anything, but nonetheless...

Basically this is a list of the top security blogs that I read. BlogBridge has this cool rating system where I use 1-5 stars to rate each blog. Then it is organized accordingly when new material comes in, which makes getting through my news much easier. I track close to 100 security blogs now, but only about 30 rate 3 or more stars.

So check it out those 30 here. The OMPL link is here.

If you happen to use BlogBridge, this is really cool. You can add my reading list as new guide. Go to Guides-Add Guide. Then click the "reading list" tab and hit the plus button (on the bottom left) and add the OPML link: http://www.blogbridge.com/directory/folder/1592.opml. Then any time I update my reading list, yours will be updated automagically.

Thanks Pito. BlogBridge is great.

Technorati Tag: information security

In this month's SearchSMB column, I provide a primer on endpoint security and why it's important. I also include 5 tips to ensure the security of your endpoint. Attacking the endpoints is the vector de jour and for obvious reasons. The one's with the controls (basically you and your users) have that little issue of human nature that forces them to click on stuff, even when they know they shouldn't. So here are some ideas on how to take that vector out of play. Of course, nothing is foolproof, but it's a start.

http://searchsmb.techtarget.com/tip/0,289483,sid44_gci1213598,00.html

PS: Also keep in mind this is for SearchSMB, which means mid-sized businesses. Some of the stuff I discuss in this specific column are better suited to this segment (100-1000 users). So you enterprise folks can put your guns back in the holster.