Security Blog Log: Opinions abound on IBM/ISS deal

Like some of the analysts SearchSecurity.com spoke with, many bloggers expressed hope that both vendors' customers will benefit from the combination of IBM's vast resources and ISS's solid security offerings.

But some focused on what the deal says about the future of the security industry. Several suggested that independent security vendors face an uncertain future as enterprises clamor for security that's baked into the IT infrastructure produced by IBM and other companies like Cisco Systems Inc. and Microsoft. Given that climate, bloggers said, more independent vendors will likely get acquired by the industry's behemoths.

In his blog, TaoSecurity President and CEO Richard Bejtlich warned that the future isn't bright for companies that want to introduce network security products but remain independent.

"By 'network security' I mean products that interact with network traffic, for inspection or access control decisions … not products which work on the host level. When I say 'remain independent' I mean start as a small company and grow to become a billion-dollar-plus company," he wrote.

About Security Blog Log Senior News Writer Bill Brenner peruses security blogs each day to see what's got the information security community buzzing. In this column he lists the weekly highlights. If you'd like to comment on the column or bring new security blogs to his attention, contact him at [email protected]. Recent columns: Fear and loathing in MS06-040's wake Israeli-Hezbollah war spills into cyberspace Has CSI/FBI survey jumped the shark?

"The functions that ISS network security products provide … are going to end up in Cisco switches," Bejtlich added. "Those features are going to be available as upgrades to sufficiently powerful switches, leaving managers with the choice of running Cisco plus other boxes, or just Cisco. They will choose 'just Cisco.'"

Several bloggers made much of ISS's struggle to grow in recent years, describing the deal as more of a rescue effort.

"ISS was struggling and IBM threw them a billion-dollar lifeline," Mike Rothman, president and principal analyst of Security Incite wrote in his Daily Incite blog.

Rothman, who called the deal the worst kept secret in the security industry, expressed concern about what he thinks is a murky strategy for managing ISS.

"Given what seems to be a screwed up organisational plan (ISS will be a business unit in IBM Global Services), it's not clear what the future of ISS's products business is going to be," he wrote. "If I were a customer looking at ISS products, I'd be deferring any kind of decision until more details emerge."

Others expressed amusement over what IBM paid for ISS and chuckled over Big Blue's habit of buying companies with three-letter acronyms.

"I wonder if they have an affinity for companies with three initials (ISS, MRO) -- I guess I should abbreviate a bunch of my company's names to see if I can attract some attention," Brad Feld, managing director of Mobius Venture Capital, joked in his blog.

Feld, who also sits on the boards of several companies, including network security provider StillSecure, said that IBM has entered the security market "in a big way" with its acquisition of ISS and that he's surprised Big Blue was able to buy up another company so soon after announcing plans to acquire Webify Solutions, MRO Software and FileNet.

Greg Osuri, a technical architect with Miracle Software Systems and keeper of the SOA blog, wrote that IBM's cash machine is working "too quick and too fast" and suggested Big Blue was hasty in grabbing up a company that hasn't experienced what he'd consider stellar growth recently.

But he did see a bright side to the deal:

"This acquisition will bring about an excellent talent pool of IT security consultants, managed services and more importantly the X-Force security intelligence service," he wrote.

Whatever becomes of ISS and the security market in general, many agreed that IBM stands to gain a lot from the acquisition.

Ambersail Security said in its blog that while the massive IBM Global Services business remains strong, it clearly has to adapt to a changing market.

"This bold move into the security products and services marketplace is surely an indication of a broader strategy to bring on board new customers, and it will certainly make existing product and service vendors sit up and take notice," Ambersail said.