IANS Perspective

Nick Selby: Guardium Acquisition as Catalyst for DTM Roll-up

Assuming the stories of an IBM acquisition of Guardium are correct, the deal marks the official transition from "standalone product" to "standard feature" of database transaction monitoring. That is to say, DTM is actually an important feature of a much larger family of products and services. No longer should it be considered a standalone industry of its own.

Right now, DTM is, sadly and still, a fairly obscure space, populated by bleeding and leading edge companies unafraid to wade hip-deep into DBAs. So the question is, can IBM make this more understandable to the mainstream? That is what has to happen. People put information into a database because the data is important to their business. At this point, they worry about backing it up, but securing the database and hence the data while it's being used - which is even more relevant in the upcoming cloud thing - is less understood. Is IBM going to take on the effort of educating the marketplace? Or will it sell it as a platinum feature?

For customers, a buy-up within the DTM space should spell great news over the coming years in the form of increased quality, better-integrated server agents, and one-stop shopping - not to mention the rapidly increasing possibility to think of database vendors as being a bigger part of a safe solution when firms move to establish enterprise-wide data security (or anti-data-loss) programs. The question is when it moves from an "available feature" (like a backup vacuum pump for your 2009 Cirrus SR-22) to a "standard feature" (like seat-belts for your new Honda).

That Guardium would go to IBM is not at all surprising - IBM is well-poised to leverage the product and the services aspects of such a thing. That some have commented that Guardium executives sold the company for more than IBM wanted to pay is funny. (It's always more than IBM wanted to pay, no? But I would not be shocked if the real number turned out to be that IBM paid between four- and seven- times - or that Guardium revenues were as high as $50m for 2009; basically I think it did just about $37m this year.) I think Guardium is fully worth what IBM is said to have paid.

From what I can tell, Guardium has led the space in terms of sales and public relations. It has achieved this leadership by its concentration on partnerships with the likes of BMC and Dell; its concentration on the mainframe (mainly through a Z/OS agent Guardium had licensed from NEON Enterprise Software) as well as its ability to articulate, probably better than anyone, the value proposition for DTM. It also built a great database agent and showed that this could be integrated without freaking out either security or operations - in short, it worked, and customers love it.

One of the things that Aaron Turner has pointed out in our Information Protection track at IANS Forums for about two years has been the highly effective capabilities that Guardium brings to the table in terms of having someone capable of speaking with and explaining to database administrators the value of security: Guardium speaks DBA in a way that DBAs don't find threatening. In and of itself the ability to translate between business, security, and database administrator imperatives is a highly valuable skill set.

I talk about DTM (as does Rich Mogull) as part of a larger data security approach as opposed to a small independent market in and of itself. At Trident we counsel clients to use DTM as an arrow in the quiver of an overall data security approach. (By the way, I just saw that Securosis has Guardium at $45m, raising earlier estimates that more closely jibed with mine.)

What's left in the marketplace is interesting, and I see similarities between this and the rollup of the web application vulnerability assessment space a couple of years ago. This may well be the catalyst for a couple of quick acquisitions, mainly of Imperva, Application Security Inc, and Secerno. The religious differences between the products - specifically the outside-and-inside approach of Imperva's integrated Web Application Firewall/DTM product, and the babel-fish approach of Secerno - help several of the remaining players make solid acquisition stories. Bummer for AppSecInc, selected for the marketing project that was Enterprise To The Edge then getting passed over. Not sure what play it has here, nor how it remains relevant enough to become acquired meaningfully. Another player not catching on fire is Sentrigo, which has an interesting technical take that make some in the US intel community say things like, 'Dude, how do you spell '8200'?'.

I would not be surprised to see, as with the web application vulnerability assessment space, a longer-than-expected integration period as political battles within the acquiring companies overtake common sense and deal execution.

As with anyone selling a panacea, this is really just a piece of the very very much larger puzzle, and it directly threatens certain factions within any acquiring organization. For example, I would not like to be the guy in Oracle to tell the Oracle team that they'd just acquired Secerno to help with security of Oracle products. Merry Christmas indeed.

Nick Selby is IANS Faculty and managing director of Trident Risk Management, a security and risk consultancy.

Nick Selby: Metasploit Acquisition Shakes Up the Pen-test Landscape

With the acquisition of Metasploit (MS) by Rapid7 (R7), the dynamics within the small penetration testing market have changed. We believe that more competition will challenge each of the three main penetration testing software vendors in different ways, and that this new competitive landscape will quickly inure to the benefit of end users and buyers.

To radically simplify, the dynamics have been that Core Security sat at the top of the marketplace in terms of price, scale and enterprise usability; Immunity Security cleaned up at the lower end of the enterprise market and dominated for vendors and professional services types, who also used MS as a free tool.

Immunity has been working on its UI, workflow and backend, steadily but without any great urgency. As its main “competition,” Core, costs literally ten times more for a single seat, and there was no real alternate competition other than MS. Both Immunity and Core have partnerships with vulnerability assessment vendors, but I believe that R7 will be able to market successfully a converged product over time.

R7 has been aggressive in its product development and marketing, and as MS creator HD Moore is nothing if not hyperactive (MS got this far through his relentless late-night and weekend coding) and as MS has been advertising for developers and staff, we can infer that R7 is determined to rapidly integrate MS into its suite. There will of course be integration issues. Among the legions of open-source enthusiasts who are MS fans (the Metasploit 3.x tree, according to Moore, is now under a 3-clause BSD license; earlier, Moore had changed the license from open source to a EULA to prevent commercial exploitation by third parties), there will no doubt be “End is nigh” drama of the sort suffered by Sourcefire and Tenable and other products that have commercialized atop a community-supported project. I assume that both R7 and Moore are smart enough not to kill the golden goose and confident they will manage, ultimately, the community aspect of this.

If R7 and MS are able to clean up usability issues with the product it will be marketable. What then needs to happen is that R7 and Moore, in his new role as Chief Architect of MS, must create sustainable, repeatable workflow around the process of development, testing and quality control and rollout of exploits, and converting - this is no easy task - from the hair-on-fire but ultimately functioning process Moore has been using for these years. If I had to pick one major marketing and sales disadvantage MS has over both Core and Immunity, they are quality control and “safety” of the exploits (not to mention derivation of the exploits, another kettle of fish which must be addressed in the context of community relations). Core and Immunity are expert at these processes - and their attendant post-release support. MS is not and must become so while integrating and transitioning and managing these other issues related to any acquisition.

Assuming that R7 and MSF are able to integrate and address those issues, then the dynamics will change at both Core and Immunity. You'll note that this analysis is not comparing technical details - usability of then client side exploits or quality of the exploits from Core and Immunity which the industry agrees are first rate. At this point, what we have is a complex marketing calculation and discussion, not a technical bake-off.

Let's give some credit to R7 and say that it will make MS more user friendly, easy-to-install-and-use and that it will give it the correct help desk stuff to soothe enterprise buyers. At that point, it has an advantage over Immunity - which philosophically believes its UI is the most elegant to support the workflow and mindset of a penetration tester, but which it admits is less polished than the average enterprise-ready application. This plays right at and competitive with Core's chief selling proposition - ease of use and enterprise class polish and support. Core will begin to feel pricing pressure where it never has before  - I have often said that anyone who can afford Core should buy Canvas and probably already has MS. As R7 begins to pressure and erode Core's per-seat price, this calculus will change for Core.

Immunity, on the other hand, will likely continue to sell well. In fact, we see Immunity Canvas sales rising slightly as R7 will spend good money and time promoting the functionality, differentiating penetration testing from vulnerability analysis (see below) and generally helping Immunity by marketing the “why should I pen-test?” proposition. A rising tide of marketing dosh raises all boats, and Immunity will benefit from a standpoint of sales. Where Immunity will suffer is in the development dollars it will feel pressured to spend to improve the UI faster than it may have otherwise wished. The team in Miami has a plan - a good one - for getting the UI and the backend framework to a new level, and it has been executing admirably on that plan. However, I believe that in the newly-shifted landscape in which it finds itself, Immunity may have to accelerate the timeline of these improvements, which will require a shift of resources within the firm to accommodate. Immunity is clearly capable of doing this.

The problem faced by all three which has been aggravated by this acquisition is the most problematic aspect of the competitive field in penetration testing - people conflate pen testing and vulnerability analysis. At IANS Forums for the last year, I've been running sessions on developing internal pen testing resources (the next one is Chicago on 2-3 November). During these sessions, I regularly ask delegates whether they are currently running pen test software and if so which. In every session, someone says that they run Nessus or Qualys and think they are pen testing when they are assessing vulnerabilities. The fact that R7 is known as a vulnerability scanning company is trouble enough for the firm, which is diversifying its offering. To add pen testing to its mix confuses customers, and R7 will have to spend wisely on marketing. We note that Core has been marketing aggressively for years and surmounted many challenges in the space; despite the success and aggression and audacity of its campaigns to date, these confusions remain in the industry. So Core, too, will benefit from R7 entering the market from a marketing standpoint. In the end, Core may find that even if it must eventually reduce its price (something it will resist mightily), its volume will likely increase as the market becomes more educated.      

The best thing about the acquisition is that enterprise customers now have three legitimate, sue-able and responsible organizations proffering tools for penetration testing. Quality will likely rise, average price will likely fall, and functionality will likely increase. This is a good time to be in the market for pen-test software.

Nick Selby is a Faculty member of IANS. He is Managing Director of Trident Risk Management.

Peter Kuper: The Consolidation Cometh

While the first quarter of 2009 started the year off with a whimper, recent deal announcements may indicate the start of a flurry of deals likely accelerating into the end of 2009.  Flat to declining IT budgets are forcing larger vendors to acquire growth and with a stock market still well below prior levels, buyers – most of whom have plenty of cash –  will be making their moves sooner rather than later. Reinforcing our view are the announcements of Dell, Cisco, and EMC indicating acquisition intentions.

 Where’s the growth?

Both overall software spending and security budgets specifically show continued weakness, hence buying growth is a foregone conclusion for strong security software players.

Source: Bureau Economic Analysis

If you can’t beat them, buy them

Given this backdrop for software spending, publicly traded companies will be driven to buy revenue growth. Organically building share via sales promotions, as one example, is also a recurring effort but it takes longer and can in some ways look more expensive. We say “look” as the optics of acquisition accounting including one-time charges are typically deemed less marring than the organic treatment. Any sales and marketing efforts essential to help grow market share are recognized as expenses, which of course hurts the bottom line or Earnings per Share (EPS).

 However, acquiring a company looks better to those alleged experts on Wall Street; for some reason, analysts typically ignore the real financial costs of an acquisition – write these so-called one time charges out of the analysis, ignore the dilution from stock issuance or the depleted cash balances needed to consummate a transaction. This happens in almost every case except where it is blatantly negative, but most deals suffer little to no impact. Therefore, CEOs are actually encouraged to take on acquisitions given the more immediate growth boost and the accepting Wall Street community.

Software M&A Since 2003

Source: Viant Group, LLC

History as Our Guide

IT managers need to consider the what-if’s from the potential consolidation scenarios and have at least a sketch of a backup plan. While we can only speculate where the deals may occur, we’re happy to take a shot at some general directions for the market. Given the lack of growth, the larger companies including Cisco, IBM, Oracle, HP, and EMC are going to first lock up the larger tangential market segments, and then move into new arenas that would augment or help sustain existing business lines. History is the guide here and we’ll use one of the most prolific recent buyers as proxy.

 Oracle went from its core database to applications that extract the data: Siebel for CRM, Peoplesoft for ERP. Next was vertical exploration such as its retail play in Retek.  It then went into applications that further refine the data such as Hyperion in Business Intelligence (BI), and Profit Logic, a retail-focused BI-like provider.

 To enable better availability and integration of the acquired properties, it then went after security companies including Oblix and Thor and a middle-ware provider in BEA Systems. With the bulk of the tangents taken, and organic growth still nowhere to be seen, you see the move on giant Sun which is quite the jump in our view.  All of these deals of course have the added benefit of pressuring the competition - most notably IBM.

 While IBM is enjoying steady growth from its Services business, the threat from Oracle is now too prevalent and we would not be surprised to see significant moves, including an eventual tie up with SAP to more comfortably repel the Redwood Shores behemoth.

 Cisco is another example – buying up everything from Linksys to SAIC for the tangents (routing, switch-like devices for the home); multiple security buys to help sustain router and switch pricing, capability. Look for Cisco to further extend its presence into the data center, one of the few growth areas in tech today – the company just named IANS Faculty Chris Hoff Director of Cloud and Virtualization Solutions, indicating a far more serious intention at both security and re-perimeterization.

 EMC is now taking its next $2 Billion dive – with RSA digested, it is now in a bidding war with NetApp for Data Domain. But EMC has also made multiple other moves to be viable in the next-gen Data Center opportunity – from VMWare to Smarts and Network Intelligence. We expect EMC to go further in this direction.

 HP is another player to watch. While the EDS deal was no small step, HP looks poised to kick into product buying mode: with HP Open View a core technology line we would expect to see increased investment.

 Avoid the Lock

 Overall, the tech world is becoming very barbell-like and the oncoming acquisitions will only exacerbate this trend. At one end we have the largest of vendors – Microsoft, IBM, Oracle, HP, and Cisco to name a few. These companies have been cornering an increased amount of IT total budgets over this decade. In fact, revenue data suggests that these companies are taking up to 80% of all new software spending. That leaves 20% left for every other vendor combined. Not a very pretty picture, although what else should we expect given all the acquisitions done over the years? Over $75 Billion has been spent on deals this decade alone.

 As we have written before, having a plan in place is essential. There are of course scenarios where an acquisition could be a good thing; the buyer is already a partner of yours and the acquired technology is a good fit for your plant. Also, as investments still are slow, more than a few private companies may not have the wherewithal to see the technology through to its fullest potential whereas a larger buyer could take it to the next level. However, what if the buyer is a “vendor” and instead of looking to maintain a healthy relationship with clients, it instead sees the acquired technology as a leverage point to squeeze more dollars out of you? Vendor lock-in is not where you want to be. 

 So, look for the buying to happen and the number of technology companies will become fewer. Picking reliable partners is that much more important as this all plays out.

Peter Kuper: Rubber Meets the Road - Empowering the Enterprise to "Rip & Replace"

We’ve been focusing a good amount of our recent posts on the economy and macro themes.  Some may ask: why is that?  In fact, at least one NY Forum participant said essentially just that. “We all know it’s bad out there – so what?”  The “so what” is that the ones that act as a deer in the headlights – who see it coming but don’t move – are more than likely going to complete that analogy as represented by the unemployment line.

Implications of the macro analysis include managing vendor consolidation, pricing pressure, and vendor lock-in, to name a few. There’s also the issue of a prolonged weak economy – we anticipate some products to be eliminated as vendor companies look to trim costs. So even being an existing solution from a “big” vendor does not guarantee your product immunity to this economy. The world truly is different this time.

It may seem too simple for us to recommend that the security buyer bang on their vendors’ desktops demanding significant discounts. Actually, it is that simple. Times are tough and every company desperately wants that sale. But for those who come across the vendor that wants to stare you down, we need to arm you with the ability to truly walk – tell them they’re out and there’s no turning back.  Normally, the rip out scenario is not all that simple. And that requires we get out of our ivory tower and come down to ground zero to advance the strategy to execution. The key is to make sure the replacement solution pricing more than covers the additional one-time costs from the switch.

Low Hanging Fruit

For certain products, the rip out can be fairly straightforward; an IPS appliance is a swap, tuning, reporting issues aside. Firewalls are a similar argument that would be even more straightforward if the vendors would advance their configuration interfaces. Fortunately, for practitioners, there are solution providers like Tufin enabling better management. SourceFire and Tenable are companies we’ve mentioned in earlier posts that are enjoying dramatic growth due to their relative low price and increasing functionality. It’s the agent-based switches that we worry about most.

 

“It’s All for Nothing if You Don’t Have Freedom”

William Wallace

Agent-based technologies are typically a little more involved and cumbersome given the distributed physical aspects alone.  But hope springs eternal in tech land as the innovation yet again comes from the privates. Consider the following: you are a Symantec or a McAfee shop and you want to see your anti-virus pricing get slashed. (You really do want to see this – why are you paying a premium for a mature signature-based technology??) So, the night before your meeting with your existing provider rep, who is looking for a renewal or more, you watch "Braveheart" four times over two bottles of wine and prepare for battle. 

The rep for said shop listens to your demands and states that your company will no longer be receiving updates unless you sign the renewal agreement at the current price. In the game of vendor lock-in chess he just said: “Check.” After your next volley of indignant words finish reverberating off the office walls, said rep smiles then proceeds to tell you (in an English accent of course) that there is no discounting program in place right now, but continues with something along the lines of “because I value our relationship, I’ll call HQ and fight for 6% off – just for you.” You, of course, want 40-50% off (yes, that much) and they say 10% is the best they can do, final offer.

Even better, if you want to limit the relationship and ask for a one year deal, they won’t discount at all, and the one year deal is the highest markup as they want to either force you into a multi-year deal at a discount or extract the most dollars possible in case you do finally defect. This is now the game of chicken; he knows it will cost you something measurable to switch – even just considering the man-hours needed to effectively rip and replace. Moreover, what if there’s a problem with the rollout – do you want to be one on the hook for a bad call? He knows this, and you know this too…

But here is the opportunity. Calling the other vendors – be it McAfee, Sophos, Symantec or Trend to name a few, or Google and Microsoft to name a few more, and letting them know you are looking at a replacement, the discounting will immediately come in at 30% or better depending on the overall size of deal and tangential sales opportunities. But even if you get the 30% off a $1million deal, how much of that $300,000 is going to be soaked up by the 53 steps needed to remove SAV 9.x? And these costs can increase further if there are any failures in the actual rip and subsequent replace. But vendors are working on this as well. McAfee has been steadily improving their tools, and we’ve found a powerful solution comes from our customer checks in BigFix. From our regular industry checks, we’ve spoken with BigFix users including one managing over 200,000 nodes that can handle all major anti-virus vendors’ agents as well as pushing patches for its Microsoft nodes in hours – 4 hours for this particular user.

There’s some very real ROI to be had from that alone. We also like the ROI analysis tool BigFix can make available before any purchase decision is made. What we value here is the ability to input various operational levers to create different outcomes – think the man hours are too few? Crank up the FTE-related inputs. Hardware cost debate? You can tweak those as you determine appropriate.  Finally, we also like the other ancillary benefits of the solution such as a power save mode that can lower electricity consumption to help pay for the BigFix licensing costs alone, irrespective of any vendor switch-driven savings.

We have seen BigFix in action thanks to the IANS community – members sharing their success stories and frustrations. BigFix is not a singular example; we’ve mentioned SourceFire and Tenable in prior posts for similar reasons. IANS users are saving money and increasing their security profile. BigFix is cited here in an effort to help our members think through the concept of cost saving strategies and translate it into actionable ideas.

To wit: IANS is hosting BigFix’s Director of Product Marketing in Boston next week to directly answer IANS members’ questions. And we have our own list to make sure we get to the good and the bad. As always, we recommend you lever the IANS community, from peers to faculty. Making a difference in your organization is always a goal; delivering significant value-add to your organization in this environment will make you stand far above the crowd – both internally and externally.  Happy hunting.

Peter Kuper: Opportunities Abound!

At the Source Boston conference last month, we spoke about the opportunities for start-ups and how now may be an ideal time to launch a new venture. CSO Magazine published a nice recap of our message and added some great perspective for would-be entrepreneurs. With the stock market still seemingly stuck in a wide but capped range, investors are likely becoming frustrated with traditional investments – or certainly fatigued by the never-ending evidence of how the average Joe has no chance to generate meaningful wealth with reckless Investment Banks or Bernie Madoff. And as layoffs hit levels not seen for 25 years, job security isn’t exactly a reason to keep toiling away in the ivory towers.

 

 

Paper Napkins

While this may sound like a silly concept, many a successful company has its roots from a couple of folks sitting in a hotel lobby drawing out what eventually becomes a solid business plan, and ultimately a going concern. Our advice is to first solicit feedback and ideas from both industry pundits (IANS Faculty are a great source) and the intended business users.

Danny, see your future, be your future

While we could write a book containing many stories and issues surrounding salesforce.com’s CEO Marc Benioff, we can’t take away the fact that his company capitalized on a subtle but dramatic shift in computing platforms. Software-as-a-Service (SaaS) has led to a number of fast-growing companies of all types in all aspects of technology – from available CPU cycles and storage (Amazon) to applications (SuccessFactors) and, of course, security (Qualys). There are many other companies and even more start ups that are targeting this complementary shift within Infrastructure Technology. Chris Hoff’s well received presentation at Source Boston (The Frogs Who Desired a King) points out the need for management around “the cloud” else we will not only replicate but perhaps exacerbate the mistakes made in the more traditional computing efforts. As the cloud is not exactly new, there are already a number of companies targeting this opportunity – but that doesn’t mean there isn’t room up on the cloud. In fact, in many cases the first mover (assuming no patent issues) makes enough mistakes to allow the next player to take significant share as they capitalize on the learnings of the “bleeding edge”.

Thank you sir, may I have another?

Finding a hidden gem can lead to securing investor dollars so long as the founders understand that it’s usually no simple task. Even entrepreneurs with incredible ideas may find themselves on many a plane trip to have only a 15 minute meeting with a distracted venture capitalist. The VCs are certainly distracted, as they too are typically challenged raising funds given the wonderful economy.  Having said that, there are a number of VCs with cash to invest. One good example is .406 Ventures, a relatively new VC located in Boston, MA. We’ve highlighted the firm’s investment approach, significant security investments (Bit9, Chosen Security, Memento, Veracode), and knowledgeable executives. Maria Cirino, one of the co-founders, was herself a “paper napkin” executive back when she co-founded Guardent, the MSS eventually acquired by VeriSign for $140 million. We also respect Maria for her thoughtful but straightforward advice. Honest feedback is what any entrepreneur needs as having a dream is not in itself useful; finding a way to effectively apply the passion is a requisite. There are undoubtedly a number of other VC firms that are also very helpful with investment and guidance, and investors need to find the right firm for their needs. One size does not fit all. For more information on this, please contact us – listing all the VCs that we see as proactive would itself be a decent-sized report!

Square peg, round hole? No problem!

Another thought we’d like to share with the IANS community is that sometimes one idea may not exactly generate a billion, but a tangential extension or different application of the core technology may be extremely successful. Sourcefire is a useful example here. Marty Roesch, the CTO and founder of Sourcefire, thought through the issues of monetizing open source solutions. Building commercial offerings around his Snort core technology led to an Initial Public Offering (IPO) currently trading on NASDAQ: FIRE. We previously mentioned Tenable and Ron Gula’s related approach to capitalizing on an open source standard. Beyond open source, there are a number of other examples to examine. Another factor in the FIRE and Tenable successes is lower TCO. In this economy, providing more for less is an absolute must. Companies that offer a compelling technology for a better price are seeing very strong growth. Early this week, we had lunch with the COO of Rapid7, a Bain Capital-backed company, who indicated the company is achieving record results – even in this economy.  And other opportunities come with expanding technology platforms. We cited SaaS earlier, which has many proven examples in security such as Postini, acquired by Google for $675 million.  Beyond SaaS, consumer plays are open to security providers: the .406-backed Chosen Security recently signed an exclusive multi-year contract with CI Plus LLP to provide digital certificates for piracy protection in TV set top boxes and other devices.

In summary, there are a number of opportunities for the aspiring individual especially in such an economy. Companies with weak models are suffering, as they should; a recession after all is a necessary cleansing of operations not sustainable. For a start-up, as the economy will likely take time to recover, this time is a huge opportunity. Take the two years to thoroughly develop the technology, win the trust of your customers, and position the company to benefit from the eventual recovery. But first things first – before you transfer the paper napkin to .ppt, use the Faculty to sanity check the idea. And if Marcus hates it, you may be on to something!

Disclosures: The author was the lead analyst on the SuccessFactors and Sourcefire IPOs; the author currently has an equity position in SFSF.