IT Security is in a transition period marked by growing distance between how vendors and their customers view the market. Vendors, particularly larger publics, are building and marketing solution frameworks -- Network Access Control (NAC), IAM (Identity and Access Management), and GRC (Governance, Risk & Compliance), etc. Customers, however, still speak about specific needs, e.g. keeping confidential data in, properly logging network activity. Longer-term, customers stand to benefit from a strategic approach to security. However, shorter term, convenience and cost rule so customers will continue buying products for specific pain points and will avoid re-architecting/replacing existing investments. As an example, Network Access Control, unveiled by Cisco in 2003, offered the promise of a ‘self-defending network’ powered by a central, policy-based approach to security and compliance. Despite Cisco’s heavy investment in the vision since then (and Microsoft’s in NAP), NAC remains an amorphous marketing label. Hundreds of vendors define themselves as NAC solution providers, in areas that include discovery, access control, intrusion prevention, endpoint security, content security and vulnerability management. Each vendor addresses needs falling within NAC, but do not themselves advance NAC adoption. And customers are buying the specific solution rather than the vision. Ultimately, the promise of NAC and other valid solution frameworks will be realized, but on a piecemeal, evolutionary basis that will take longer than publicly envisioned. This is good news for vendors seeking to benefit from the large potential market that NAC and other frameworks represent. It also means that the ‘stack dominators’ – Cisco, EMC, HP, IBM, Microsoft, Oracle – will continue to actively acquire vendors that help them turn the visions into reality. |
