25 August 2006

ISS enters Big Blue

Brian McKenna

Not so much a summer of love as a season of wedding accouncements. Microsoft swallows Whale; EMC scoops RSA; and now Big Blue takes ISS.

Although a true IT security industry pioneer, ISS has never developed a full security suite: no anti-virus, and no incursions into authentication or identity management.

But it is almost synonymous with IDS (intrusion detection systems), and has benefited from high brand recognition among security specialists. Co-founders Tom Noonan and Chris Klaus, and CTO Chris Rouland enjoy celebrity status in our community. And its Managed Security Services business is outstanding among pure play security companies.

Two years ago, Infosecurity said that ‘ISS’s value proposition may not be enough, in about two years’ time when infrastructure providers start embedding security into their products’.

Alain Dang van Mien, research director at Gartner, told us, back then, in May 2004: “a discontinuity will be brought about by the big players who don’t plan to make money on security, but will embed more security technology into their operating systems and networks”.

Looks like the 'discontinuity' is among us.

At that time, ISS’s Pete Privateer, SVP of global marketing, dismissed that argument, saying: “To buy into the Gartner premise, you have to accept the idea that security groups built up over the last ten years are going to be replaced by systems and network administrators. I can’t see that happening”.

It looks like the company has seen that happening.

However, Jaap Smit, senior vice president EMEA for ISS challenged these statements. "Being a pure play security company has always worked well for us", he said. He conceded that "more and more decisons do involve more than the security function. However, from our point of view, that shift to the networking guys getting involved is a good thing; budgets are bigger there.

"At least", he said, "we can not be seen as just a niche, albeit visionary, player."

On 23 August, IBM and ISS announced the two companies have entered into a definitive agreement for IBM to acquire Internet Security Systems in an all-cash transaction at a price of approximately $1.3 billion, or $28 per share.

In a statement they said that the acquisition reinforces IBM’s position in the area of Managed Security Services. ISS will join IBM as a business unit within IBM Global Services’ Security organization. All 1,300 employees will keep their jobs and the existing management team will remain in place.

Uttering the magic IBM words, ‘on demand’, Tom Noonan, President and CEO of ISS said: "By delivering an integrated security platform that is adaptable and extensible to address new threats and business requirements without incremental complexity and cost, ISS has delivered the foundation for delivering security as a service. These on-demand capabilities, together with our managed security services, appliances and software will bolster IBM’s leading security services”.

IBM, it is said, will utilize ISS’ X-Force security intelligence service, which protects networks with detailed analyses of global online vulnerabilities and threat conditions.

Jaap Smit contested analyst comment that the X-Force might lose its edge in teh new set up. "IBM has put a lot of money behind this acquisition. They value the totality of what ISS does, and do not want to lessen the value of taking it apart".

He also dismissed commentary suggesting that the acquisition will impact negatively on ISS's distribution network. "Contracts will stay in place", he said. "IBM saw our network as of interest, and our partners, too, will get to play on a larger stage".

The ISS network of security operations centres (SOCs), which include sites in Tokyo, Brussels, Brisbane, Detroit and Atlanta, will also be added to IBM’s existing global network of SOCs.

The acquisition is the biggest IBM has made since it acquired the PwC consulting business in 2002.

Back to news index