Schwartz On Security: Reaching The M&A Tipping Point

The jury is out on whether businesses will benefit from Intel buying McAfee or from Symantec, IBM and Microsoft sucking up everything in sight.

The pace of mergers and acquisitions in the security industry has been breathtaking, but could it be headed for a stop?
Since last year, numerous top-tier smaller outfits have been snapped up by large players. Indeed, more than $10 billion has been spent in just the past six months by Symantec (
VeriSign
plus
PGP and GuardianEdge
), IBM (
BigFix
,
OpenPages
, PSS Systems), Hewlett-Packard (Fortify and ArcSight) and CA (Arcot).
Furthermore, the technology industry heavyweights -- who by virtue of their size largely
innovate via acquisitions
-- apparently still have oodles of cash at the ready.
Whats behind the breakneck pace of acquisitions? One answer is that its mirroring a
growing awareness of security
by senior executives. Security is starting to get higher on their radar screens now, said Steve Robinson, general manager for IBM security solutions. Many of our corporate accounts are starting to put in chief security officers, to expand their security teams and see that security has impact on all parts of their business.
This evolution and growing security understanding is -- on the upside -- leading customers to demand more consolidated approaches to mitigating their security challenges. Accordingly, said Robinson, we need to move beyond the single product to solve a single problem, to more of a comprehensive strategy.
Cue mergers and acquisitions. But where should they end, and are businesses best served by a more
all-in-one approach
?
Consider Intels $7.7 billion acquisition of McAfee, which surprised many industry watchers who thought endpoint security should be
built into the operating system
, rather than the motherboard.
The positive spin is that the deal has the potential to bake-in better security to PCs and mobile devices -- through to
virtualized environments and the cloud
-- from the get-go. But it also has the potential to be seen, in a few years, as an expensive one-size-fits-all boondoggle of AOL proportions.
Garter Group analyst John Pescatore
likens the overall information security M&A equation to cars and boats: Would you buy a car from a boat maker? How about a boat from a carmaker? The short answer is, no. Now extend the paradigm to information security.
Im always amazed when network infrastructure vendors like Cisco and Juniper build security solutions that try to get us to put their software on our endpoints, and when software vendors like IBM Tivoli or CA acquire and try to sell network security products, he said. These strategies always end badly -- it is why the McLobster sandwich and the Nobu Whopper never did well either. But there are signs that some security companies may be reaching a tipping point. On Saturday,
The Wall Street Journal reported
that Relational Investors LLC began building a stake in Symantec earlier this year, so as to split the company into separate security and data storage businesses. Analysts say that Symantec is still having difficulty benefiting from its 2005 acquisition of Veritas.
If the rampant pace of merger and acquisition activity threatens to create a fast food approach to information security -- ease over substance -- thankfully theres been some undeniably good news on the botnet M&A front lately: The brains behind the
Zeus crimeware toolkit
will reportedly retire, allowing his code to be merged with a competitor.
Zeus expert Don Jackson, director of threat intelligence at SecureWorks, recently
told Reuters
that the anonymous programmer behind Zeus had announced his retirement, saying his creation was
taking too much heat
, and that hed hand the Zeus source code to up-and-comer financial crimeware outfit Spy Eye.
Little is known about the Zeus author, who first hit the scene in 2007, except that he appears to be Russian and to favor usernames based on expensive cars. Jackson, however, thinks the retirement announcement is a ruse so that the Zeus author can drop his less lucrative and more high-maintenance customers. He estimates that, so far this year, Zeus-using gangs have netted at least $100 million.
But other security experts noted that after youve sold enough software to earn yourself whats likely millions of dollars, then if not retire, you could afford to take a break.
With luck, one way or another, the author of Zeus will go away for a long time.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Schwartz On Security: Reaching The M&A Tipping Point