In my last blog, I wrote about the ArcSight IPO and its significance to the marketplace. I pointed to the fact that ArcSight revenue jumped from just less than $40 million to a hair less than $70 million year-over-year, a metric illustrating just how hot the security management market is. Ditto for closely related log management. According to ESG research, nearly half of all enterprise companies collect at least a terabyte of log data each month, and this capacity continues to grow as more log data is collected from more devices and left online for longer periods of time. In this case, growth equals vendor opportunity.
With numbers like these, it certainly seems like security and log management are great businesses to be. Surely, EMC, IBM, Hewlett-Packard, and Novell think so--each of these firms either acquired or partnered to enter this space. With all of this writing on the wall, however, a few vendors that should be in the security and log management space remain on the sideline--an absolute mystery to me. Which companies? How about:
1. McAfee. McAfee claims to be the biggest pure-play security vendor, yet it doesn't sell a security information management solution. This would be like entering the fast food burger market to compete with McDonald's and not selling French fries. McAfee recognizes this weakness and says it is developing its own product in-house--the old day late and dollar short strategy at work.
2. Check Point Software Technologies. In fairness, Check Point does have some security management products but the company tends to focus on managing its own devices. Yes, Check Point does have its OpSec partners and integration tools but the company that distinguished itself with wonderful software functionality has steadily avoided the standalone security software management market. Check Point is still wildly profitable but security and log management could be its ticket to topping a billion dollars in revenue over time.
3. Microsoft. Eventually, Microsoft will tie security and log management together with Windows Server 2008, Microsoft System Center, and SQL Server, amongs others. As of today however, Redmond is a no-show.
4. The management crowd. I'm thinking about companies like BMC and Compuware. Security may be a stretch but log management is a foundational piece of compliance management, IT governance, and IT operations. As such, these firms should be in this marketplace.
I realize that technology vendors can't diversify willy-nilly but jumping into security and log management is not a stretch for any of the aforementioned firms. ArcSight could have fit into any of these companies' strategy. I just don't get it.
What's the fastest-growing data source at large organizations? Video? Maybe at YouTube, but not at Citibank. The answer is log files. Yup, those mundane text messages produced by every conceivable technology device are growing like a proverbial weed.
Why the log file explosion? First off, every IT shop has more and more devices to manage each day, and more devices mean more logs. In the past, most IT managers paid limited attention to logs, but this too has changed. Driven by security monitoring, regulatory compliance reporting, and IT troubleshooting, large organizations now aggregate, analyze, store, and archive terabytes of log data every month. Indeed, the log management snowball is rolling down a very steep and very snowy hill.
It's certainly time that the IT industry recognizes that log management is no longer a tactical domain of IT administrators. Rather, think of log management as the foundation of a Network Information System (NIS). Analysis of log data (as well as other data sources like NetFlow and SNMP) is quickly becoming the difference between effective IT security/operations management and flying blind.
As log management gains strategic importance, look for the big guys to swoop in. EMC/RSA and IBM are already there, and HP is working with SenSage on its play. There are also several strong pure plays including ArcSight, LogLogic, and LogRhythm. All this said, where is everyone else? Log management seems like a natural for Cisco Systems, especially in concert with its whole Data Center 3.0 initiative. Symantec is also missing from the party thus far, as is CA, McAfee, Microsoft, and loads of others.
Logs seem trivial, and log management appears like a tactical task at the bottom of the IT stack. Maybe in the past this was true, but in today's world, information is power and logs are device-specific information. Aggregate these logs, add some intelligence, and provide tools for analysis, and you get a great temperature reading of what's going on across the IT system. Seems pretty important to me.
- prev
- 1
- next
