IBM Sets Out To Prove Security Mettle

IBM is trying to succeed in the less familiar terrain of network and desktop security — and finding that a few high-profile moves aren’t enough to sway some skeptical analysts.

When IBM acquired Internet Security Systems (ISS) a year ago, the industry’s mixed reaction included that of Gartner security analyst John Pescatore, who said it doesn’t “make sense for IBM to own network-security products.”

IBM pushed forward nevertheless, striking a deal to buy Web-application security vendor WatchFire in June. Then in November IBM said it will spend $1.5 billion on security in 2008, and announced several new products and services for data security and compliance with the Payment Card Industry Data security Standard. The $1.5 billion sum is thought to be twice as high as IBM’s previous security spending.

Pescatore still thinks IBM should take it slow, saying that the fact IBM has expertise in providing I.T. infrastructure doesn’t mean it should be selling products that react to security threats. Fraud detection and fraud management are areas that would make sense for IBM to enter, but “the area we don’t think they should go [into] is more network security stuff, like buying a firewall company or getting into antiviral software,” he says.

IBM does provide antivirus software in IBM ISS’ desktop offering. Moreover, IBM intends to be “the dominant security player” in a market that’s ripe for consolidation, says Peter Evans, vice president of marketing at IBM ISS. A big enterprise that buys security products from dozens of vendors might have an easier time managing those tools if they all came from one vendor, or from just a few, Evans notes. Much of the $1.5 billion IBM plans to spend on security will focus on creating integrations between various security products, he says.

Some analysts are wary of IBM’s increased focus on security, but others…