McAfee + NitroSecurity: SIEM Merger Done Right

One of the big problems with security solutions in business is that they are largely ad-hoc. This means different layers are often added without much consideration for interoperability, and the end result is exploits that otherwise might have been caught are missed because they pass between the reporting gaps of the various systems. Security information and event management (SIEM) products are designed to close these gaps by connecting all of the products and showcasing trends so that an attack -- regardless of the attack vector -- can be more rapidly identified and mitigated.

The advantage of having a vendor-independent SIEM solution is that it gives you a better choice of the parts. The disadvantage is that the independent vendor generally has trouble maintaining high integration with new features because they aren’t in the development loop for the products they are integrating with, and are always playing catch-up. In a slow-moving market, this is an acceptable trade-off; unfortunately, the security market is no longer slow-moving, which likely goes to the core of why McAfee bought Nitro Security.

According to IDC, the SIEM market alone is currently more than $1 billion total and growing at an aggressive 22 percent. This is likely because of the proliferation of point-security solutions that now need to be better integrated in order to be made effective. This is coupled with the massive increase in visible threats, which many of us believe are underreported, but have crossed industry and government sites and penetrated organizations that were thought secure enough. SIEM products have a strong value proposition: They create visibility across the IT infrastructure, limit risk, and provide analytics that can identify threats and help fund mitigation efforts. In short, they provide the missing situational awareness needed to address what has become a complex threat landscape, and help make better decisions with regard to how to best protect the business.

I think the key to why McAfee bought NitroSecurity is the need for speed. It already tied back into some of its other offerings, but these offerings were being changed at an increasing rate, and for the links back into NitroSecurity to function optimally, McAfee would need an integrated suite. The only way to get this result effectively while maintaining product development security was to buy NitroSecurity and use it to link its ePO, McAfee Risk Advisor, and GTI offerings.

This now will increasingly look like an end-to-end suite so that buyers aren’t left with timing integration gaps between McAfee's and NitroSecurity's products.

This was also one of the easiest types of integration mergers to do, one where the product was already partially integrated with the planned suite of offerings and where the integration issues are likely already known.

Most software acquisitions occur between products that were never intended to work together, and then fail because folks eventually find out it is generally better to start from scratch than to try to integrate products that were never designed to be integrated.

In this case, NitroSecurity’s SIEM offering was designed to be integrated with McAfee's products, making the integration comparatively easy and speeding time to market. The end result is a solution that is and will remain more agile and better able to respond to a world of increasing and ever more aggressive threats.

Rob Enderle is president and founder of The Enderle Group. Special to Dark Reading