Buyer Beware: How To Avoid Getting Sucked Into Shelfware

We’ve all seen slick pitches by information security vendors eager to grab budget. Some are valid, concentrating on the critical controls required in today’s world to protect our data; others are of slightly less need and merit.

Sales will be sales; compensation drives behavior, and when you’re faced with a sales team earning a significant commission from selling tools that protect you from all the “l337 h4x0rs,” sometimes that behavior is less than in the best interests of the buyer. As much as a vendor will advise you on which technology is best suited for the issues faced, remember they are often primarily trying to sell their solution. When was the last time you went to a BMW dealer to look for a new car and, after discussing your requirements, they suggested an Audi? Or even less probable, they said that you should keep what you have and just give it a clean and a service?

This isn’t a rant about sales teams; I’ve worked with some amazing salespeople who care about the customer and the problems they face. This is more about what you should consider before signing on the dotted line.

Security technologies are rarely simple, more often requiring effort to manage and operationalize effectively to gain the level of protection evangelized in the sales process. A good CISO friend of mine once told me that no matter what the vendor of a product tells him (including me), he always calculates the cost of managing any control at a 5:1 ratio -- calculating the operational costs as five times the amount spent on actual licenses. Far too many companies want to throw money at a silver bullet rather than put the effort into actually fixing the problem, which leads to lots of license sales but low return on investment.

Beware Of Shelfware

It seems odd that companies would spend a huge amount of money on a technology and not implement it fully, but shelfware (or underutilized technology) is a known problem in the industry. When Target got popped at the end of 2013, reading the kill chain analysis gave a sobering and clear view of the problem. The retailer had spent a significant amount of money ($1.6 million) on a market-leading anti-malware solution to defend against the very attacks it experienced, but it ignored the alarms raised by the platform, idly standing by as critical data flowed out into the hands of cybercriminals. Target had invested nearly $2 million on a control many would argue is the right approach to addressing the threat of targeted malware. Yet due to an inability to actually operationalize the control effectively, the retailer paid an even bigger price. Simply buying an expensive security technology is useless if it’s not implemented properly.

With every purchase, more consideration should be given to how the product will add value to the overall business. People, process, and technology are often cited as the critical considerations to think about for a control. But for me, I also like to think about measure, validate, and communicate.

I like to pose three simple questions when talking about implementing any control or suggesting an investment in a technology:

So next time you’re across the table from a vendor, try posing these questions. Vendors with a desire to help and a solid approach will undoubtedly provide guidance through examples of other work they’ve done with similar customers, metrics to use to measure the operational efficiency, and advice on how to demonstrate the value of the solution.

Vendors love to state that their solution is “almost plug and play,” or that you can “just drop it in and it works like a charm with proactive protection out of the box.” But after the proof of concept is done, the purchase orders are sent, and the license keys are received, make sure you're getting the most value you can from the investment, because security budgets are tight enough already.