Maturity Hurts

We’ve previously argued with fierce conviction in thesepages that IT managers (and there are many layers of them), have a focus that’sgoverned by things like network up-time, availability, network security,e-commerce, web mastery and network authentication. The idea such exalted beings could spend their timemanaging physical security vulnerabilities, conducting investigations, managingsecurity officers, handling physical key management, law enforcement liaison,evacuation procedures and all the rest is hard for us to come at. Professionalsecurity managers have a focus on the day-to-day protection of corporate assetsthat senior IT people are never likely to approach.It light of these opinions it was interesting to readHoward Schmidt, president of the Information Systems Security Association, recentlyquoted as saying “It used to be the guns, gates and guards versus the bitchasers and the hacker trackers – technology has fundamentally changed the wayall those groups do business. We’re much more united today than in the past.”We’re seeing the technologies that used to berestricted to physical space – the cameras, the alarm systems, the card readers- all of which were unique to a hard-wired analog environment, moving into anIP-based digital system,” Schmidt said. No one who has been paying even faint attention to theelectronic security industry over the past 10 years will be surprised by any ofthis. But how likely is it that IT managers will govern security departments?After all, accounting systems and HR systems also drive across networked IPenvironments and there’s no chance IT departments will ever control them. Significant elements of the hype are driven byconvergence – and that’s being pushed hard by U.S. Homeland SecurityPresidential Directive 12, issued in 2004, that includes a requirement forautomated and secure user credentialling at federal agencies. It’s all aboutmoney, really. With Directive 12, the U.S. government is looking to shave its infrastructurespend and in chasing Directive 12, manufacturers are looking to stack up whenit comes time to winning the humungous contract to supply all those millions ofU.S. government workers with their credentials and access infrastructure. There’s been plenty of push and shove when it comes toDirective 12. Oracle is working with Honeywell and Lenel to make its identityand access-management software work with the physical access systems sold bythose companies. At the same time Novell and Honeywell are set to ally in thenear future. Another big player is HID Global and there are plenty of othersthat don’t spring immediately to mind.None of this answers the question of whether or not ITpeople might one day head up the security function. There’s no sure answer butthere are a few things we can say. First up, IT managers are now thinking aboutphysical security and IT manufacturers are now building networked physicalsecurity solutions. What this means is that regardless of the end results ofconvergence, security managers and electronic security installers are nowcertain to team up with IT departments during their installations and their day-to-dayoperations. One final observation is this. Network administration software andnetwork administration teams are uniquely positioned to monitor events occurringacross networks of devices. If there’s a job electronic security systems are designedto do that doesn’t involve monitoring events on remote devices, we can’t thinkit is.