SIM/ESM: Ripe for consolidation?

NETWORK WORLD NEWSLETTER: SCOTT CRAWFORD ON NETWORK/SYSTEMS MANAGEMENT
07/13/05
Today's focus: SIM/ESM: Ripe for consolidation?

Dear networking.world@gmail.com,

In this issue:

* Consolidation could come in security information management
  market
* Links related to Network/Systems Management
* Featured reader resource
_______________________________________________________________
This newsletter is sponsored by Oracle
Automate Business Processes and Improve Efficiency

Fragmented data, disparate applications, lack of automation, and
a disconnected supply chain slow you down and cost you money.
You need to respond more quickly to change, connect more closely
with partners and customers, and squeeze more value out of
existing resources. Oracle's industry-acclaimed Business
Integration Solution is built on the industry's most complete,
J2EE- and open-standards-based integration infrastructure. Learn
more by clicking here!
http://www.fattail.com/redir/redirect.asp?CID=107502
_______________________________________________________________
VORTEX2005: Setting the IT Agenda

Sign-up to reserve your seat at this one-of-a-kind event! You
don't want to miss John Gallant and Geoffrey Moore deliver
hard-hitting, direct questions to senior executives from AT&T,
Cisco, EMP, HP, Microsoft and more on how their strategies for
the future of the $1 trillion enterprise IT market impact your
business needs and goals. . Register today and enjoy a preferred
registration rate (a $700 savings!)
http://www.fattail.com/redir/redirect.asp?CID=107875
_______________________________________________________________

Today's focus: SIM/ESM: Ripe for consolidation?

By Scott Crawford

Recently, Micromuse announced plans to augment its security
information management products with its acquisition of
GuardedNet, one of the longstanding players in the space.

This event was not a surprise. With limited differentiation
among competing offerings, the SIM market has become highly
competitive - as suggested by the number of competing taxonomies
that describe it. Segment leaders ArcSight, e-Security,
Intellitactics and netForensics, as well as challengers such as
Network Intelligence and OpenService, increasingly go up against
larger players like Computer Associates, NetIQ and Symantec -
all competing for highly demanding integration efforts among the
largest and most complex verticals.

In this atmosphere, GuardedNet had been particularly aggressive
in its partnership efforts, so the acquisition was not
unexpected, and will significantly shore up the competitive
positioning of both Micromuse and the well-pedigreed GuardedNet
team.

Does this signal the consolidation of SIM, particularly in light
of Cisco's acquisition of Protego Networks late last year? While
the answer remains to be seen, SIM's potential for complementing
network and systems management has long been noted.

SIM aggregates and correlates security event data from a number
of sources. As the market has matured, some SIM products have
been positioned as enterprise security management (ESM) systems
that can "close the loop" on security event management. This is
why HP has multiple partnerships here, and even IBM has a Tivoli
offering (though hardly on a par with ESM leaders).

Management vendors aren't the only ones with an interest in
SIM/ESM. Symantec continues to leverage its own management
assets to beef up its enterprise strategy. Protego's
functionality has become a cornerstone of Cisco's approach to
security management - but the company partners with leaders such
as netForensics when additional depth in SIM/ESM is required.

One of the more interesting security management partnerships is
between EMC and SenSage. SenSage is differentiated by its
ability to correlate meaningful data from a large body of
unstructured information. Today, SenSage uses this capability in
security analytics. Its technology could, however, become
valuable to EMC in managing massive amounts of data, which could
play a role in EMC's forward-looking approach to information
lifecycle management.

With so many potential suitors, why haven't we seen more
consolidation in SIM/ESM already? For one thing, leaders are
still able to maintain competitive positioning - but also, the
products are still maturing. The integration and correlation of
multiple information sources is demanding enough, but security
threats are constantly evolving, and their management poses some
of the greatest challenges in IT. Some management tools may not
yet be fully ready to integrate with ESM, since the nature of
security event management can be outside the scope of what they
can presently embrace.

Interest in SIM/ESM remains high, fueled in part by the
increasing demands of regulatory compliance. Emerging trends
such as service-oriented architectures also play a role, since
SOAs will need centralized management of security issues
originating from a number of sources. In this atmosphere, I
doubt that any SIM/ESM vendor is going to want the $16.2 million
paid for GuardedNet to set the bar for an exit.

Still, the evolution of the SIM market would seem to place
considerable pressure on players to align with strength to
maintain an edge, suggesting that consolidation will eventually
play a larger role in the market.

But when - and with whom?

RELATED EDITORIAL LINKS

Users bank on managed security services
Network World, 07/11/05
http://www.networkworld.com/nlnsm3225

Citrix streamlines apps management pack
Network World, 07/11/05
http://www.networkworld.com/news/2005/071105-citrix.html?rl

All eyes on security management
Network World, 07/11/05
http://www.networkworld.com/news/2005/071105-sim.html?rl
_______________________________________________________________
To contact:

Scott Crawford, CISSP, is a Senior Analyst focused on IT
security, systems and application management with Enterprise
Management Associates in Boulder, Colo., an analyst and market
research firm focusing exclusively on all aspects of enterprise
management systems and services. The former information security
chief for the International Data Centre of the Comprehensive
Nuclear-Test-Ban Treaty Organization in Vienna, Austria, Crawford
has also been a systems professional with the University
Corporation for Atmospheric Research as well as Emerson, HP,
and other organizations in both public and private sectors.
He can be reached at mailto:scrawford@enterprisemanagement.com
_______________________________________________________________
This newsletter is sponsored by Oracle
Automate Business Processes and Improve Efficiency

Fragmented data, disparate applications, lack of automation, and
a disconnected supply chain slow you down and cost you money.
You need to respond more quickly to change, connect more closely
with partners and customers, and squeeze more value out of
existing resources. Oracle's industry-acclaimed Business
Integration Solution is built on the industry's most complete,
J2EE- and open-standards-based integration infrastructure. Learn
more by clicking here!
http://www.fattail.com/redir/redirect.asp?CID=107501
_______________________________________________________________
ARCHIVE LINKS

Archive of the Network/Systems Management newsletter:
http://www.networkworld.com/newsletters/nsm/index.html

Management Research Center:
http://www.networkworld.com/topics/management.html
_______________________________________________________________
FEATURED READER RESOURCE
TEN WAYS TO STOP SPYWARE

You will get spam down to a manageable level this year, but then
spyware will kick in. Spyware cleaners will help, but won't
eradicate all the unwanted activity at the office, at home.
Here's a ten step guide you can follow to curb the spyware
problem:
<http://www.networkworld.com/nlnsm3140>
_______________________________________________________________
May We Send You a Free Print Subscription?
You've got the technology snapshot of your choice delivered
at your fingertips each day. Now, extend your knowledge by
receiving 51 FREE issues to our print publication. Apply
today at http://www.subscribenw.com/nl2

International subscribers click here:
http://nww1.com/go/circ_promo.html

_______________________________________________________________
SUBSCRIPTION SERVICES

To subscribe or unsubscribe to any Network World e-mail
newsletters, go to:
<http://www.nwwsubscribe.com/Changes.aspx>

To change your e-mail address, go to:
<http://www.nwwsubscribe.com/ChangeMail.aspx>

Subscription questions? Contact Customer Service by replying to
this message.

This message was sent to: networking.world@gmail.com
Please use this address when modifying your subscription.
_______________________________________________________________

Have editorial comments? Write Jeff Caruso, Newsletter Editor,
at: <mailto:jcaruso@nww.com>

Inquiries to: NL Customer Service, Network World, Inc., 118
Turnpike Road, Southborough, MA 01772

For advertising information, write Kevin Normandeau, V.P. of
Online Development, at: <mailto:sponsorships@nwfusion.com>

Copyright Network World, Inc., 2005