ITGRC: A Security Approach That's Not for Sale

By Alex Handy

May 13, 2008 —  (Page 1 of 3)
When Jonathan Penn, research director at Forrester, walked around April's RSA conference, he was appalled by what he saw. “The vendors are destroying what's a very useful approach by claiming for themselves. If you're not an ITGRC vendor, just shut up,” said Penn.

What angered him were the sheer number of products available at the security conference claiming to be tailor-made for Information Technology Governance, Risk and Compliance, or ITGRC. This approach to security, said Penn, cannot be bought in a box, though many vendors at RSA would have you believe otherwise.

“The message is just meaningless at this point,” said Penn of the marketing messages now seen around ITGRC. “They need to figure out how they fit into an ITGRC program, not just be an ITGRC product. The last thing security people need is to go worrying about products again. That's what got us into this mess in the first place. We end up with a lot of tools that are difficult to manage.”

Penn and his Forrester colleague Marc Othersen, senior analyst for security and risk management, have been working on a report about ITGRC in enterprises, and they've figured out a way to cut through all the marketing hype.

“The way we segment the market is, 'What, in essence, does the technology automate?' ” said Othersen, describing the pair's method for sorting the ITGRC wheat from the chaff.

“ITGRC is an incredibly valuable approach to security,” said Penn. “What I like about it is it's a good way to structure what IT does. But it's much more a practice than a product. The tools that manage things at a high level, those are the ITGRC products.”

An Immature Market
For Othersen, ITGRC products aren't even mature enough to be taking on the G in ITGRC. He said that ITGRC is still a young concept, and that the governance aspects of this approach to IT security are still far too new conceptually to have been effectively addressed in commercial products.

Related Search Term(s): Security

Share this link: http://www.sysmannews.com/link/32188