Posted by John Burnham in In the Industry, Security Intelligence, SIEM

Last week, 6/20 – 6/24/11, was the annual Gartner Security Summit in Washington DC. This is always an excellent event, as it is heavily weighted to end user customers.

Unlike industry trade shows which have largely become business development events for vendors, at the Gartner Summits we can interact all day – everyday, with a broad customer base, each of whom is there to discuss and learn more about IT security solutions, best practices, trends, and maybe best of all the opportunity to do some peer group sharing. And of course, all of the Gartner analysts are there, relative to security that is, and some Gartner folks responsible for corporate management, some of whom I had not seen in quite a while. All in all, a great event.

Below is a combination of my observations and experiences, as well as some third party comments from the investment community, in particular Todd Weller from Stifel Nicolaus. The data referenced is taken from Gartner presentations.

First, as Joseph Feiman told us a year ago, Enterprise Security Intelligence would become a pervasive and eventually over-arching theme at all Gartner Security events, and it was certainly the case here. Contextual information, which then becomes actionable intelligence, is the goal of Security Intelligence as we and Gartner define it. It was so pervasive that one end user customer even remarked to me that “context” is clearly the word of the day at Gartner!

Some highlights (the underlining/bold is mine):

• Security Information and Event Management (SIEM) remained a hot topic at the Gartner conference and was indicated to represent a foundation behind Gartner’s ESI concept.

• We had a chance to catch up with Q1 Labs management at the conference. We walked away from the conversation feeling that market demand for SIEM remains solid and that Q1 continues to experience solid momentum in its business.

• Security products and services markets expected to increase from $55 billion to over $71 billion by 2014.

• The enterprise security infrastructure market is expected to be $22.5 billion in 2011 and from 2009-2014 the expected CAGR is 11%. The security service market is expected to be $33 billion in 2011 and from 2009-2014 the expected CAGR is 8%.

• Security is one of the top concern areas and represents the number 1 topic inquiry for Gartner representing 17% of all its inquiries.

Security market numbers:  (Note- if you add software only and appliance, SIEM clearly dominates the growth parameter)

• 2011 growth estimates for various enterprise security infrastructure market segments (Y/Y):

–Appliance: E-mail Security Boundary: 28.6%

–Appliance: Secure Web Gateway: 22.8%

–Appliance: Security Information & Event Management: 22.4%

–Security Information & Event Management: 22.4%

–Secure Web Gateway: 17.3%

–IPS Equipment: 16.1%

–Other Security Software: 15.7%

–SSL VPN Equipment: 15.5%

–E-mail Security Boundary: 12.8%

–User Provisioning: 8.4%

–VPN/Firewall Equipment: 6.6%

–Endpoint Protection Platform (Enterprise): 3.8%

–Web Access Management: 3.2%

• Security spending priorities for 2011 based on a Gartner survey:

–Data Loss Prevention: 54%

–User Provisioning or Identity Management: 51%

–Security Information and Event Management: 44%

–Network Access Control: 40%

–Intrusion Detection and Prevention (mostly driven by PCI): 39%

–Vulnerability Assessment: 39%

–Patch Management: 38%

–Application Security (mobile devices and web application firewalls): 34%

–Antivirus: 34%

Security Intelligence:

• existing security is made up of silos of security disciplines (identity and access management, endpoint protection platforms, network security, application security) and silos of monitors and scanners within each discipline. There is limited interaction, integration and correlation. Also limited context, history, and linear search.

• Gartner believes that in the existing approach enterprises can’t see the forest for the trees. Enterprise Security Intelligence (ESI) was indicated to be not a new market but a new paradigm that recognizes security intelligence as an explicit deliverable and designates it as a strategic objective for enterprises’ IT security and risk management.

• Gartner pointed to Security Information & Event Management as an important component of ESI as it enables the storing and querying of collected information. We call SIEM the “anchor tenant” of Security intelligence.

On SIEM in particular:

• Gartner pointed to a key issue of SIEM being “the big data problem.” The issue relates to many SIEM solutions using a single data store to support real time collection/monitoring and historical analysis. The issue is that event/log collection needs to support high insert rates in real time whereas historical analysis requires heavy indexing and high volume read activity. In short, Gartner indicated that these two are at odds with each other and that SIEM vendors need to extend their architectures to better support the disparate requirements.  (Gartner knows that QRadar SIOS in fact uses both data store architectures.)

• Enterprise Security Intelligence (ESI) is about optimal decisions and technology interaction through information integration and correlation. SIEM is a foundation technology for ESI as it aggregates, normalizes, and monitors security events.

• As far as SIEM vendors, the Gartner analyst provided some insights into every vendor in the quadrant which was a lot. As far as the leaders quadrant, we thought the comments that stood out the most were positive comments related to HP/ArcSight and Q1 Labs and the lack of mention of EMC/RSA until near the end of the presentation. We believe this validates that EMC/RSA continues to experience some challenges in the SIEM space.

So, an excellent event for anyone trying to measure the impact of Security Intelligence on the market, as well as to test the role of SIEM in the overall IT security landscape.