Safety First for Information Security Solutions Letter From the Editor 14 June 2002 According to Gartner surveys, information security budgets average between 3 percent and 5 percent of overall IT budgets; some industries' budgets vary outside this range. This doesn't include additional spending on information security by business units that choose to boost security beyond the protection offered by the central IS organization. Information security is not a discretionary purchase. It is as essential to the enterprise as the enterprise's mission and its employees' dedication. Purchasing security solutions is difficult, however, because information security technology is complex and ever-changing to meet a continual flood of threats. Such constant change can unnerve information security professionals who must scramble to keep up. Remaining apprised of what suppliers are offering in such an environment is daunting. Evaluating competing and complementary products and services is even more challenging. To help enterprises select information security solutions, we present various viewpoints on the information security marketplace and provide guidance on outsourcing some security functions. The Market, Vendors and Products Vic Wheatman segments the information security market in terms of products that work, those that don't and those that attain market share because they are "good enough" in "'Good Enough' Is Best for a Security Solution". John Pescatore, Bill Gassman, Arabella Hallawell and Richard Stiennon examine a new marketing relationship by two information security providers and consider the likely outcome of a partnership that may have broader long-term implications in "Security Vendors Will Reap Marketing Gain from Partnership". Ray Wagner looks at alternatives to a well-known product that is being withdrawn from the market in "Laptop/Disk Encryption in a World Without PGP". John Pescatore suggests that an open review of code, which Microsoft opposes, would create a more secure product in "Microsoft Sends Mixed Signals About Software Security". Outsourcing Options Richard Matlus and Bill Maurer caution enterprises to examine all of their IT outsourcing contracts (not just for information security) for vendor-supported security and business continuity features in "Add Security and Business Continuity to Sourcing Contract". Kelly Kavanagh, although targeting small and midsize businesses (SMBs), provides helpful advice for enterprises of all sizes that are considering outsourcing aspects of their information security programs in "Security for SMBs: The Outsourcing Option". Kristen Noakes-Fry and Patrick Worms focuses on the specific decision points for outsourcing firewall protection in "SMBs: Consider Outsourcing Your Firewall Protection". John Pescatore refines the outsourcing option and defines vendor selection guidelines in "Choosing a Managed Security Services Provider". Magic Quadrants John Pescatore, Kelly Kavanagh and Richard Stiennon present managed security service provider evaluations in "2H01 Managed Security Service Provider Magic Quadrant". Arabella Hallawell considers antivirus product and service quality as well as management functionality in "Enterprise Antivirus 2Q02 MQ: Room for Improvement". Vic Wheatman suggests that "pure-play" public-key infrastructure vendors have all but disappeared in "Public Key Infrastructure 1H02 Magic Quadrant". John Pescatore examines market consolidation and XML security standards in "Extranet Access Management 2H01 Magic Quadrant". As always, we welcome any questions you may have. Arabella Hallawell Editor in Chief Security and Privacy spotlight.feedback@gartner.com Vic Wheatman Editor in Chief Security and Privacy spotlight.feedback@gartner.com