You and Don Guillot are right on when you note that constant innovation is the only way to stay ahead of commodification. But innovation alone is not sufficient - it must be directed at the right target.

In 'The Work of Nations', Robert Reich argued more than a decade ago that no industry would be exempt from the effects of the shift from high-volume (i.e., mass) production to high-value production (based on specialized knowledge and problem-solving) as the source of long-term profitability. This shift is at the heart of the mid-90's renewed emphasis on focusing one's core competence, which is the area where a company (or individual) possesses a distinctive competence that can provide the most value to a customer. Any activity -- including IT security -- that is not core, that does directly add to your company's bottom line, represents a cost center and a weight on its profitability, and your company should, and will, seek to reduce the cost of that activity to the lowest order possible. Even for software companies, their value is in providing an innovative solution that solves a particular customer problem, not in actually writing the code - if a developer in China can write the code for that solution with the same (or better) quality and timeliness, the software company can charge the same premium price for their solution but realize 2-3 times the profits.

Seeding FUD over the reliability of outsourced development and management only postpones the inevitable. Regardless of whether or not one agrees with Reich on the need for income redistribution to balance the effects of this fundamental shift, IT security professionals need to base their value on more than a priest-like knowledge of Linux toolkits and Perl scripting. These can all be automated and provided as a service -- including intelligible reports --for less than your salary. The IT and infosec professionals who survive and thrive in the future will be those who can really understand their company's core business and then formulate and champion ways to help IT actively support that core.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/184/22436#22436