What's the Endpoint of Endpoint Security?

Are security trends anything more than spin?

By Scott Berinato

May 26, 2006 — CSO —

If youve ever watched youth soccer, you instantly understand the term swarm ball. In many ways, security marketing isnt so different from youth soccer. Vendors swarm toward the ballthe jargon that will resonate with buyersand then have a mad battle to control it, only to have the ball squirt out in another direction, whereupon they all swarm that way. Recently, the ball was compliance solutions, until the swarm caught up and jarred that around, and eventually it kicked out to where the vendors swarm now: endpoint security.

From the perspective of journalists who get dozens of pitches a day (or is it thousands?), the onset of the term endpoint security felt almost coordinated, as if a memo about some focus group results was distributed late one night, and the next morning, all the vendors had effortlessly injected endpoint security into their spiels. Of course, defining the term was harder than just using it. When we asked, we got as many definitions as answers. In one case, a VP of marketing gave two definitions. Presumably, when with customers, he uses the one thats more likely to extract money from that mark. (The mark: Thats you, the buyer of endpoint security solutions.)

At a ballpark level, endpoint security seems to mean security related to PCs and laptops, points at the end of a network. But some vendors suggested that it could encompass some security appliances at the server level too. Others added cell phones and BlackBerrys to the mix, and USB dongles. Those are endpoints too, right? But they want a modifier to encompass all this, so here comes dynamic endpoint security. Stu, the vendor sales and marketing guy, would say, Yes, Mr. CISO, lots of companies do endpoint security, but do they do dynamic endpoint security like us?

Now come some companies using the term to describe policy enforced against client devices, defining what those devices can and cannot do on the network. In some cases, these products intervene with the endpoints to prevent transactions. In other words, its not about securing endpoints, but rather securing your network from the endpoints. Endpoint security, then, becomes a less offensive substitute term for surveillance and behavior monitoring and control. Or, if you will, its a compliance solution. But compliance solutions are soooo 2005.

OK, but generally, we can say that endpoint security refers to security around clients, right? Not so fast, fella. As this is being written, a PR pitch arrives in the old inbox for On Demand Endpoint Clientless Security. Um, what?

It appears the swarm has caught up to this one too.

Deconstructing Jargon

• Print