|
“Customers no longer want to buy security on a piecemeal basis”
Geoff Haydon,
Vice President,
Asia Pacific, 
RSA
From the time when it was known largely for its authentication tokens, RSA has grown tremendously through research and acquisitions to become an all-encompassing security solutions provider. The company, which continues to operate as an independent entity, is giving additional impetus to parent EMC’s might as a formidable information management player. Geoff Haydon, VP for RSA’s Asia Pacific operations, talks to Sanjay Gupta, Sr. Associate Editor, Network Computing, about the company’s growth and the changing dynamics in the security space. Excerpts:
How has RSA been growing in the Asia Pacific region?
We have been growing year on year at over 60 percent, but in our recent quarter we have grown by more than 100 percent compared to the corresponding quarter last year. We have seen tremendous growth in all areas and also substantial increase in investments.
Has RSA’s focus broadened from large enterprises and niche verticals?
Traditionally our business was concentrated on very large, multinational accounts, predominantly in the financial, telecom, and public sector segments. But we have been expanding our business in more geographies, new verticals and smaller companies as well. For instance, the BPO vertical in India has emerged as one of our fastest market segments. Two of the fastest growing geographies for us in APAC, as you might expect, are India and China.
From the technology domain standpoint, where do you see more growth coming from?
We have been seeing a lot of traction in solutions for two-factor authentication, online fraud prevention, and online risk-based authentication services. We have also been witnessing high growth in our compliance-based solutions and services.
Do you think there’s a trend amongst enterprises away from buying point solutions to taking a more holistic approach to security?
That’s interesting. Over the past few years, we’ve transformed our business entirely. So a few years ago we were a leading provider of authentication solutions for employees, as SecurID represented over 90 percent of our worldwide revenue. But today, RSA is a leading provider of information risk management solutions. So three years ago, we recognized that customers no longer wanted to buy security on a piecemeal basis. So apart from investment in R&D, we acquired a number of companies to bring a complete portfolio of security solutions to our customers. A lot of this transformation has been driven by demands from our customers. They don’t want point solutions from many vendors and don’t want to manage a large number of vendor relationships for security. Even RSA’s acquisition by EMC a year-and-a-half ago was driven by customers who wanted a security component to the storage solutions offered by EMC.
How is the back-end integration between RSA and EMC going?
Today we are working very closely with EMC to integrate RSA’s security capabilities with some of EMC’s traditional core architectures – Clariion, Celerra, etc. There are about 150 engineering projects currently under way in that direction. Again, customer demand is driving our integration priorities.
How do you engage with your customers for their security needs? How do you convince them, say, to move from plain user name and password to two-factor authentication?
Today, a typical conversation with our customers doesn’t start with authentication or secure token or something like that. We talk to them about their business – what business initiatives are under way, revenue growth, cost reduction, business continuity, compliance, etc. Now underlying those initiatives is an IT project and information is an enabler for that. So we look at what sensitive information exists and understand where that information exists in context of the enterprise technology infrastructure. We also understand how that information needs to be classified from a risk perspective. So rather than jump right into authentication, we get into a conversation about the risk analysis. This further breaks down into several conversations about security policy, managing the security, authentication, and other implementation areas.
How does your security approach differ from other vendors?
The traditional approach of many security vendors has been to address perimeter security through firewalls, antivirus or VPNs, which is no longer sufficient. It’s our belief that a security initiative needs to include these three things: it has be information-sensitive, it needs to be risk-cognizant and, finally, it’s got to be repeatable.
|