By Joris Evers
Friday, June 23 2006 11:20 AM
URL: http://www.zdnetasia.com/news/security/0,39044215,39369984,00.htm

Microsoft's security ambitions do not stop with the consumer. The company also has an eye on the multibillion-dollar enterprise security market.

Now that it is launched the Windows Live OneCare security service for consumers, Microsoft is ramping up its efforts to convince businesses that it is the solution to, not the source of, their security woes. The Redmond, Wash., company last week unveiled Forefront, a single brand that encompasses updated and upcoming security products aimed at businesses.

The moves are part of Microsoft's attempt to expand its business and tap new revenue sources, analysts said. Last year, security software sales hit US$12 billion, according to research firm IDC. On the enterprise side, Yankee Group expects the Windows client security software market to grow to US$3.6 billion this year.

"They are in it for the money, of course," said Andrew Jaquith, an analyst at Yankee Group. "Microsoft initially was very mysterious about its security plans. But its steady drumbeat of announcements over the last months shows intent to be a very broad enterprise security player."

Under the Forefront plan, the brand-new Microsoft Client Protection product, now in development, will be sold as Forefront Client Security for PCs and servers. In addition, updates of Antigen for Exchange and Antigen for SharePoint will also carry the Forefront tag, Microsoft said. Antigen for Instant Messaging and the ISA Server firewall and Web caching software are also in the Forefront group.

"We're going to provide a comprehensive set of security technologies for businesses that is integrated with their existing infrastructure, with an emphasis on the deployment, management and ongoing usability," said Steve Brown, the director of product management in the security, access and solutions division at Microsoft.

As far as motivation goes, Microsoft sees its entry into the security fray as a "very broad opportunity" for itself and for its customers, Brown said. "The primary reason we're doing this is that there is clearly a customer need for this approach," he said.

Companies such as McAfee, Symantec, Trend Micro and Computer Associates have long demonstrated that there's money to be made in protecting Windows systems. For Microsoft, it's simpler to create security add-ons than to build security into its products, an approach that would also make it harder for the company to make extra money, at least one analyst said.

"This is a rather safe play," said Charles Kolodgy, an analyst at IDC. "It is easier than building the security into products and not being able to directly capture revenue. And if their security product line doesn't work, they can leave the market."

Microsoft has gradually built up its security muscle in recent years through numerous acquisitions. It bought antivirus specialist GeCAD, anti-spyware maker Giant Company Software and Sybari Software, maker of the Antigen products. Its lineup also includes hosted e-mail security services, picked up through the takeover of FrontBridge Technologies.

Most recently, the company gobbled up Whale Communications, a specialist in secure remote access and Web application firewalls. Last October, it announced it would sell security software for business PCs and servers. The new product, now called Forefront Client Security, is due for release in the second quarter of next year.

In catch-up mode
While it's bound to attract some business for its new products right away, Microsoft has some work to do to become a formidable competitor in the security area. That's especially true when it comes to enterprise client security, analysts said.

"They will get some market share just for being Microsoft," Burton Group analyst Dan Blum said. "To take a majority position, they need to establish a product that is functionally on

Turning lemons into lemonade

par with, or pretty close to, the likes of McAfee and Symantec," he said, adding that this likely will not happen until 2008 or 2009.

Symantec, which provides a range of products aimed at protecting corporate networks and systems, said Thursday that it is ready for any competition from Microsoft.

"With a level playing field, all the vendors in the security space will compete for mind share, based on what enterprise customers believe to be the best product to suit their needs," a representative of the security software maker said. "Symantec has been the leading provider of effective protection against viruses and other malicious threats for more than 15 years."

The main obstacle facing Microsoft is customer distrust. "There are certain customers that don't trust them because of their previous track record," Yankee Group's Jaquith said.

The software maker has invested heavily in security over the past years. Despite this, most malicious software targets Microsoft products, and the company still deals with lots of security holes. Last week, for example, it issued 12 security bulletins with fixes for 21 vulnerabilities--the largest number ever for its monthly "Patch Tuesday" updates.

"You're in one camp or another with them," Jaquith said. Either businesses are very loyal customers and are rooting for Microsoft, or they feel they were burned by the company and simply don't trust it, he said.

And there are those who feel the software giant is trying to turn lemons into lemonade with its move into the security fray.

"The idea of Microsoft coming up with antivirus software is a sham," said Frank Seichal of Old Bridge, N.J., who works in IT at a financial institution. "Why should I purchase software from Microsoft to stop the operating system vulnerabilities created by Microsoft? I can not believe Microsoft is getting away with this."

Another factor to overcome are the high-quality products sold by incumbent security vendors. McAfee, for example, has earned high marks from its customers with the ePolicy Orchestrator, a central security management tool, Jaquith said.

"Microsoft needs to prove reliability, stability and predictability. They need some success stories," Jaquith said. "Just saying that they're better integrated and that they make the operating system is not going to cut it."

In its Forefront documentation, Microsoft promises products that work well together and with existing IT systems. Additionally, the software will be simple to install and can be centrally managed, it says. However, they will protect only Microsoft software and not Linux servers or SAP applications, for example.

"That is perhaps their greatest disadvantage," Blum said. "They tend to have this somewhat myopic strategy centered around their own products and ignoring other products, even those that run on Windows."

Rivals and regulators
Antitrust concerns also lurk. Microsoft may promote Forefront products as better integrated, but if it has used hooks into its operating system that are kept secret from rivals, regulators might be all over the software giant, analysts said.

In fact, some small Microsoft competitors are already complaining about the company's security pricing strategy. In a blog posting this week, Alex Eckelberry, president of Clearwater, Fla.-based anti-spyware toolmaker Sunbelt Software, said Microsoft is engaging in predatory pricing with its OneCare and Antigen products.

By undercutting its rivals on price, Microsoft is pushing the competition out of business, after which it will increase its prices, Eckelberry wrote.

Jaquith dismissed that complaint. "I think they are being creative and aggressive, but I don't think they are being predatory. There is plenty of room for pricing innovation in this space," he said.

It was about time that Microsoft fleshed out its security strategy and shared it with the public, Jaquith said. "Finally we're hearing what they are doing," he said. "It is a 'damn the torpedoes, full speed ahead' strategy."