But I am reminded that it’s not just the titillating stuff that’s of interest. CA is still one of the Big 4 and up until a couple of years ago making headlines with some major and strategic purchases in our space – such as buying Concord for its e-Health software in 2005 and Wily Technology in 2006.

I recently ran across a 451 Group report, “CA: ghosts of deals past” by Brenon Daly (if you haven’t read one of his takes on the M&A market, you don’t know what you’re missing) that showed quantitatively just how much the acquisitions had slowed down.

2003 – 4

2004 – 3

2005 – 6

2006 – 6

2007 – 0

2008 – 0 (so far)

Two or three years ago (I still have the slide in our presentations), it seemed like you couldn’t go a month or two without hearing about the latest acquisition by the Big 4 – to either fill gaps in their monolithic portfolios or take out a growing threat, which had built some good technology. This should sound very familiar to anyone (like me) who rubbed up against WorldCom. Growth (in revenue and technology) by acquisition. Buy your own revenue and don’t worry about the niggling details like integration.

But we’ve certainly seen the acquisition trend slow across the board. HP, after its mega-purchase of Mercury Interactive in 2005 for $4.5 billion, for example, went relatively silent on the acquisition front in our space. Perhaps, as it turns out, because they were too busy preparing for the even bigger purchase of EDS for $13.9 billion (and the layoffs, 24,600 and counting, which in this worsening economy are probably just starting).

Can HP-EDS put its money where its mouth is? EDS profit margin, pre-acquisition, was under 6%. The former EDS CEO, now heading the combined outsourcing unit, expects to leverage HP automation tools to cut costs and improve that margin.

But Rod Bourgeois, an analyst at Sanford Bernstein says, “It’s not like HP has automation tools that weren’t at EDS’s disposal before.”

But this brings up a good point. EDS and 140,000 new bodies notwithstanding, HP seems to be positioning itself to do a big automation push in the marketplace.

Of course this makes sense – we’ve talked before about what a critical role automation is going to have in managing the rapidly evolving “dynamic” data center. Technologies like virtualization and cloud computing needs are pushing out the limits of real-time resources management in the data center; management tools must perform faster, integrate with more solutions across the spectrum of IT infrastructure and be smart enough to do much of this on their own.

Denise Dubie of Network World shares her top 3 reasons to get excited about management technology, particularly network and systems management. She discusses that innovative technologies often require superior management to meet high demands, as well as the benefits of saved time, reduced costs, and streamlined applications.

An Infoworld blog cites some very interesting numbers around the needs driving green computing. Datacenters total estimated energy bill will be $11.5billion in 2010, up 34% from 2007. This reflects a 16% increase in installed server base – wonder how much this projection takes virtualization adoption into account?

Dave’s friend and network security e-pundit, Alan Shimmel writes about his un-interoperability experience at Interop this year. As part of InteropNet, the multi-vendor project all about interoperability, we of course had a different opinion. Different perspectives are a good thing.

HP announced its intention to buy EDS this week for $13.9 billion. There was a lot of talk about HP positioning itself better to take on IBM in the technology services space, but more interesting to us was what such a deal means to Microsoft. Given the combined Microsoft-buying/bought power of HP and EDS, will the new HP have the power to push Microsoft around?

ShareThis

Security consulting operations come in the standard small, medium and large sizes. Small shops are less than 30 consultants, medium 31-200, large 201+.

Small shops: Sometimes known as boutique firms or lifestyle firms (since the people that run them take jobs when they want and only when they want) can be excellent resources within their specialities. Typically these are 1-5 person shops that are fairly niche focused, maybe they specialize in Web Application Security, secure development, or PCI audits.

Advantages: If you are using them in an engagement that is their speciality you are going to get a lot of bang for your buck. Prices are generally in line with normally hourly rates but try to get them to make a fixed cost bid. Most of the smaller shops are terrible at estimating and you have a lot of leeway once you get them in to push a little scope creep on them, all within reason of course. Don’t forget these people have to eat and they might not have another gig lined up after yours.

Disadvantages: Scheduling and resources. Small shops can easily get stretched. They can generally only handle 1 or 2 engagements at the same time. If they are a lifestyle shop they like to take long vacations. If you need a time sensitive service, like incident response or forensics, it might be better to go with a larger shop or at least have a backup plan if your small shop is not available.

Medium Shops: In my opinion the medium shops are the best balance between flexibility, resources and mailability. They typically employ at least 3-4 people for any given service they are offering so you get some decent coverage. Quality stays fairly high top to bottom. They will employ junior people but they are not likely to send them out solo.

Advantages: Good flexibility, reasonable prices and good access to people resources.

Disadvantages: Increasingly are becoming part of traditional VAR shops so they might be prone to push product on you. Can still run into resource issues if something big comes. Also are prone to the bait-and-switch where they pitch the rockstar and the new kid shows up to do the actual work.

Large Shops: Have hundreds if not thousands of consultants and a bill rate to match. Incredible appetite for large and lengthy engagements. I did time at EDS and let me tell you they are pretty evil, at least when I worked there. We would get a long term contract, then hire the cheapest talent we could find. They would then proceed to screw things up and cause other problems and we would then point out that fixing those problems was outside the scope of the contract! Cha-ching!

Advantages: No one gets fired for going with IBM, EDS or PWC. You will have a lot of people show up day 1.

Disadvantages: Masters of the bait-and-switch, the business model they run practically make it a requirement. Not usually the home of subject matter experts. All those people that show up day 1 need a place to sit.

Who are you favorite security consultants and why?

Post from: Grumpy Security Guy

Security Consultant Hacks: Size Matters

The fifth edition of the Silver Bullet Security Podcast features Ed Felten, Professor of Computer Science and Public Affairs at Princeton University and the Director of the Center for Information Technology Policy. Gary and Ed take a look at Ed’s predictions for 2006 and how he’s faring so far and then discuss Ed’s relationship with his former adversaries. They also talk about how to discuss difficult technology issues with lawmakers and the importance of public policy and the law to computer scientists. Ed also outlines the challenges of raising a bright 11-year-old.

• A partial transcript of the interview in IEEE Security & Privacy
• Freedom to Tinker - Ed Felten’s blog
• Ed’s Predictions for 2006
• Wikipedia: Series of Tubes
• Subscribe to IEEE Security & Privacy