Since launching the world’s first firewall in 1993, Check Point Software Technologies has played a defining role in securing corporate IT systems around the world. The Israeli IT security software vendor’s products are now deployed by more than 100,000, including all Fortune 100 companies, and its technologies dominate the global markets for perimeter-based defences such as firewalls and virtual private networks (VPN).
However, as chief security officers (CSOs) know all too well, even the strongest firewalls are no longer proof against today’s increasingly sophisticated hackers and malware authors, nor are the external threats that they defend against necessarily those that pose the greatest risk to corporate IT assets. Consequently, for Check Point and its customers, relying solely on the firewall for their corporate wellbeing is no longer an option.
Indeed, although Check Point is still comfortably the gorilla of pure-play security software (with net profits last year of $281.1 million on revenue up 27% to $730.9 million), there has been a growing perception that the company is being forced to swim against the tide of the industry that it has done so much to create.
In terms of technological leadership, for instance, analysts such as the 451 Group note that Check Point’s core expertise may no longer be as relevant as it previously was. “The focus of enterprise security concern has shifted from the network perimeter to the network core, in which malicious insiders and stealthy data exfiltration tools operating behind the firewall are the bogeymen,” said a recent 451 Security Quarterly Report on Transaction Security.
This shift and expansion in the threat posed by IT vulnerabilities has already had a profound impact on the security industry – encouraging growth in IT security spending, which has produced a parallel proliferation of niche security technology vendors. This, in turn, has awoken the interest of major vendors such as Cisco, Microsoft, IBM, Symantec and EMC, who now see security as an essential requirement in their broader IT infrastructure portfolios – a requirement they have met by acquiring IT security specialists, including almost all of Check Point’s significant former competitors.
Between them, these two trends – the de-emphasis of perimeter defence and the delivery of corporate IT security as one element in a larger set of IT infrastructure services – have had the effect of making Check Point appear somewhat isolated: the last large-scale pure play in a world of infrastructure suite vendors and specialist start-ups.
However, according to Gil Shwed, the company’s co-founder and CEO, Check Point’s apparent isolation should not be mistaken for vulnerability. On the contrary, he says the combination of independence and size makes Check Point “probably the best placed to help customers with their problems”. In particular, he says, Check Point can help companies cope with the complexity when attempting to combat today’s myriad different IT threats, by pulling together defences composed of products from dozens of different vendors.
At Check Point’s recent European user event in Prague, Shwed argued that it is the complexity created by the growing trend toward multi-vendor solutions that is actually the biggest challenge facing corporate IT security professionals.
“The fact that there are now more than 700 companies out there shows that customers are buying lots of niche solutions from these different vendors,” says Shwed. But, he adds, the more point solutions they buy, the more cumbersome their IT defences are to manage – and the more ineffective they become.
Shwed lays the blame for this on vendors and customers in equal measure. Most of the former, he says, do little to enable their products to work in harmony with those of other vendors. But “most customers don’t have a clear, well-defined IT security architecture and strategy either. They may have a wish list. They may have expertise. But not a well-defined IT security architecture that says, this is how we’re going to organise our network, this is the security we’re going to enforce at every location and this is our road map that will guide us there in the next three years,” says Shwed.
Predictably, he wants customers to recognise the need for a more coherent and co-ordinated approach to IT security and, once they do, he wants them to come to Check Point for all of their security needs, and not just their perimeter defences.
On paper, at least, this is not the impractical proposition that it would have been a few years ago, when Check Point had done little to develop its expertise beyond the perimeter defence space. Since 2003, when the company entered the endpoint security space for the first time by acquiring Zone Labs for $256 million, broadening its technology base to create a one-stop shop for a unified IT security infrastructure has become a steadily more accelerating priority for Check Point.
It took a majority stake in Sofaware (a VPN and firewall appliance maker focused on the SME sector), before spending $586 million acquiring Protect Data to enter the data security market; and then a further $20 million on NFR Security, an intrusion prevention systems (IPS) specialist.
These acquisitions have since provided the foundations for Check Point’s single-agent EndPoint Security offering, and allowed the company to tick the boxes in customer wish lists covering all aspects of IT security, from network edge to core information assets – and to do so while also offering a single-unified set of management tools. Or at least, that’s the theory.
In practice, despite Shwed’s bullish claims for the depth and breadth of his company’s capabilities, there are still observers that wonder if Check Point’s single-vendor solution is genuinely more coherent than the defences that are “cobbled together” from the products of multiple vendors by skilled systems integrators and service providers.
Certainly, in the company’s own recent admission that it continues to survey the market in search of suitable acquisitions (particularly in the critical area of enterprise security information management) there is evidence that Check Point’s ambition to be all, or at least almost all, things to all people has still to be fully realised. Nevertheless, with plenty of smaller acquisition prospects to choose from, and with $1.2 billion in cash in the bank, it may not be a lot longer before it is.
Further reading
IT security is a futile pursuit says IBM There is no future in the security business, says new head of IBM Internet Security Systems
The China security threat The threat that
Find more stories in the Security & Continuity Briefing Room
