The World Wide World: IT Ain't Just the Web ... - Cdn.oreilly.com

John Thompson, Symantec: Architect of adjacency
John Thompson is a very methodical guy. When he came to Symantec nearly six
years ago, he says, “I had spent the last ten years fixing things.” That’s what he proceeded
to do at Symantec, but this time as CEO. “I found a company whose core
competence was shipping things in yellow boxes. It was a technology company optimized
around distribution.” Its business was also 60 percent consumer-based.
Starting not from scratch but with a successful $632-million-revenues business,
Thompson proceeded to remold it to reflect the industry around him – 65 percent
enterprise – and to shift its core back to security. “My question to the team was,
‘What is our strongest and most relevant technology?’ The answer was anti-virus.
The near adjacencies were content filtering and intrusion detection. Better yet, there
were no big players – no IBM, no Microsoft....Ifwe ran fast, we could be the
biggest dog in the pound.” (At least until recently!)
So the company shed everything else to focus on security. Thompson got a curve ball
of sorts in the last few years. The consumer business suddenly grew 50 percent a
quarter as consumers finally reacted to the virus threat and started buying antivirus
product in droves. That threw things off balance, though in a positive way.
But there was more to it than customer mix. “We did a postmortem after the ‘slammer’
worm and realized that it could have been stopped dead in its tracks if corporate
users had only patched their systems according to what they had been warned of
six months earlier. We realized that a lot of security isn’t just the tools; it’s how you
use them. So we bought Powerquest, with Windows imaging, provisioning and disaster
recovery tools, and On Technology, which provided key infrastructure-management
tools.”
More recently, the company’s pending acquisition of Veritas is in part a move to
redress the balance of the company towards the enterprise, and in part a way to
address problems that can’t be as easily solved as mere virus threats. “It’s also a
recognition that security isn’t just intrusion detection and exclusion; it’s the reliability
and integrity of what you have inside,” says Thompson.
He continues, “Security for the enterprise covers other issues such as inclusion
[identity management and provisioning] and compliance. Right now we don’t have
anything that focuses on compliance, Sarbanes-Oxley, Graham-Leach Bliley or other
regulatory initiatives. But technically, you can instantiate all those compliance rules
in our software, whether it requires an internal development or the integration of
some third-party capability.”
16 RELEASE 1.0 WWW.RELEASE1-0.COM