Commodity Security Levels: Gold, Platinum, or Inimitable

If you are going to be a commodity, may I suggest Gold, or Platinum. Or, better yet, inimitable.

Standing before 100+ information security leaders at a conference and pointing out that every single on of them, myself included, are commodity resources is going to get attention. Wait! What did he just say! I’m a “commodity”? Yes. Yes you are! If we left our jobs tomorrow, business would just go find another “firewall admin”, “proxy admin”, or “[insert security control here] admin”.

Oh, and if you are a contractor who is charging by the hour, you are not only a commodity, but an amateur as well. At least that’s the way the business is looking at you. Because everyone who understands value knows that even lawyers and accountants, who are masters at hourly billing, operate contrary to the value needs of those they serve. They are incentivized to take 10 steps to do something when it could better be done in two. The real business IT professionals are the ones who are getting approved directly by the person with all the budget authority so as to not be overridden by anyone. And those are most definitely not quoting hourly rates, but rather outcomes that they are signing up to achieve.

It’s True: IT Really Doesn’t Matter

As soon as you can after reading this, please go and check out the paper IT Doesn’t Matter. It’s from Harvard Business Review and is old enough (from 2003) that they make it freely available from their web site. I just wouldn’t waste time trying to find the PDF version, as that’s only available behind their paywall. No matter, what you need is really there.

What’s amazing about this paper is that it was written in 2003 and really painted THE picture and vision for the shift to the cloud. And yes, this includes cloud security. For in it the author makes the clearest of cases that

“What makes a resource truly strategic—what gives it the capacity to be the basis for a sustained competitive advantage—is not ubiquity but scarcity.”

So are you reading this? He’s saying that there should be less IT to be competitive, not more. That’s certainly something to think about the next time you want to add another something to that already large stack of security appliances, right?

My “IT Doesn’t Matter” Top 10

And that’s not all! I’m not going to do a book report, summary, or essay of the paper. There’s no need to. It speaks perfectly well for itself and should be required reading for anyone in IT today as it is, from students to the very top executives. But, here are the top 10 quotes from the HBR paper that just resonate so well with where we are all at right now.

  1. “But as their availability increased and their cost decreased—as they became ubiquitous—they became commodity inputs.From a strategic standpoint, they became invisible; they no longer mattered. That is exactly what is happening to information technology today, and the implications for corporate IT management are profound.”
  2. “Infrastructural technologies, in contrast, offer far more value when shared than when used in isolation.”
  3. “But, for the broader economy, the value produced by such an arrangement would be trivial compared with the value that would be produced by building an open rail network connecting many companies and many buyers. The characteristics and economics of infrastructural technologies, whether railroads or telegraph lines or power generators, make it inevitable that they will be broadly shared—that they will become part of the general business infrastructure.”
  4. “Here, too, a company that sees what’s coming can gain a step on myopic rivals.”
  5. “The trap that executives often fall into, however, is assuming that opportunities for advantage will be available indefinitely. In actuality, the window for gaining advantage from an infrastructural technology is open only briefly.”
  6. “As many experts have pointed out, the overinvestment in information technology in the 1990s echoes the overinvestment in railroads in the 1860s. In both cases, companies and individuals, dazzled by the seemingly unlimited commercial possibilities of the technologies, threw large quantities of money away on half-baked businesses and products. Even worse, the flood of capital led to enormous overcapacity, devastating entire industries.”
  7. “By the end of the buildout phase, the opportunities for individual advantage are largely gone. The rush to invest leads to more competition, greater capacity, and falling prices, making the technology broadly accessible and affordable. At the same time, the buildout forces users to adopt universal technical standards, rendering proprietary systems obsolete. Even the way the technology is used begins to become standardized, as best practices come to be widely understood and emulated. Often, in fact, the best practices end up being built into the infrastructure itself; after electrification, for example, all new factories were constructed with many well-distributed power outlets. Both the technology and its modes of use become, in effect, commoditized. The only meaningful advantage most companies can hope to gain from an infrastructural technology after its buildout is a cost advantage—and even that tends to be very hard to sustain.”
  8. “IT is, first of all, a transport mechanism—it carries digital information just as railroads carry goods and power grids carry electricity.And like any transport mechanism, it is far more valuable when shared than when used in isolation.”
  9. “But history shows that the power of an infrastructural technology to transform industries always diminishes as its buildout nears completion.”
  10. “Studies show that the companies with the biggest IT investments rarely post the best financial results. As the commoditization of IT continues, the penalties for wasteful spending will only grow larger. It is getting much harder to achieve a competitive advantage through an IT investment, but it is getting much easier to put your business at a cost disadvantage. IT management should, frankly, become boring. The key to success, for the vast majority of companies, is no longer to seek advantage aggressively but to manage costs and risks meticulously. If, like many executives, you’ve begun to take a more defensive posture toward IT in the last two years, spending more frugally and thinking more pragmatically, you’re already on the right course. The challenge will be to maintain that discipline when the business cycle strengthens and the chorus of hype about IT’s strategic value rises anew.”

But What Type of Commodity are YOU?

When you have your performance reviews and such, there’s a pretty good chance you get the feedback as to where people view your level of value. As a commodity, you may be anywhere from bronze to platinum. That being said, I would say there’s a completely different level, which is “Inimitable”. The definition of this word is that it is incapable of being imitated or copied. As the musical Hamilton says following their use of this word, “I am an original!”.

Spotting these high value resources is not too difficult. Quite often these are the deepest of thinkers. They are the ones who when everyone else is saying they need to increase their IT security budget, they make the best case as to why they need to actually be spending less. And then they show everyone else how to do it! Beyond this, they are the content creators (authors, bloggers…), always happy to share every golden nugget that they, or their peers, come up with. They embrace that the rising tide floats all boats and are relentless in pursuing the very outcomes that matter. And at the end of the day, they will be recognized not for the trends they followed, but rather those they either created or, at the very least, recognized straight away and took it the next level. The naysayers will put them down when they articulate and then try to sell everyone on an idea that may takes years to come to fruition; but it matters not to them, as they know they can get there, whether it be in their current role or one that someone else is eager to hand them.

%d bloggers like this: