I think it’s incumbent upon both consultants and integrators to better educate the end users in regard to what are realistic expectations for their security systems. Ideally, this should be a cooperative effort (also requiring an end user that wants to be educated). Of course, the first prerequisite for this is that both need to educate themselves regarding what technology is available and what its capabilities and limitations are. In the best case scenario of a good consultant working with a good integrator, they can learn from each other and keep each other honest (“As iron sharpens iron, so one person sharpens another.” Prv. 27:17). That should lead to the best possible solution for the end user.
Here are the tough nuts to crack:
1.) How do you identify the “good” integrators and consultants? I think things like IPVM certification can definitely help with that. Even if it does not become widely recognized by the majority of end users outside of security professionals, (How many non-IT people know about MCITP or RCDD? How many non-AV people know about CTS-D?), it can still be very beneficial in regard to helping knowledgeable security professionals identify each other. A strong network of good, knowledgeable integrators and consultants can help mitigate the influence of the snake oil salesmen.
2.) How can you get manufacturers to stop filling end users’ heads with science fiction, (which enables both the foolish end user and the tricky integrator)? That’s a major uphill battle. I commend IPVM for taking it on, but don’t envy you for it. Ultimately, manufacturers are going to continue to make fanciful marketing claims as long as there is no significant downside to doing so (“downside” meaning lost profit). Calling them out is definitely a start. Testing/debunking them is also very beneficial as that enables that network of knowledgeable security professionals to confidently tell end users, “No, that’s marketing BS. It can’t do that.” (Of course, it doesn’t help when certain manufacturers have an almost cult-like following among a small but vocal group of integrators.)
Best (Realistic) Wishes,
The Masked Consultant