The ROI of Freedom

As with all things security related, one of the primary challenges for NAC adoption is the proof of some sort of quantifiable ROI model.  While there are some "hard" elements out there (Brand Protection is certainly one; I haven't been in or even met an IT organization yet that wants its company's name in the papers), the real truth is that it's squishier than that.  After all, security is really about peace of mind, about enablement, about freedom.  Where's the ROI in that?  How do you quantify the ROI of playing catch with your kids in the yard instead of fighting yet another malware outbreak (or data breach, or outage, or whatever) at work?  There are likely some productivity gains you can point to, but no job is without its TPS Reports, so even that's a slippery hook on which to hang your hat.

In the end, and at its best, freedom is really what controlling network access should really be about.  It should be about enabling rather than disabling.  It should be about managing the risks of doing business on your network in recognition of the simple fact that your network exists to do your company's business.  It should be about empowering IT organizations to say "How," in recognition of the simple fact that they can't say "No."  We're analogy heavy here at Mirage, and analogies abound within the walls of the company, both for the NAC space generally and for our product specifically (most have to do with either poker or college football but that's a different blog entry).  A common analogy used by me and others has been that NAC (generally) and Mirage (specifically) are essentially the TSA of networks, ensuring safe network travel.

In many ways this fits.  People are going to fly (recent bankruptcies and flight cancellations notwithstanding), and do fly to the tune of some 2 million travelers in the air every day.  Moving that many people through the air has risks, both at a micro and macro level.  You manage the risks as best you can.  You find the best balance that you can between security of travel and doing of business. And that's really as good as it gets.  However, given the average grumbling from the average person in the average security line, no one really wants to associate himself/herself with TSA.  The analogy used at Oasis that I really liked is that we're the guys (er, I mean people) on the skydiving plane checking your chute before you jump.  We're not there to keep you from jumping out of the plane; we're there to see that you do it as safely as is possible.

At RSA, we introduced this notion in a new campaign.  Free your network.  Free your people. Free your business.  Free your world.  Leverage NAC to say How, so that you can quit trying to say No.  Let them jump, knowing that we've checked their chute and they're going to be fine.  Then go home and play with your kids.  Or on the Wii.  Or Dungeons and Dragons.  Whatever it is you do when you're not at work.