By Aaron Momin

Enterprise Rights Management (ERM) is a powerful and effective solution to applying persistent protection to electronic data through its lifecycle. Some folks get this, most folks don’t. And most folks don’t because they don’t understand the mechanics, opportunities and benefits of this powerful solution.

So how do you raise awareness to the business units to adopt ERM, and make a strong business case with a ROI to implement ERM? Consider this: in an effort to bolster Symantec’s new AntiVirus 2011 and Norton Internet Security 2011 product suite, Symantec uses the FUD factor in driving rapid adoption. See here:
http://itacidentityblog.com/symantec-uses-fear-uncertainty-and-doubt-to-sell-new-anti-virus-software-will-it-back-fire

http://techcrunch.com/2010/09/08/symantec-norton-cybercrime-report/

But is this the right or ethical approach in selling security products? Bruce Schneier wrote an excellent post on how to sell security, see here:
http://www.schneier.com/blog/archives/2008/05/how_to_sell_sec.html

I think when you read Schneier’s Post you’ll agree with his conclusion. Here is a snippet of it:

“Though effective, fear mongering is not very ethical. The better solution is not to sell security directly, but to include it as part of a more general product or service. Your car comes with safety and security features built in; they’re not sold separately. Same with your house. And it should be the same with computers and networks. Vendors need to build security into the products and services that customers actually want. CIOs should include security as an integral part of everything they budget for. Security shouldn’t be a separate policy for employees to follow but part of overall IT policy.”

I’d like to get your thoughts, ideas, and approaches on how to sell Enterprise Rights Management effectively to the Businesses.

Aaron is Founder & CISO of ForfendSecurity, with responsibility for all aspects of the Company’s business strategy and day-to-day operations. He has over 15 years of progressive information security & risk management experience in assisting and enabling clients in managing risk, improving security posture and implementations, integrating privacy, re-engineering processes and gaining efficiencies, and enhancing business processes by embedding security.