supporting second tier OSes

Steve Smaha (Smaha@DOCKMASTER.NCSC.MIL)
Wed, 6 Sep 95 11:19 EDT 

Re: SGI

I'd like to talk about commercial product support for niche operating
systems from the point of view of economics, not wish-fulfillment or
R&D.  My company, Haystack Labs in Austin, has been shipping commercial
audit trail analysis software (aka "intrusion detection systems") since
12/93, so we've thought about this some.

1.  There are 15-20 hardware vendors currently shipping their own
versions of Unix, including niche and European vendors.  Most hardware
vendors moved to Unix because it was cheaper to buy some source code
from ATT (or borrow it from UC/B) than to develop a full proprietary OS,
and it generated the marketing illusion of openness.  (Anyone who has
looked at Unix audit trails will understand why I say "illusion".)

The most recent Dataquest workstation market share numbers for 1994
look like this:
    Sun: 36.2%
    HP:  19.8%
    IBM: 12.9%
    DEC: 10.7%
    SGI:  5.9%
    Others: 14.5%

Servers looked a bit different, with a very large presence by NCR, and
none for SGI.  That clipping is at the bottom of a big pile somewhere.
I know it's 1994 data, but it's still useful.

2.  In addition, there are definite patterns about which vendors'
machines are in sites that buy security tools.  As a matter of practical
experience, we have found that IBM sites are frequently more
security-conscious than are Sun sites, and are MUCH more likely to
actually have a budget for security.  Sun sites are more likely
to use freeware code from the Internet.  And Internet-attached sites
are the least security-conscious.  ("After all, we have a firewall!")

3.  Microsoft Windows NT will have a HUGE impact next year.  If you want
to know how big, think about all those over-caffeinated marketeers
from Redmond who have nothing to do now that Windows 95 has shipped.

4.  Haystack Labs has about 11 employees, and we are breaking even while
introducing what is for most customers a brand new product category.
(This is the dreaded "missionary selling" problem.)  We sell software
products, and are not focussed on selling services like most of the
firewall consultants.  We have to allocate our limited resources toward 
the product development activities that most enhance the profitability 
and survivability of our company.

5.  Here's a little quiz.  Your company depends on sales of Unix
security software, rather like Haystack Labs.  Your company currently
supports IBM AIX and Sun (SunOS and Solaris and Trusted Solaris)
platforms, and you want to do some additional ports with your 
limited development and support resources.  Your customers and
prospects have identified the following new platforms as the main ones
for which they will pay money: {HP 9.X, NT, Novell 4.X}.  You have 2 
inquiries for SGI in your database of 1450 entries.

Questions:  Which would you do first?  Which would you do second?  
Would you do SGI?

Our answers for comparison:  HP 9.  NT.  Not unless a whole BUNCH of
people with checkbooks call soon and place firm orders.

Inevitable commercial reference:

Our Stalker software is installed in intelligence and military and
financial organizations in several countries.

If y'all know anyone looking to buy extremely high-quality security
monitoring and misuse detection software, ask them to give us a call
or send a message to our email responder: info@haystack.com.

Steve Smaha

Haystack Labs, Inc., 10713 RR620 North, Suite 521, Austin, TX 78726
512-918-3555 (voice), 512-918-1265 (fax), smaha@haystack.com