SALES: Who is your Target?

At EDS I'm very controversial. About 10 months ago, in front of the Security & Privacy Practices leadership, I declared that Identity Management is NOT a security initiative.

[Arms went up, voices raised, general mayhem.]

"I can do an entire IdM program without technology, and without any relevance to security" I further claimed ... and went on with this example:

"If I get, via a letter delivered via the postal service, updated information about an individual's employment status, and I trust the letter, and my job is Cellphone service management, then I'm going to take some action, such as deactivating the phone, and saving the company possibly thousands of dollars in cost."

They argued "isn't deactivating the phone a security item". Well, no, it's not. It's called ASSSET MANAGMENT, and is a business process.

All of IdM is about business process. Security, compliance, cost-savings, and user-experience are all residual benefits depending on what business process you're addressing. The main reason for IdM is to make an organization more efficient, and more accurate about their records. One drives down cost and improves user experience, the other avoids costly penalties from failed audits.

My main client, GM, recognized this fact and has intentionally distanced their IdM organization from the Security Office. Furthermore, they're aligning with the Business, not the IT organization. Jarrod Jasper illustrated this in his Burton Catalyst speech.

So then why are so many vendors and consulting firms still selling on security, regulatory compliance, and driving it from their security solutions group to the IT organization? Go talk directly to the business instead. Don't bring a SE, but a Finance guy instead. Your sales will do better because you've now sold the solution on IT's behalf.