In a 2014 interview with ITWorld Canada editor Shane Schick, new Symantec CEO Enrique Salem reflects on his career—from early work on the Norton product line, through founding and selling Brightmail, to leading the world’s largest security vendor. He emphasizes the need to run Symantec like a $6 billion startup, marrying the advantages of scale with the agility of a small company. Salem outlines Symantec’s focus on the full information lifecycle, stressing data categorization, retention policies, and recovery as core to security and storage integration. He addresses common concerns that hinder SaaS adoption—security, availability, latency, compliance, and vendor lock‑in—arguing that confidence in data protection can overcome these barriers. The conversation turns to Symantec’s advocacy for federal data‑breach notification legislation in the United States, promoting a “safe‑harbor” approach that rewards companies that implement strong safeguards. Finally, Salem discusses the evolving role of the Chief Information Security Officer, suggesting that as security becomes operationalized and integrated into business strategy, the CISO’s function will shift from a barrier to a strategic risk governance partner.
Chapters
Hi, I'm Shane Chick, editor-in-chief of ITWorld Canada. Whenever we canvass our readers about the issues that are important to them, security is always very near the top of the list. Earlier this year, the security industry experienced a sea change when John Thompson, the longtime CEO of Symantec Corporation, retired. His replacement, Enrique Salem, was one of the very first developers as part of the Norton product line. He later left to start up a company called Brightmail, which Symantec later acquired, and now he's running the world's largest security vendor. We welcomed Enrique to our offices in Toronto. So you're one of the first developers hired for the Norton product line, worked at Symantec for a number of years, and then moved away to work on more of an entrepreneurial opportunity with Brightmail, then came back to take on a much bigger role with a much bigger company once again. I wondered if you could talk about what you learned from running a company like Brightmail and how that's helping you in the transition to being Symantec's new CEO?
When you look at my experiences working at some of the largest companies in the world and contrast that with what I've learned at small companies, what comes through is size is an advantage, but you need to use it as an advantage. See, when you're a small company, you move very, very quickly. You're very agile. And so one of the things I like to say about Symantec is I want us to be, in some ways, a $6 billion startup. Right. I want us to have the agility of a small company but use the size of Symantec to be able to aggressively move into markets, to be able to go after customers in every geography around the world. So take the advantages of a big company and marry it with the agility and decision-making of a small company.
One of the things that's been more interesting to me over the last couple of years is the combination of security with storage, and obviously Symantec was one of the companies that led that with the acquisition of Veritas. Now there's other companies that have started to take on content management as a piece of that. And I wondered if you saw any opportunity for Symantec to also build in that content management functionality as part of the security and storage mix.
When you think about information, there's a complete lifecycle from the point it gets created to the point it gets deleted. And we work along that entire continuum. Now, we're not the application providers. A lot of third parties are in the creation of the data. But from the point of the creation of the data, we can take over and do most of the capabilities that are required. Now, One of the areas that's becoming increasingly important for our customers is the notion of how they categorize the information. What is it that matters? What information do they need to care about? Most companies will tell me that 10 to 15% of their data or information is what matters. And so that's what we're focused on. What are the policies around it? How long do you need to keep it? When can you delete it? If it gets lost, because it's a disaster or something else, how do you recover it? And so we're focused on those aspects of information. One of the areas that we're continuing to evolve our thinking in is the notion of categorization, because the better we can categorize it, the better we can help our customers to secure and manage it.
You've been a big supporter of software as a service, as a computing model for companies to adopt, but you know that there's a lot of organizations that are hesitant to give up the control around owning that data and managing that data. How do you help them through that from a security perspective and give them the assurance that they're going to need as they look at SaaS as a model?
If we look broadly, customers are going to want to run some of the software for a long time to come themselves in their data centers. But you have some customers who are saying there are advantages to using software as a service. Some of the advantages are they don't have to train their staff on having the knowledge and expertise to know how to use every product. They also don't have to build out the infrastructure to support those products. And so there's good reasons to go to a SaaS model. But there's 4 or 5 reasons that have been the barriers. One has been security. Second one has been concerns about availability. Will the systems be up and running, and will you get the same SLAs that you can in your own data center? A third point has been around latency. Will you have any way reduced or increased latency that will cause you problems in your environment. Other folks talk about compliance issues. Can I still enforce all of the different regulations that govern my business when I don't have full control of the systems? And then lastly, some vendors worry about getting locked into a service if they're not operating it themselves. So these have been some of the things that they've been concerned about. We think they're all things that can be overcome. From a security perspective, which has been one of the major concerns, What you have to do is make sure that you understand how are they managing and securing the data, because quite frankly, that's the asset that really matters. Whether you use a SaaS model for CRM or for message filtering, what you want to make sure is that your information, your data, is never compromised. If you can assure yourself or you have confidence in that, then SaaS is something that you can absolutely take advantage of. We are a security company, as you know, and we're very sensitive as we move to third parties working with us, because we have a number of hosted offerings ourselves, but we also use other hosted offerings. And we're very sensitive to not allowing our data to in any way be put at risk. And that's the same thing that any Chief Information Security Officer is going to be worried about.
Recently Symantec expressed its support for a piece of legislation in the United States that I'm not sure Canadians would be as aware of around data breach notification. Can you talk a little bit about why that was important and why Symantec felt it had to put its backing behind it?
When, when you look at a company like ours, we have to show leadership in helping the market move forward. And so we're very active on many fronts. In Washington, D.C., we spend time with regulators around what are some of the laws that we'd like them to pass. But we also spend time trying to help people understand where are the things that will make a difference to their environments. What are the opportunities for us to say, if we adopt a certain set of behaviors, a certain set of standards, a certain set of guidelines, that things will be better. And I'm going to give you a real clear example. In the United States and in parts of Europe and probably here soon in Canada, we'll see that there'll be data breach notification laws.
[Speaker:ENRIQUE SALEM] Yeah.
[Speaker:ERIC SCHMIDT] Now, we think that there needs to be federal legislation that handles data breach notification. But we also think that if companies take the appropriate safeguards, they should be able to be held to a set of standards, and we are pushing for the notion of a safe harbor. Because what we believe is if you take the appropriate steps to protect the information, then you should have a little bit more flexibility in what you need to disclose. And so that's just an example of where Symantec is going in and saying, how do we make sure to make sure that our customers understand and legislators understand what is the right way to look at technology. And so we've done a lot of work around standards and a lot of work around legislation.
And finally, one of the last things I wanted to explore with you, I covered a panel a number of years ago where a group of chief information security officers were talking about their role, and they talked about what you've mentioned around operationalizing security and making it less about being a barrier to business and helping it instead. He said that if they were doing their jobs right, eventually they would, in a sense, be working their way out of a job. That if we really operationalize security, we might not need Chief Information Security Officers anymore. Now that was at least 5 years ago, and obviously we still have those people around, but how do you see that role evolving based on what you're asking people to do in terms of operationalizing security?
Yeah, ultimately the, the role of the CISO has already started to change, and what's happened is Security needs to be everywhere, but I don't think CISOs need to be the people who have to run the security every day. And so they need to set the standards. They need to help quantify risk. They need to help the business leaders understand what are the risks that they're taking, and then make sure that that security can be operationalized. And so the role of the CISO is more about technology selection, setting guidelines, deciding what is the right level of risk for a company to take on or not. And so their roles have moved from being both the direction and operations to being more the strategy, vision, and direction. And I think that's where it'll continue to evolve. The notion that CISOs will go away, I think at this point, given the amount of information that's being created, given the amount and numbers of risks that businesses need to deal with, I think the role of the CISO becomes more important not less important, but they'll have less operational responsibilities and more decision-making and more power, quite frankly, over risk management inside of companies of all sizes.
