[Note: I accidentally left this in my unpublished bin for a couple months. I can see why, as this is a bit unpolished and confusing, but I wanted to post up my thoughts on “data-close” and “data-distant” objects and how they relate to the changes in security and even IT consumption in general over the years.]

Last week I posted about Bruce Schneier’s latest essay on product suites and the course of security purchasing. I see Bejtlich has also posted, and has some really good comments going on it. Two thoughts kinda struck me.

First, Bejtlich says, “…what are the ‘crown jewels’? It’s the data, not the hardware and software.” Second (Bejtlich did not say this), trying to get an outsourcer to manage one’s security or even IT as a whole is a lot like Nicholas Carr likening IT to a utility like eletricity.

So can some utility provider manage a company’s data? I’d have to say I don’t think so, unless the company is such a cookie-cutter company that the data offers zero differentiation from its competitors.

From there, we can create this spectrum with data on one side and electricity on the other. Data, the applications that gather/hold/report the data, applications that interact with others to glue all that data together into something useful…on up to the very commoditized desktops systems, networking hardware, 1s and 0s on the wire, the electricity powering it, and the Internet access. I can describe this spectrum as “data-close” objects and “data-distant” objects.

I can also explain one aspect of the rise of web applications. Web applications can be pretty specific to a company, especially the internal apps. They are pretty “data-close.” Desktop systems are “data-distant.” The configuration or maintenance or even presence of a desktop machine is rather unimportant unless it needs a lot of fat applications to consume data. Since a web browser is in every OS (we’ll just assume this, since that’s really the case in any business endpoint system), we have now moved the data-consuming app closer to the data where it should be, leaving the guts of the desktop system to be “data-distant,” where it should be. Hard disk encryption continues this trend, since the hard disk is a bit more “data-close” than the rest of the desktop system.