In my rather long career in product development, I have asked myself many times what would have made my products successful in the market. I reached the conclusion that the features and extensibility of the product itself are not enough, especially in the modern world that is highly connected and globally social.

This is particularly true for a security platform supporting customers in their daily fight against cybercrime. What it is needed is a broader set of elements, within which the product is an important part — but not the only part.

What Goes Into a Successful Security Platform?

A successful security platform requires three distinctive elements:

1. A robust and flexible enabler (e.g., a security development platform);
2. A set of out-of-the-box security applications for the most common needs; and
3. An open ecosystem for customers and partners to nurture the development of new values.

The first element, the security development platform, is the foundational component. It either has to be simple to install or should be available as a service in the cloud. It should be inherently secure so developers can focus on the functionality and value that the application delivers without being distracted by other concerns.

The second element, out-of-the-box security applications, is a key component to the initial success of the security platform. In fact, it’s a wonderful foundation since not solving any real-life problems would be useless for the customers. At least the hygienic needs must be fulfilled, but it will be much better if innovative applications were available, as well.

While the first two elements are relatively normal, the last one is somewhat new and could represent the secret sauce for success. For this reason, it probably deserves a deeper dive to understand what an open ecosystem needs to organically grow.

The developers of new values, who will leverage the capability and extensibility of the security development platform to invent new applications for all needs that are not covered by available apps, are the key element of the open ecosystem. Those individuals should be the most disparate. They should range from ISV professional coders to IT security operators to make the ecosystem healthy and sufficiently heterogeneous.

To attract these segments of people, the ecosystem must have an entry point accessible to everybody, which implies clarity and simplicity in developing solutions on the platform.

Enabling the Most Effective Security Activities

To understand what tools are needed to nurture the ecosystem, it may help to know what the key activities are that the aforementioned individuals would like to carry on. Typically, they will:

1. Need to learn the security development environment, read tutorials, study examples and refer to reference manuals and expert tips to get the most out of it;
2. Ask questions to expert developers so that they can share best practices and explain what is already available. The questions may highlight needs that exhort others to come up with a solution that will fulfill them;
3. Optionally develop collaborative solutions that are too big for a single contributor or that require multidisciplinary knowledge; and
4. Share the security solution outcome, possibly for a fee, in a place where others will go to find them. It should be rated by the community of users and become an eminent contributor to the ecosystem.

How BigFix Can Help

I believe our IBM BigFix team understands the importance of this holistic approach and is delivering it.

BigFix has a set of websites that support the typical flow that will help achieve the activities tied to the four parts of the ecosystem. Both a rookie and an expert developer can go to developer.bigfix.com and learn how to extend BigFix. If any doubts remain, they can ask the community on the forums.

That site is also very good for sharing ideas for enhancements and understanding what may be good applications to build. The outcome of the development work can be shared in bigfix.me. Moreover, a supporting area is available on Github to work collaboratively on bigger projects.

If anyone happens to attend InterConnect 2016 and is interested in discussing this topic more, there will be a dedicated presentation in which UC Berkeley, RES Software and IBM will go over the details and share their experiences using this platform. The session is titled “How Users and Partners Grow the BigFix Ecosystem With Custom Applications.”