At IBM Internet Security System's, the company's primary security research organization is called X-Force. Kris Lamb, director of X-Force, says his group is charged with knowing where potential threats will arise and deliver product, services and education to customers about how to stay ahead of the risk. Recently Lamb discussed with Network World Senior Editor Denise Dubie what he sees as the most critical challenges and opportunities facing enterprise IT security managers today.

Tell me a bit about your role as director of X-Force at IBM Internet Security Systems.

We are the thought leaders for our customers and the company around applied security technology, the security landscape, threat forecasting, creation of new technology solutions that we may bring to market in the form of new products or new service offerings. We also provide the content delivery services for all of our products that we currently sell, such as antivirus updates or IPS updates or content filtering updates are delivered out of the X-Force organization. We also have a consulting portion of X-Force that delivers security consulting services to our clients. All told X-Force is a sizeable organization made up of a lot of research and development disciplines that are centered on security expertise.

What are some major trends or changes in the security industry X-Force is currently tracking?

Over the last 12 to 18 months or so, we've seen the hard right turn of the criminal underground shifting from a notoriety-driven motivation to a very highly-organized financially-driven motivation. Money is really driving what they do. All of the security vulnerabilities or exploits or computers they control represent real dollars to them given the activities they are using these resources for. Before it was about notoriety, it was about being seen or noticed, or getting a lot of press coverage by Web site defacements and denial of service attacks that were very public. Now the criminals don't want to be detected because when they are detected they lose control of the computing resources and they are not able to engage in the criminal activities such as computer bot exploitation or malware spreading or phishing recruitment runs. They lose those assets or the ability to conduct those activities and that means they are losing money. The criminal underground is now engaging in very shrewd, very guarded sets of activities.