<PAGE>

                                                                    EXHIBIT 31.2

                                  CERTIFICATION

I, Richard Macchia, certify that:

     1.   I have reviewed this quarterly report on Form 10-Q of Internet
          Security Systems, Inc.;

     2.   Based on my knowledge, this quarterly report does not contain any
          untrue statement of a material fact or omit to state a material fact
          necessary to make the statements made, in light of the circumstances
          under which such statements were made, not misleading with respect to
          the period covered by this quarterly report;

     3.   Based on my knowledge, the financial statements, and other financial
          information included in this quarterly report, fairly present in all
          material respects the financial condition, results of operations and
          cash flows of the registrant as of, and for, the periods presented in
          this quarterly report;

     4.   The registrant's other certifying officer and I are responsible for
          establishing and maintaining disclosure controls and procedures (as
          defined in Exchange Act Rules 13a-14 and 15d-14) for the registrant
          and we have:

               a) designed such disclosure controls and procedures, or caused
               such disclosure controls and procedures to be designed under our
               supervision, to ensure that material information relating to the
               registrant, including its consolidated subsidiaries, is made
               known to us by others within those entities, particularly during
               the period in which this quarterly report is being prepared;

               b) evaluated the effectiveness of the registrant's disclosure
               controls and procedures and presented in this report our
               conclusions about the effectiveness of the disclosure controls
               and procedures as of the end of the period covered by this report
               based on such evaluation; and

               c) disclosed in this quarterly report any change in the
               registrant's internal control over financial reporting that
               occurred during the registrant's most recent fiscal quarter that
               has materially affected, or is reasonably likely to materially
               affect, the registrant's internal control over financial
               reporting; and

     5.   The registrant's other certifying officers and I have disclosed, based
          on our most recent evaluation of internal control over financial
          reporting, to the registrant's auditors and the audit committee of
          registrant's board of directors (or persons performing the equivalent
          function):

               a) all significant deficiencies and material weaknesses in the
               design or operation of internal control over financial reporting
               which are reasonably likely to adversely affect the registrant's
               ability to record, process, summarize and report financial
               information; and

               b) any fraud, whether or not material, that involves management
               or other employees who have a significant role in the
               registrant's internal control over financial reporting; and

Date: November 5, 2003                /s/ Richard Macchia
                                      ----------------------------
                                      Richard Macchia
                                      Senior Vice President Finance and
                                      Administration and Chief Financial Officer