<PAGE>


                                                                    EXHIBIT 31.2

                    CERTIFICATION OF CHIEF FINANCIAL OFFICER

I, Richard Macchia, Senior Vice President and Chief Financial Officer of
Internet Security Systems, Inc., certify that:

    1. I have reviewed this annual report on Form 10-K of Internet Security
Systems, Inc. (the "Registrant"), as amended by this Form 10-K/A;

    2. Based on my knowledge, this annual report does not contain any untrue
statement of a material fact or omit to state a material fact necessary to make
the statements made, in light of the circumstances under which such statements
were made, not misleading with respect to the period covered by this annual
report;

    3. Based on my knowledge, the financial statements, and other financial
information included in this annual report, fairly present in all material
respects the financial condition, results of operations and cash flows of the
Registrant as of, and for, the periods presented in this annual report;

    4. The Registrant's other certifying officer and I am responsible for
establishing and maintaining disclosure controls and procedures (as defined in
Exchange Act Rules 13a-15(e) and 15d-15(e)) and internal control over financial
reporting (as defined in Exchange Act Rules 13a-15(f) and 15d-15(f)) for the
Registrant and have:

        a. designed such disclosure controls and procedures, or caused such
    disclosure controls and procedures to be designed under our supervision, to
    ensure that material information relating to the Registrant, including its
    consolidated subsidiaries, is made known to us by others within those
    entities, particularly during the period in which this annual report is
    being prepared;

        b. designed such internal control over financial reporting, or caused
    such internal control over financial reporting to be designed under our
    supervision, to provide reasonable assurance regarding the reliability of
    financial reporting and the preparation of financial statements for external
    purposes in accordance with generally accepted accounting principles;

        c. evaluated the effectiveness of the Registrant's disclosure controls
    and procedures presented in this annual report our conclusions about the
    effectiveness of the disclosure controls and procedures, as of the end of
    the period covered by this annual report based on such evaluation; and

        d. disclosed in this annual report any change in the Registrant's
    internal control over financial reporting that occurred during Registrant's
    fourth quarter of fiscal 2004 that has materially affected, or is reasonably
    likely to materially affect, the Registrant's internal control over
    financial reporting; and

5. The Registrant's other certifying officer and I have disclosed, based on our
most recent evaluation of internal control over financial reporting, to
Registrant's auditors and the audit committee of the Registrant's board of
directors (or persons performing the equivalent functions):

        a. all significant deficiencies and material weaknesses in the design or
    operation of internal control over financial reporting which are reasonably
    likely to adversely affect the Registrant's ability to record, process,
    summarize and report financial information; and

        b. any fraud, whether or not material, that involves management or other
    employees who have a significant role in the Registrant's internal control
    over financial reporting.


                             /s/ RICHARD MACCHIA
                             --------------------------------------------------
                             Richard Macchia
                             Senior Vice President Finance and Administration
                             and Chief Financial Officer

March 24, 2005