<PAGE>


                                                                    EXHIBIT 31.2

                    CERTIFICATION OF CHIEF FINANCIAL OFFICER

I, Richard Macchia, Vice President and Chief Financial Officer of Internet
Security Systems, Inc., certify that:

     1. I have reviewed this annual report on Form 10-K of Internet Security
Systems, Inc. (the "Registrant");

    2. Based on my knowledge, this annual report does not contain any untrue
statement of a material fact or omit to state a material fact necessary to make
the statements made, in light of the circumstances under which such statements
were made, not misleading with respect to the period covered by this annual
report;

    3. Based on my knowledge, the financial statements, and other financial
information included in this annual report, fairly present in all material
respects the financial condition, results of operations and cash flows of the
Registrant as of, and for, the periods presented in this annual report;

    4. Registrant's other certifying officer and I am responsible for
establishing and maintaining disclosure controls and procedures (as defined in
Exchange Act Rules 13a-15(e) and 15d-15(e)) and internal control over financial
reporting (as defined in Exchange Act Rules 13a-15(f) and 15(d)-15(f) for the
Registrant and have:

          a. designed such disclosure controls and procedures , or caused such
     disclosure controls and procedures to be designed under our supervision, to
     ensure that material information relating to the Registrant, including its
     consolidated subsidiaries, is made known to us by others within those
     entities, particularly during the period in which this annual report is
     being prepared;

          b. designed such internal control over financial reporting, or caused
     such internal control over financial reporting to be designed under our
     supervision, to provide reasonable assurance regarding the reliability of
     financial reporting and the preparation of financial statements for
     external purposes in accordance with generally accepted accounting
     principles;

          c. evaluated the effectiveness of the Registrant's disclosure controls
     and procedures and presented in this annual report our conclusions about
     the effectiveness of the disclosure controls and procedures, as of the end
     of the period covered by this annual report based on such evaluation; and

          d. disclosed in this annual report any change in the Registrant's
     internal control over financial reporting that occurred during Registrant's
     fourth quarter of fiscal 2004 that has materially affected, or is
     reasonably likely to materially affect, the Registrant's internal control
     over financial reporting; and

    5. The Registrant's other certifying officer and I have disclosed, based on
our most recent evaluation of internal control over financial reporting, to
Registrant's auditors and the audit committee of the Registrant's board of
directors (or persons performing the equivalent functions):

          a. all significant deficiencies and material weaknesses in the design
     or operation of internal control over financial reporting which are
     reasonably likely to adversely affect the Registrant's ability to record,
     process, summarize and report financial information; and

          b. any fraud, whether or not material, that involves management or
     other employees who have a significant role in Registrant's internal
     control over financial reporting.


                                /s/ RICHARD MACCHIA
                                -----------------------------------------------
                                Richard Macchia
                                Senior Vice President Finance and Administration
                                and Chief Financial Officer

March 16, 2005