When managed security services make business sense

Organizations have to come up with strategies to deal with a constantly changing threat environment. Though everyone from C-level executives down to front line workers should have security in mind, that isn’t always practical, or even possible. Why not get someone else to do it for you? “A couple of weeks ago I got a phone call from the CEO of a company,” says Marc van Zadelhoff, director of marketing for IBM Internet Security Systems, in conversation with Telemanagement. “He wasn’t a customer of ours, but he was having a security crisis and was looking for help to remediate the crisis. When a CEO calls me up to talk about security, what have we come to?” The answer is simple enough: we are in a situation where the business relevance of an ICT security crisis can reach the highest possible level. Day-to-day operations can be in peril if an organization doesn’t have the internal technical resources to solve the problem. Marc van Zadelhoff, however, takes it one step further. “For me security should be seen as an enabler of change,” he says. “We try and bring security solutions and expertise to market so that people can think about security early in the process – this way they don’t have to patch holes afterwards.” Sounds reasonable enough, but a company like IBM has so many offerings, in such a range of areas, that it can be hard to mix-and-match what is right for an organization. IBM Internet Security Systems (ISS) offers Managed Security Services (MSS) and Security Enablement Services (SES). MSS has service level agreements (SLAs) that include “a $50,000 money-back warranty ensuring 100% accountable, reliable protection,” and a promise to reduce information security management costs by 55%. Overall, MSS offers a higher level of managed security for servers, firewalls, identity, and intrusion, whereas SES focuses on e-mail, web security, event logging and vulnerability management. “With a managed security service you do not want a lot of customization for rules exceptions and guest signatures,” says Greg Young, an Ottawa-based vice-president for Gartner Research. “Customization is not a profitable strategy – it makes more sense with a one-size-fits-all approach.” How do you know you’re a candidate? From Young’s perspective, the best candidates are those small- to mid-size organizations that have “horizontal” ICT environments – meaning their security requirements are not specialized or industry-specific. “Smaller organizations don’t have security staff and it is easier to put a monthly fee toward a managed service,” he says. “I don’t think it would work in dynamic, sensitive environments where you have your own staff looking after best-of-breed technologies, as in financial services and healthcare.” Here, some of IBM’s offerings do seem appealing. IBM says that the Proventia Web Application security capability, which fits into the company’s Express Multi-Function Security Bundle, will save a customer an average of 15 to 20 times their investment. IBM also has its ISS Virtual SOC Portal, a web-based management tool which provides a single interface to monitor the security of both managed and unmanaged security devices. Managed security gets flexible Young says there’s also a role for blended environments, where some security services are managed externally, while others are kept in-house. “You can outsource the monitoring but keep the actual security management inside. And you can have another firm implement and transfer the oversight to your own trained staff to take on the day-to-day chores like data loss prevention and network access control.” This strategy can make sense but – and here is where many organizations get caught – security can become a training and HR issue. It is not enough to have a few people who are trained in security, and then to leave it at that. “You can have security staff who are expert at the operating system level, but who aren’t keeping up with the changes,” says IBM’s van Zadelhoff. “The threats have shifted to the application level with things like SQL injection. That’s where the hackers are now, and a lot of the old security skill sets are no good for that.” The ability to change with the threat environment, and to have flexible offerings, can help organizations that have bigger issues to attend to – like running their business. “Our dynamic infrastructure model supports flexible ways to run a business,” says van Zadelhoff, “and from our perspective, offering security choice is offering flexibility.” But according to Young, the right choice might mean only outsourcing the simple stuff. “E-mail, anti-virus, these are great things to outsource,” he says. “Firewalls can be managed externally if you don’t have too dynamic an environment. And intrusion detection is in the middle – it depends on the organization. But you must be aware that you will pay for any customization, which limits returns.” Once a system is set up, however, service providers can offer neat tricks to adjust to how customers do business. “We have introduced a security offering where staff can toggle the service off or on,” says van Zadelhoff. “During the day staff can be in house to monitor security with firewalls, intrusion prevention, etc., but at night when they leave the building they can switch it to IBM, turn off the lights, and go home for the night.” Depending on the level of security offered, however, Young says it is often not as simple as that. Two companies in any given vertical will often have radically different processes, and it can be remarkable how different companies’ IT departments can be. He adds that third parties may be less vigilant than desired. “Third parties will always be less aggressive than you’ll be,” he says. “They will lean toward false negatives rather than false positives. A false positive always generates more angst, and you can always say there are bad guys out there.” Young says companies that scale easily are good candidates for managed security services, but when it comes to areas like data loss prevention it is often best to stay in house because an organization will inevitably see sensitive data in a “radically different form” than will the outsourcer. Security in the virtual cloud “This bleeds over into the whole cloud computing story,” Scott Crawford, managing research director at Enterprise Management Associates (EMA), tells Telemanagement. “The cloud providers should in theory be able to provide a higher level of security than one vendor can on their own.” But from Crawford’s perspective, security should now be baked in to any vendor’s products to such an extent that paying someone else specifically to manage security might be unnecessary. And as more and more computing will be done in the cloud, security will have to be a part of it anyway, albeit an unseen one. “You still have to ask yourself: Can a service provider do a better job than I do?” says Crawford. In effect, if an organization wants to have some ICT functions outsourced or managed externally, that’s fine, and security should be part of the deal. The big security market is increasingly defined by companies like Cupertino, CA-headquartered Trend Micro Inc, which sell cloud-based security services to virtualized data centres, which then offer managed environments for their enterprise customers. “Security vendors recognize the reality of where data centres are going,” says Crawford. “Virtualization is increasingly popular because it optimizes the IT investment. In this area it is the security start-ups that are more agile, but I expect more consolidation with those vendors with major enterprise portfolios like IBM and Oracle Corp.” Crawford represents a widespread consensus that the security market will consolidate, with smaller vendors getting bought up not only by enterprise players, but also by big network companies like Cisco Systems and Juniper Networks. These firms are becoming more application-centric and moving further into virtualized data centres. As well, security firms are drumming up business providing managed security services to those data centres that offer secure hosting services to enterprises. Canada isn’t immune to these changes, as was shown recently by Trend Micro’s purchase of Third Brigade, a privately-held security and in Ottawa that provides security solutions to virtualized environments. Crawford says that virtualized data centres can provide a more secure environment, but that “a virtualized environment will replicate much of what exists in a non-virtualized environment – including vulnerabilities.” Are some of your applications sitting in someone else’s data centre as part of a software-as-a-service offering? Is your e-mail in the “cloud”, and being held by your ISP or a web-based provider like Google Inc.? If so, like it or not, you have outsourced security, yet you may not have a good handle on whether the environment is virtualized, or what your rights are if there is a breach. “We have not seen targeted virtualization attacks yet in the wild,” says Crawford. However, he adds that the main virtualization vendors like VMware take the issue seriously, and have recognized the need to address security, as have smaller players. For example, two years ago VMware bought security firm Determina, which allowed it to embed intrusion prevention technologies, and late last year it also bought virtualization security firm Blue Lane Technologies. But smaller players like Third Brigade still abound. “A company like Third Brigade is part of a handful of start-ups that are specific to virtualization,” says Crawford. “Security vendors will still want to have a stake in this space.” In the end, however, they might get swallowed whole by larger players, who will then push their offering through a channel that re-sells managed security services. Trend Micro’s Smart Protection Network, for example, “a next generation cloud-client content security infrastructure,” can be delivered as a managed security service by its partners.

When managed security services make business sense

News | 05/27/2009 4:49 pm EDT

To keep reading, get a free trial.

Already a Subscriber?

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us