Back to the IntraNet page

By Peggy Watt
IntraNet, 3/30/98

Lawyers are skittish when it comes to confidentiality, so the thought of reducing paper documents to electrons that would fly across an extranet understandably made litigation support firm The Cardomon Group a bit nervous. After all, the firm didn't want its legal papers cruising the same pipeline as cybersex or opposing counsel's e-mail.

To ease its apprehension, The Cardomon Group decided to develop its extranet using a toll road built just for its clients. The firm considered building this secluded electronic highway - commonly known as a virtual private network (VPN) - using its own equipment and hooking to the Internet. Instead, it opted to buy a VPN service from AT&T WorldNet, says Doug Mondo, president of the Santa Ana, Calif., company. Similar decisions are becoming increasingly common among IT managers struggling to cope with the complexities of letting remote users, business partners and other third parties enter the corporate Web. Buying a VPN service saves them the hassles associated with picking out, installing and maintaining the remote access servers, modem banks, firewalls, security software and links needed to build their own secure extranet.

VPN services work the same way as home-grown VPNs. Data packets are encrypted and encapsulated, then transmitted through a "tunnel'' on an IP network, often the Internet; authentication keys may be employed at each end. No other company's packets are allowed through a company's VPN tunnel.

In The Cardomon Group's case, information being tunneled across the Internet includes information from a repository containing deposition transcripts, exhibits for thousands of law firms and corporate legal departments, and other legal paperwork the company has been compiling for 12 years.

Obviously, it's essential that only authorized persons have access to the documents, and that those people are able to get to the documents at their convenience. "We don't say 'access' without saying 'secure' first,'' Mondo says.

The Cardomon Group manages its database and Web servers, as well as a router, at its Santa Ana headquarters. AT&T WorldNet handles administration for the rest of the extranet.

Besides AT&T WorldNet, large Internet service providers such as UUNET Technologies, Inc. and Netcom On-Line Communication Services, Inc. offer VPN services, as do carriers such as MCI Communications Corp. and GTE Communications Corp. Value-added network providers such as IBM, through its IBM Global Network, also play in this market.

Approximately one-quarter of the firms using VPN technology opt to outsource their VPNs to providers such as these, says Greg Howard, senior analyst for Infonetics Research, Inc., which is preparing a report called "User Plans for VPN Products & Services in 1998'' for release next month. The San Jose, Calif., market research firm estimates the worldwide VPN market was $205 million in 1997, and says that figure will grow to $12 billion by the year 2001.

Setting priorities, making choices

When choosing a VPN provider, users should consider their geographic distribution, necessary access speeds, expected help-desk needs and asset management. End-user billing provisions also must be factored in if the service is passed on to a customer, as is the case with The Cardomon Group.

Typically, when a company outsources its VPN operations, the service provider installs and manages all the equipment. San Diego-based ISP American Digital Network (ADN) even manages the local circuits for its customers, giving them a single point of contact so they don't have to waste time determining which provider to call when problems arise.

Because ADN has relationships with all the local telephone companies, the ISP can help customers identify the most reliable local connection, determine the best pricing and get better responses if there are problems, says Steve Wallace, vice president of engineering at ADN.

Concentric Network Corp., of Cupertino, Calif., will lease the onsite equipment, such as routers with tunneling software and firewalls. Then it will either maintain the hardware and software itself or will leave the administration to IT, says John Lawler, product line manager for VPNs at Concentric. A typical package includes a router or other internetworking device, Internet access, 24-7 support and T-1 lines, each attached to a security device such as firewall or encryption box.

"Most companies understand there's a need for security, but don't have the up-front money or a network administrator trained in security,'' Lawler says.

Harbinger Corp., of Atlanta, provides VPN services to its customers on an IP network that provides electronic data interchange and Web-based electronic commerce service. The company also works with customers to ensure VPN security for transmissions over the Internet. Extranet customers call Harbinger's modem banks and transmit encrypted data on the Internet through Technologic, Inc.'s Interceptor firewall at each end.

Harbinger, which partners with UUNET to provide Internet access to its extranet customers, encourages these customers to use the same ISP at different access points for greater security.

"Security and availability are our customers' biggest concerns,'' says Joe Minieri, network engineer at Harbinger.

As well it should be, Infonetics' Howard says. "Maintaining security is a job in itself because of the administration of passwords, digital signatures and software tokens,'' he explains.

If security is a particular anxiety, IT managers can seek out speciality VPN service providers such as Pilot Network Services, Inc., in Alameda, Calif. This ISP, for example, promotes industrial-strength security equipment and charges about $5,000 per month for its expertise.

Companies that want a routine VPN service might find Pilot's rates rather pricey. In general, monthly fees range from $2,000 to $3,000 per line, depending primarily on the transmission speed and levels of security.

That cost might pale in comparison to buying and, more significantly, maintaining VPN equipment. While there is a wide selection of firewalls, routers, modems and associated equipment available on the market and the prices are competitive, the expensive part may be training and keeping staff with the expertise to manage a VPN.

Reliability also should be high on an IT manager's VPN check list.

Most VPN providers offer a maximum, one-way transit delay of 150 msec, no matter how long the circuit. But an ISP with a sprawling network will have more points of presence and can deliver end-to-end service among a customer's sites without having to trust the capabilities of an "off-ramp'' ISP.

Some service providers, such as UUNET and Concentric, guarantee nearly 100% uptime, and offer rebates to customers who experience failures. ISP and other VPN providers, in fact, are starting to use such guarantees to tout their services.

However, unless a carrier owns every inch of the network - including a local connection usually handled by a telephone company, such guarantees are more marketing than fact, says Bob Betros, vice president of sales and marketing at ADN.

ADN assists its customers by monitoring traffic and equipment and working closely with customers on preventive measures. For example, the company urges clients to consider an often-overlooked threat: internal trespass. "Most of the time, people think of a hacker from outside. But that's the easiest to protect against. Disgruntled employees are a security risk,'' Betros says.

ADN raises this security issue especially when it discusses network administration. And it requires customers to develop an acceptable use policy. "We work together to ward off attacks,'' Betros says.

Room for growing extranets

The benefits of letting a service provider handle changing equipment needs attracted Digital Network Associates, Inc. to the idea of outsourcing its VPN. Digital Network Associates not only uses a VPN, but also provides VPN access to its home health care clients, says Ed Alldredge, vice president of operations for the Costa Mesa, Calif., company.

"We expect a somewhat spiraling growth rate over the next few years, and we didn't want to have to build and maintain a lot of modem banks, servers and firewalls,'' says Alldredge, who chose AT&T's WorldNet VPN service.

Digital Network Associates' clients dial into AT&T WorldNet and send confidential patient care data to a central office. This setup eliminates procedures involving paperwork and error-prone data-entry, Alldredge says.

Having a VPN service provider handle growth and new technical demands also appealed to American Fashion, Inc., which contracted with ADN to maintain a VPN on the Internet between its San Diego and New York offices, says Carl Schutte, MIS operation manager. With the tunnel comes reliable speed, and ADN maintains firewalls at both ends.

"Speed was our main reason. We aren't as concerned about security,'' Schutte says. "For a couple years, we had a frame relay circuit between the offices, at a 65K bit/sec port speed. Now, for about the same money, we have full T-1 and many more expansion opportunities.''

The reasons to outsource are increasing as fast as the number of service providers. Value-added integrators are entering the market, for example. They offer consulting services to identify needs, administration options, and equipment and carrier contracts.

Whether an IT department wants total relief or only some assistance for its network administrators, it's sure to find something it likes among the growing VPN services field.