Very promising networks

By NATALIE ROBB AND ERIC ZINES
Network World, 01/25/99

Firms of all sizes are warming to the idea of implementing virtual private networks (VPN) to augment their wide-area services. Those that go with a VPN service report all is well, for the most part; in fact, VPN users tend to be more content than users of other WAN services. Users who roll their own VPNs are generally not quite as happy as those who go with a service provider, but they report positive results overall.

While it's still early in the VPN game, the results of the first TeleChoice VPN Market Report, sponsored by Network World, paint a promising picture of the future for the technology. Nearly 20% of the 501 readers surveyed said they have some type of VPN in place, and another 35% said they plan to implement one by the spring of next year.

The study also makes clear that some user fears about VPNs are unfounded. Early users report their VPNs are relatively easy to manage and that service providers have likewise been easy to work with. The biggest user concern about VPNs? It's no longer security, although that's a close second; maintaining good performance weighs heaviest on user minds.

The survey was structured so respondents could provide useful information regardless of whether they were implementing a VPN. We garnered general data from all 501 respondents, representing a cross-section of industries and business sizes. Detailed follow-up interviews were conducted with 45 of those who reported they were currently using VPNs or planned to in the near future. The experiences of the early adopters provide valuable lessons for others to follow.

We define VPNs as private networks that exist in a public network environment, often the Internet. This definition includes networks that users implement themselves and offerings from service providers.

Twenty percent of respondents have bought into the VPN idea; this represents impressive progress for a new technology. It's difficult to pinpoint exactly when the VPN market was born, but few could argue that the technologies and products were viable and available for mass consumption more than two years ago. By way of comparison, the frame relay services market, which was officially born in 1991, was scarcely measurable until 1994.

These findings, however, do not indicate 20% of companies use VPNs exclusively. Many companies, especially larger ones, have begun to implement VPNs in addition to their legacy network services. Some companies are in the pilot phase of VPN adoption and are merely testing one or more options. Pilot VPNs are often used to address a particular requirement, such as remote access, telecommuting, connecting new offices or extranet connectivity.

Early VPN adopters, at least among survey respondents, include high-tech firms; providers of business services, such as management consulting and advertising; and entertainment, printing and publishing companies. Manufacturing and banking industries also stand out as leaders in VPN deployment because of the clear benefits of combining the security of VPNs with the openness of the Internet. One surprising finding was that the insurance and real estate industries, usually conservative in adopting new technologies, are among those moving to VPNs.

The industries that emerged as laggards are health care, education, wholesale trade and transportation, although they were at least represented among VPN user respondents. In fact, every industry appeared to have VPN users.

Overall, VPN adoption appears to be a mile wide across industries but an inch deep into the overall market for WAN offerings. TeleChoice interprets this as evidence that a growing audience of customers sees the value of VPN services and that the VPN market is beginning its journey toward maturity.

Satisfied customers

Net managers who subscribe to all types of WAN services are a content group overall. Some are even happy, but few are overly critical of their WAN services or service providers.

For the sake of comparison, TeleChoice classified survey respondents into three groups, depending on the mix of services they use: traditional WAN services only (69% of respondents); traditional WAN services and VPNs (24%); and VPNs only (6%). Respondents were asked to rate their levels of satisfaction with their particular WAN offerings on a five-point scale ranging from "very satisfied" to "very dissatisfied." We found that users employing only traditional WAN services are not as satisfied as VPN users.

About half of the VPN users subscribe to a fully managed service from a carrier, and about half are do-it-yourselfers who built their own VPNs by adding security software to products such as firewalls and routers.

Customers with fully managed VPNs are more satisfied than do-it-yourselfers. On the same 1 to 5 scale, the average satisfaction score was 3.5 for those who chose a VPN service, but only 3.1 for those who went it alone. Interestingly, just over 15% of the do-it-yourselfers were very dissatisfied, the highest percentage of unhappy users for any service category.

TeleChoice attributes this negativity to the frustrations involved with implementing a VPN without fully understanding limitations and requirements. In defense of the do-it-yourselfers, they were most likely to be very satisfied than other users - call it "pride of authorship."

The findings also show that customers aren't exactly displeased with legacy offerings. So in order to get users to migrate, vendors will have to prove VPNs can perform at least as well as legacy technologies while providing additional benefits, such as cost savings, ease of use and better geographic coverage. Survey respondents agree with that premise; more than half of VPN users say their primary reason for moving to a VPN was cost.

Expectations met or exceeded

The perceptions of non-VPN users definitely contrast with the experiences of VPN users, which should serve to calm the anxieties of those considering a VPN. Of those responding companies using a VPN, 40% say VPN management is "very easy" vs. just 3% that say it is "very difficult." Similarly, 71% find it very easy to add users, none say it's very difficult and only 5% say it's "difficult." As for working with service providers, half of the respondents report it is "very easy".

Probably because early adopters are tomorrow's marquis customers, respondents report they are treated with kid gloves by their service providers. Fifty percent of respondents say they are very satisfied, and 42% report being satisfied with their service providers. We asked the satisfaction question three times, in three different ways, and all garnered equally positive responses. TeleChoice doesn't take this is as a sign of things to come; we don't believe this picture will remain so rosy as VPN adoption occurs at an increasing rate.

In terms of expectations vs. reality, 60% say management of their VPNs is about what they expected. An additional 26% report management is easier than expected, and only 14% thought it was more difficult. If you're considering a VPN, the message is: Management is not as hard as you might expect.

As for how users feel about specific carriers, it's a bit early in the game to say with any confidence because most providers have too few users to garner meaningful statistics; the only exception is MCI WorldCom. Combined, more than half of those who say they're using VPN services can be lumped in the MCI WorldCom camp. The reason for this is twofold: Thanks to the acquisitions of CompuServe, GridNet, and ANS, WorldCom has collected a large installed base of VPN users; additionally, MCI and UUNET bring a number of both do-it-yourself and managed VPN customers to the table. So the combined MCI WorldCom clearly has the early advantage.

Seventy percent of WorldCom customers say they are "very satisfied" with the service, and another 20% say they are "satisfied," for an impressive 90% total. MCI didn't fare as well, with just 77% of users reporting they're satisfied or very satisfied. (However, the survey was conducted while Cable & Wireless was in the process of acquiring MCI's Internet assets, including some of its VPN business; that may have skewed results.)

While generally optimistic, VPN users still report challenges. Two-thirds of respondents say setup was the most difficult VPN issue. Service providers apparently are not properly preparing users as to how long a VPN installation will take and often miss installation deadlines. Nor are providers communicating with customers as much as they should during installation. Setup in general is just not user-friendly. Most respondents think it ought to, and can be, much less painful.

About one-third of respondents report that getting end users trained is a challenge and a constant process. Other challenges mentioned are directory management, hardware reliability, anticipating growth and maintaining a consistent and balanced traffic load. The services seem generally reliable, however; only one user complained about a prolonged service disruption.

Next-generation VPN services

An important goal of the TeleChoice VPN Market Report was to discover which features users think are most important in evaluating VPNs and what they want to see in future offerings.

One of the most interesting findings was that when asked to rate the importance of particular VPN features and characteristics, users rank performance slightly ahead of security, although they deem both to be very important.

This adds weight to the argument that the focus in the VPN market is slowly shifting away from security in favor of performance. This is particularly true among those who rate their familiarity with VPN technologies and products as "high." Those who understand VPNs are gaining confidence in security products and realize that performance is the next big battle. Security is a concern, and there's a great deal to be worked out in terms of implementing scalable, standards-based security, but it must be done without sacrificing performance.

There's also a great deal of debate as to the importance of service-level agreements (SLA). Some respondents claim VPNs must carry SLAs that are as stringent as those offered with traditional data services. Others say they don't even consider SLAs when making purchase decisions.

The survey results show that users do want SLAs offered with VPNs, with 86% of respondents rating SLAs as "important" or "very important." A financial institution says, "Since SLAs are so important to us, we would really like to be able to monitor the SLA for our VPN service ourselves."

Although not ranked as highly as the features above, users indicate they would like to see usage-based pricing options in VPN services. This feature was listed as "important" or "very important" by 65% of respondents.

Another surprise is that users are not terribly concerned about support for legacy LAN protocols in VPN environments. The study asked about AppleTalk and IPX, and neither were considered to be "very important" by a significant number of respondents. In fact, 75% of respondents rated AppleTalk support as either "of little importance" or "not needed" in a VPN. Responses about IPX were distributed more evenly among the choices, indicating users will accept services that do not support IPX, but providers will find a niche for VPN services that do.

In the final analysis, users are much more concerned about high-level attributes, such as performance, security and usability, and less concerned about the nitty-gritty technologies and protocols that may underlie those features.

Outsource or in-house?

The survey also attempted to gauge user interest in outsourcing certain management and administrative aspects of their VPNs to a service provider. Although attitudes toward outsourcing varied according to organization size, overall respondents were not thrilled at the prospect of outsourcing any aspect of their VPNs. This was particularly true of end-user authentication and administration.

Users were asked to rate their willingness to outsource each function based on a five-point scale ranging from "not at all willing" to "very willing." The results show there is a strong aversion to outsourcing anything that touches end users. Respondents who were using VPNs even reacted negatively to outsourcing remote access. This may seem surprising, considering that saving on remote access charges has been a cornerstone of VPN service marketing. But the issue again returns to the level of user familiarity; the more knowledgeable respondents were with VPNs, the more attracted they were to the outsourcing option.

Respondents in general - those who may or may not be using VPNs - were somewhat less negative toward outsourcing management of security functions and VPN customer premises equipment, two staples of managed VPN offerings. This response reflects the complexity of providing security in Internet environments and the lack of qualified security personnel.

The findings also underscore the need for continued education efforts in the VPN market. Net managers who have outsourced their VPNs to service providers report few problems and high levels of satisfaction. And in many cases, it's easy to prove that outsourcing network management is less expensive than providing this service in-house. Clearly, VPN service providers have a great deal of work to do in convincing IT managers that outsourcing is a winning proposition.

The next new kid on the block

Which service providers will VPN newcomers use? Respondents favor traditional interexchange carriers (IXC) by at least 3 to 1 over RBOCs or ISPs. IXCs have the majority of mind share when it comes to implementing WAN services, including VPNs.

However, one-third of respondents don't know, or couldn't specify, which provider they would use. This is hardly surprising given that survey respondents confess to be relatively unfamiliarity with VPN technology, products and services.

If you decide there is a VPN service in your future, the results of the TeleChoice VPN Market Report show you are likely to be happy with that decision. The results also indicate it's important to take the time to educate yourself on the technology, define exactly what you need and understand exactly what will be delivered. Pay particular attention to the details of the VPN setup and be vigilant with your service provider. Demand to know what you can expect and to be kept informed.

Service providers, do you hear that? Work toward improving the VPN installation process before the stampede.