As prices fall, managed security services entice enterprises looking to offload the tedious work of monitoring security systems
As prices fall, managed security services from such companies as SecureWorks and Perimeter eSecurity entice enterprises looking to offload the tedious work of monitoring intrusion-detection, intrusion-prevention and other security systems.
In 2001, Incyte Corp. found itself in a quandary: The company — known at the time as Incyte Genomics — centered on selling subscriptions of its genomic database encyclopedia to the biotech and pharmaceutical industries. As information about the human genome increasingly became part of the public domain, Incyte realized it soon could be left without its flagship product, says Roger Hoilman, vice president of IT at the Wilmington, Del.-based company. That meant Incyte had to find a way to reinvent itself. Incyte has since refocused its efforts on drug discovery, and transitioned into a pharmaceutical company.
This story is part of a special Security Trend Watch issue, in PDF format. Download now.
Restructuring IT was a big part of that effort. The company went from having 900 total employees and an IT staff of 275 people, to having 200 total employees and 10 IT professionals, Hoilman says. “There’s no way my staff can run everything 24/7/365, because we don’t have the time, and we don’t work in shifts. My strategy for keeping my head count down is to have a few people on staff who can wear many hats, and to co-manage or outsource anything I consider busy work,” he says. Among those tasks constituting busy work, he adds, was the continual monitoring of firewalls and intrusion-detection and -prevention (IDS/IPS) systems.
Cost and Complexity
Now Incyte works with managed security-services provider (MSSP) SecureWorks (formerly LURHQ) to manage its firewalls and IDS/IPS appliances — for less than it would cost the company to do the work on its own. Hoilman would need three people to monitor the company’s firewall around the clock, he says he figures. At about $90,000 a year plus benefits for a single certified security engineer, he would have to spend more than a quarter-million dollars for firewall and IDS/IPS protection — and that figure doesn’t include the cost of hardware and software. “SecureWorks costs me a little more than half the salary of a security engineer,” he says.
12 managed-security-services providers you should know. View slideshow.
Offloading busy-work and saving money also lured Boiling Springs Savings Bank in Rutherford, N.J., to the outsourcing model. The bank, a $1.2-billion thrift with 16 locations in New Jersey, turned to Perimeter eSecurity in 2003 for managed IDS/IPS services and has since added several other services including e-mail and Web hosting.
“Security is always a catch-up game,” says Ken Emerson, senior vice president and director of strategic planning at Boiling Springs. “Training for security personnel must constantly be kept current; and for an organization my size, that’s a very expensive proposition. An MSSP can leverage the investment in personnel and education across many users,” he says.
Indeed, the complexity and expense of providing network security has led many enterprises, especially small-to-midsize companies, to seek out MSSP partners. In a recent survey of the Network World Technology Opinion Panel about security trends, 62% of 483 respondents indicated they were using a managed security service. On average, these readers said they were meeting 30% of their organizations’ security needs with a managed service. Two-thirds of respondents said they expected their use of managed security services to increase over the next two or three years.
Options galore
Their options are plentiful. Managed security services are available from such established global carriers as AT&T, BT and Verizon Business, as well as from such smaller, specialty providers as Perimeter eSecurity and SecureWorks. “The market is being driven by a desire for a better documented, process-driven security-monitoring program, and in many cases by compliance concerns,” says Kelly Kavanagh, principal research analyst at Gartner.
Falling prices are fueling enterprise uptake, too, Kavanagh says. “Between 2002 and 2006, prices fell significantly, and since 2006 there has been a slow erosion of pricing,” he says. Today, pricing varies with some providers offering services à la cart and others bundling them in packages. A firewall service offered in the cloud — which means the firewall resides inside the network and can be partitioned for more than one user — might cost a few hundred dollars a month, while a package of several customer-premises-equipment-based services that are not shared can cost $5,000 to $7,000 a month.
For such companies as American Nuclear Insurers (ANI), a joint-underwriting association that provides liability insurance for nuclear facilities in the United States, the latter option makes sense — but not the former. “We would draw the line at putting our data out in the cloud or trying to run applications in that mode. That would be much harder to justify,” says Daniel Antion, vice president of IS at ANI, in Glastonbury, Conn.
ANI has been using AT&T’s managed security services since 2006, when prices fell enough to warrant Antion’s attention. “Historically when we looked into [Web and e-mail filtering] services, we simply couldn’t afford them,” he says. After attending an AT&T seminar on managed security services two years ago, “I was very surprised when I discovered the old ‘faster, better, cheaper’ scenario applied to its services,” he adds.ANI now uses AT&T’s Web filtering and e-mail filtering and archiving services. Antion would consider outsourcing other infrastructure services, such as VPN and firewall, if the price were right, he says.
Bushaus is a freelance writer in the Chicago area. She can be reached at dbushaus@mindspring.com.
