|
By Bob Violino
More organizations are using managed security services, where security functions such as vulnerability assessment and network firewall monitoring are offered to clients as a service.
These services offer potential benefits to organizations that lack the internal security resources. They also present risks, such as choosing a service provider that can't meet the specific needs of the client organization.
Use of managed security services is on the rise, according to industry research. For example, a report by Forrester Research Inc. released in December 2008 says such services are set to grow among small and medium sized businesses, driven by skill needs and cost savings.
Among the 685 North American and European companies surveyed by Forrester, the top drivers for using a managed security service provider are the demand for a specialized skill set (31%) and the need to reduce costs (24%).
Other reasons include reducing complexity and the desire for 24/7 coverage. Email/Web content filtering and network firewall monitoring are the top two services already in use as managed/outsourced services, Forrester says, and the firm expects to see growth in vulnerability assessment and endpoint security as managed services.
Westamerica Bank in San Rafael, Calif., uses a variety of managed security services, says Charles McCain, information security officer of County Bank, which Westamerica acquired in February.
"I think there's lots of potential for [managed services], depending on the emphasis taken," McCain says. For example, he sees great potential benefits of using a managed security service provider for complex projects such as creating secure networks using the latest Internet protocol IPv6, which he says is more secure than the current IPv4.
Organizations using managed security services need to understand their own role in the partnership to enhance security within the enterprise, says Irfan Saif, a principal at Deloitte & Touche LLP.
"If someone is managing your network and infrastructure, there's a certain point at which if they were to detect some sort of intrusion or anomaly, they may throw it back over the fence to you," Saif says. "Make sure you have integrated response plans and that you know how to take information they provide and react promptly to mitigate risks."
Not all security managers are keen on using managed services. "Given our scale, we found that contracting for managed security services is more expensive than handling it ourselves," says John Cholewa, director of corporate security at Embarq Corp., a communications services provider in Overland Park, Kan.
"Regardless of the cost issue, protecting your own enterprise with your own people is the optimal situation," Cholewa says. "Providers of managed security services do a fine job. But we are not their only client, and in the event of an emergency affecting a number of clients, it will not be possible for them to focus all their efforts on our company. With our employees working those issues, they will devote 100% of their energy on our company."
Only registered users can write comments.
Please login or register. |
