Outsourcing Security Doesn't Mean You're Desperate

On the surface, giving the security of your networks, systems, and data
over to someone else seems like a desperate move--an acknowledgement
that the threats are more than you can handle. The reality is that
tapping into a service provider might be the best way to protect your
company and comply with the latest government regulations.

One caveat: Do your homework. You must know what's in your networks,
systems, and databases and clearly define how the service provider is
going to help your company meet its security and compliance needs. You
also must be sure the service provider is financially stable before
trusting it to manage intrusion detection and prevention, log analysis,
firewall, or other security services.

Lack of resources and expertise is most often the reason for subscribing
to security services. "In the security world, it's a game of catch-up. I
couldn't possibly throw enough resources at it internally," says Ken
Emerson, director of strategic planning and CIO at Boiling Springs
Savings Bank in New Jersey. He tapped Perimeter Internetworking to
manage e-mail security and an intrusion-detection system. "I didn't feel
like I had the necessary knowledge on my staff, especially with the
rapidly growing volume of spam," he says.

Emerson thoroughly checked Perimeter and found it had passed the
Statement on Auditing Standards No. 70, a standard set by the American
Institute of Certified Public Accountants that requires an in-depth
audit of a service provider's control activities. "The other outsource
firms I looked at didn't have SAS 70 certification," Emerson says. "I'm
not going to have depositors if I can't protect their information."

After Boiling Springs signed with Perimeter, a worm got into a PC at one
of its branches. Perimeter notified the bank so it could shut down the
infected computer, Emerson says.

Kettering Medical Center Network, a group of 50 health care facilities
around Dayton, Ohio, turned to managed security services to augment its
internal IT security resources, particularly the time-consuming task of
sifting through data collected by its Check Point Software Technologies
and Cisco Systems firewalls, which protect remote physicians' offices
that are part of the Kettering network.

Kettering owns the network security equipment, but for the last two
years it has had Symantec collect and analyze data from firewall logs.
"We need to be concerned if someone is trying to do a port scan against
our systems or if our network contains ad bots or spy bots trying to
communicate out," says Bob Burritt, Kettering's IS network and
technology manager.

The ability to detect and avert downtime is crucial to any organization,
but particularly a health care operation. Added incentive is the $1
million a day Kettering would lose if it couldn't bill or collect fees.
Burritt declines to say how much Kettering is paying for Symantec's
services, but he notes that outsourcing firewall log analysis saves as
much as $150,000 annually, roughly the cost of hiring two full-time IT
pros.


WHO TO CALL?

Perimeter and Symantec are among the dozens of companies that offer
services for keeping out malicious e-mail, blocking network-borne
viruses, and automatically patching software as vulnerabili- ties are
fixed. In recent years, a number of smaller service providers have been
absorbed by larger service providers looking to add security offerings.
Symantec spent $145 million in 2002 on Riptech, a provider of outsourced
network-monitoring services run by Amit Yoran, who went on to become
director of the National Cyber Security Division of the Department of
Homeland Security.

VeriSign bought Guardent in 2003 for $140 million, and BT Group earlier
this year acquired Counterpane Internet Security, founded by IT security
luminary Bruce Schneier. Other security vendors have merged, including
SecureWorks with Lurqh in September (keeping the name SecureWorks), and
TruSecure with Betrusted in 2004 to form Cybertrust.

SecureWorks' customer Digital Federal Credit Union isn't likely to
outsource the maintenance and management of its core IT infrastructure
for loans and deposits anytime soon, but the not-for-profit financial
cooperative formed in 1979 as part of Digital Equipment Corp. knows its
limitations when it comes to security. "We're a financial services
company, we're not security experts," says VP of IS Kris VanBeek.
Digital Federal serves more than 300,000 members at 1,000 companies.

Digital Federal has SecureWorks perform security assessments on the
products and services it develops for the Web. "SecureWorks is able to
keep up with the latest; we don't have anyone on staff who can do that,"
says David DeWitt, the credit union's IS risk manager.

"We're looking at SecureWorks in place of hiring a whole department to
do this full time," says VanBeek, who estimates it costs about half as
much to outsource as it would to hire a security staff and buy the
necessary technology.

Before opting to outsource any aspect of its security, a company needs
to be able to clearly define all interfaces into its data and how the
service provider will access that data. Security services, like any
other, must be managed, and that typically costs about 10% of the
services contract when you factor in the time and effort of your IT
staff to do it, says Paul Simmonds, global information security director
of Imperial Chemical Industries Group, which develops and sells paints,
foods, fragrances, and personal care products.

ICI Group has relied on Qualys for the past four years to scan every IP
address ICI owns or has data on for signs of trouble. Before hiring
Qualys, ICI didn't have a regular or repeatable process for detecting
viruses or other problems with its IT systems. When Simmonds joined in
2001, "we ran a penetration test and actually defaced the ICI Web site
in under a half hour," he says.

Qualys manages all of the devices used to protect ICI's systems and
provides the company's security staff with a Web-based interface for
checking the information collected. This approach lets ICI avoid
investing in security hardware and software. If Qualys went bust, "the
only thing we'd have committed to was their services. This is difficult
work," Simmonds says, so the decision to outsource was easy.