When Offshoring Comes to Infosec

Computerworld - Offshoring IT work is nothing new for my company, but I have dreaded the day when I would be asked to offshore some of our information security work. So, when I tell you that I spent last week in India, youll understand that it wasnt just the jet lag that had me feeling harried.

When it comes to budgets, IT is not a high priority for my company. Most internal investment is in product development, because that is what keeps us competitive and makes money. In every other area, we are always looking for ways to cut costs, and for several years, weve been doing that by moving certain jobs and functions to lower-cost countries. We outsource some of our product source code development to Russia, hardware engineering to China, training and knowledge management to Singapore, and application development and engineering to India. I understand the reasoning behind moving certain operational and support tasks offshore, and I believe the cost savings far outweigh the risks. But information security is another story entirely, and I dont say that because I want to protect my turf. Im talking about protecting the company.

In the hiring process, we hold security engineers to a higher standard than other employees, since in giving them the ability to access our critical infrastructure, we are giving them the keys to the kingdom. If security engineers are going to effectively protect intellectual property and detect network intrusions, they have to be able to monitor all network and employee activity. While no employee should expect privacy on a corporate network, the truth is that many people engage in very private personal and business matters at work. We have to be careful about whom we put in a position to be privy to all that sensitive information. Having people offshore do that work makes me very uncomfortable.

So, there I was in India, trying to put my mind at ease. I was very impressed with the security operations of one of the Indian companies I visited. Its network operations center put my companys in-house capabilities to shame. The Indian company has invested heavily in enterprise-class monitoring, configuration management, documentation, process and procedures.

But while offshoring would let us take advantage of certain economies of scale, the trade-off is a lack of oversight and security. One key will be retaining control of all that I can while leveraging the budgetary advantages of a lower-cost workforce. Take Tripwire as an example. We use it to monitor changes to files. If we outsourced this activity, I would insist that we in the U.S. continue to define policies (that is, which files are to get monitored), while the actual execution of the policy and the monitoring operations themselves would be moved to India. I would still be responsible for compliance, oversight and escalation, but the day-to-day operational activities would be conducted overseas.