Outsourcers Rush to Meet Security Demand

Computerworld - An increasing number of firms are rushing to offer outsourced security services in anticipation of a spurt in demand.
During the past several months, companies such as Internet Security Systems Inc. (ISS), Riptech Inc., Ernst & Young International, Foundstone Inc., OneSecure Inc., Guardent Inc. and Counterpane Internet Security Inc. have rolled out services aimed at helping firms manage key aspects of their security.
Their services include managing firewalls and virtual private networks (VPN); performing vulnerability analysis, intrusion detection and antivirus protection; and, in some cases, even designing, implementing and managing security architectures. Driving the demand for these services is the shortage of security professionals and the complexity of implementing and maintaining enterprisewide security architectures, said Allan Carey, an analyst at IDC in Framingham, Mass.
Most outsourcing today is limited to managing firewalls and VPNs and providing intrusion-detection services. Users retain control over all security policies and architectural decisions, users and analysts said.
But "over the next four years, we expect to see companies outsourcing pretty much the whole security life cycle to third parties," Carey said.
As a result, the demand for third-party security services will exceed $17.2 billion by the end of 2004, according to IDC.
Managed services address a crucial need for many companies, said Ron Hilliard, a network manager at Health Alliance Plan (HAP), a major health maintenance organization in Detroit. The company outsourced all of its firewall management functions to Atlanta-based ISS two years ago because of the hassles and cost involved in maintaining the system internally, Hilliard said.
Cost Factor
Cost is also important, said Vijay Bobba, a partner at The McKenna Group in Mountain View, Calif. The technology consulting firm recently outsourced firewall management to Denver-based OneSecure for less than a quarter of the $100,000 it would have cost to hire a full-time security professional, Bobba said. As a result, McKenna is now looking at outsourcing all remote-access-related security issues as well.
"It's not just the price but the whole value proposition that needs to be looked at," Bobba said. For instance, by outsourcing to OneSecure, McKenna has 24-hour protection that wouldn't have been available otherwise, Bobba said.
ISS's firewall monitoring service starts at approximately $300 per month and goes to more than $1,000 per month, while its intrusion-detection services range from $800 to more than $3,000.

Read more about Outsourcing in Computerworld's Outsourcing Topic Center.