Field Notes:Outsourcing Can Help

Computerworld - The growth of e-business and the ever-increasing integration between corporations and their suppliers and trading partners has put a premium on security, user authentication and data integrity. In addition, recent economic pressures have forced many companies to reassess their telecommunications strategies with an eye not just toward security, but toward cost and performance as well.

Users are turning to VPNs as an answer to all of these challenges. In addition to providing increased security, in some cases VPNs have reduced telecommunications management costs and improved performance. However, deploying a VPN isn't like deploying a few new desktop PCs. There are still many technical challenges to work out and much research to do before you choose any one VPN product or architecture, say users.

"We were worried about the technological risk associated with the changing technology," says Ed Flynn, CIO at FMC Corp., a Philadelphia-based manufacturing company with 90 locations worldwide. FMC started the move toward a VPN in early 2000 as a means to provide what Flynn calls "secure anybody, anywhere access" for more than 1,000 employees. However, the growth of business-to-business trading also increased concerns about having to touch customer systems, says Flynn, "and we didn't want to do that at all."

After researching its options, FMC chose Seattle-based Aventail Corp. for its VPN and remote access requirements. It came down to the technology and flexibility, says Flynn. The Aventail service allows FMC to control employee access rights and also uses a noninvasive agent that leaves the client IP stack alone, thereby meeting FMC's requirement to not touch customer systems.

"We vetted who we went with very well," says Flynn, "so we're not limited by the technology choice." And since FMC "had no idea how to deploy what they needed on their own," handing over these complex technologies to a company with the know-how minimized the risk, he explains.

Kelly Henderson, chief operating officer at AutoWeb Communications Inc. in Oak Park, Mich., agrees with the idea of having someone else do the VPN work. AutoWeb, which does business through a VPN managed by Southfield, Mich.-based ANXebusiness Corp., was faced with figuring out a tunnel management process for each of its 600 trading partners, including nine of the world's largest automotive manufacturers.

"Most companies aren't in the business of managing telecommunications," says Henderson. "It's not their core business." And VPN tunnel management on AutoWeb's scale "can get involved" and "can be a significant investment for companies," she says.

"There's expertise that we didn't have but that we needed to have to handle that type of process," says Henderson. "The cost is well worth it to us because of the type of business we're in. But you need to identify where the real pain points are and whether a VPN is going to address those pain points."

Joe Klein, director of telecommunications at Illinois Tool Works Inc. (ITW) in Glenview, Ill., says deploying a VPN hasn't been painful; in fact, he says it's been a pleasant, cost-effective change from traditional telecommunications methods.

ITW deployed a VPN from OpenReach Inc. in Woburn, Mass., to replace frame-relay networks connecting up to 70 business units. VPN tunnels are supporting human resources, financial and e-mail applications between remote sites and ITW's headquarters, as well as 100 remote dial-in users.

"Users have to realize that with all good things, it takes some time to accommodate change and get used to the product," says Klein, noting that he made use of the OpenReach installation team to get the VPN up and running. However, so far the VPN has helped Klein cut costs by 30% to 50%, he says.

Read more about Security in Computerworld's Security Topic Center.