Choosing The Best Security Guards

Computerworld - After the Nimda virus crippled his network for nearly three days in October, Richard Diamond figured there had to be a better way to protect his system. "I wanted to put in a reasonable intrusion- detection system, but I didn't have the resources in-house to integrate our security components and monitor them," says Diamond, CIO at Doctor's Co., a physician-owned medical malpractice insurer in Napa, Calif.

Diamond outsourced his security management to Symantec Corp. in Cupertino, Calif., a vendor of antivirus products that has joined dozens of other product vendors that are expanding their offerings to include managed security services. These vendors review and correlate audit information from different sources, weed out false positives and alert customers to security events and how to respond.

Managed security services providers (MSSP) are addressing a very real need as IT departments are drowning in reams of alerts and false alarms coming from virtual private networks (VPN) and firewall, intrusion-detection, antivirus and other security monitoring systems and logs, says John Pescatore, an analyst at Gartner Inc. in Stamford, Conn. At the same time, it's impossible for most companies to hire and keep an expert staff to sort through all of those reports on a daily basis, says Pamela O'Leary, senior vice president of information services at Rockland Trust Co., a banking service in Rockland, Mass.

There's no denying the value of these services, says O'Leary, who figures she's saving 35% annually by outsourcing security event monitoring to Riptech Inc. in Alexandria, Va. And The Regence Group, an insurance administration company in Portland, Ore., reports saving 80% per year by hiring Counterpane Internet Security Inc., also in Cupertino, to manage its security event monitoring.

But analysts warn that relying on an MMSP is something of a double-edged sword. There's always the chance that the provider doing business today may not be around next year. This is especially true now with managed security services because providers are struggling with the traditional fallout, fragmentation and consolidation that accompanies most new technology or technology services markets. Service providers also differ widely in terms of the devices they monitor and how they correlate and analyze the information they collect. And vendors' profitability boils down to how well they automate event correlation and analysis, which can be very time-consuming and expensive if done manually, says Peter Stapleton, director of product management at Ubizen NV, a monitoring services provider in Reston, Va.

"Trust in vendors is a pretty big issue in this market, given the fact that last April we saw Pilot Network Services and the Salinas Group go out of business rather abruptly," says Allan Carey, an analyst at Framingham, Mass.-based IDC.