MSSPs: At your service

• Article 5 of 33
• SC Magazine, November 2006
• View the original article online

Page 1 | Page 2 | Page 3 | Page 4 | Page 5 | All 5 Pages

The Fabulous Bakin' Boys and The Salvation Army are, to some extent, typical of the earlier adopters of MSSPs in that they use suppliers mainly for upstream filtering of their email or internet connection. They're also relatively small organisations with fairly small IT departments, many of whom see MSSPs as a way of getting rid of a problem and dealing with a skills deficit. “Five years ago,” says Thomas Raschke, an analyst at Forrester Research, “there was a lot of enthusiasm on the part of clients.It was one way out of being responsible for your own security - you just outsource. You still see that in smaller and mid-size firms.”

The age of compliance
However, as budgets thawed out from the bursting of the dotcom bubble, the overall trend changed too, with larger companies and those with greater needs than simple content filtering beginning to take advantage of the savings and management resources available from MSSPs. Even long-term holdouts, such as those in the government sector and financial services, have started to embrace the possibilities of MSSPs at all levels.

One reason for this is that they may be struggling to cope with the needs of compliance. With regulations imposed by the Government, the European Union, the US's SEC, the payment card industry and other bodies affecting UK organisations, many are finding they don't know what they have to do to be compliant, so hire an MSSP who knows both the legislation and best practice to help clean up their acts. This is particularly the case with larger enterprises, according to Chris Richter, head of security at IT services company Savvis.

The nature of the relationship between MSSPs and clients is changing too, as customers are starting to want more than basic protection. Paul Brown, group IT manager at healthcare recruitment agency Reed Health, was looking for something that would offer him protection from email threats, spam and malicious web content; look after his firewalling, virtual private networks (VPNs) and demilitarised zones; and protect him from anything else that could endanger his company.

He now uses Network Box's united threat management and managed security service to protect his company's two mirrored data centres from external threats. The centres provide the power for the company's thin clients, which are installed in all its branches. “I've always been very adamant about not using third parties,” Brown says. “But I came to realise it's impossible to do everything yourself. The actual job of keeping firewalls up to date, reviewing logs, or setting up VPNs can be extremely boring, and to have someone skilled and reliable doing that as a job, isn't very cost-effective. You'd be paying £40,000 to £45,000 for a good security person, and it's costing me a lot less with Network Box.”

He also wanted someone who could provide him with advice on security.

“It's not just a client-supplier relationship. They're always suggesting things. It's like having an expert on the team that I couldn't otherwise afford.”

The next level
The services an organisation will pick depend on its maturity, according to Bart Vansevenant, director of product management, MSS, at CyberTrust.

Typically, firewalls and intrusion prevention systems will be the first for outsourcing, with SSL VPNs next on the list. Organisations might then consider ID management, transaction management and managed compliance.

Garry Sidaway, head of product marketing, EMEA, at CyberTrust, says the effects of the Jericho Forum and deperimeterisation have been to boost interest in management of host devices. “The trend is towards application-level security monitoring: looking at where the data is and protecting that.” Personal anti-virus and desktop security are also proving popular, he adds.

Page 1 | Page 2 | Page 3 | Page 4 | Page 5 | All 5 Pages