In past columns we've looked at how and why to choose an ASP, as well some specific niches of ASP services. This month we're going to look at one area that might not immediately leap to mind as being a natural one for ASPs: security.

At its core, information security closely resembles security in the physical world. Bricks-and-mortar organizations use burglar alarms, fire alarms, and security guards to protect facilities from theft and disaster. The online world has exactly the same need, but the immense economic pressure to get online and grow quickly often tempts organizations to sacrifice security as a non-essential luxury.

The fact of the matter is that deploying security is essential for your e-business. The question is a matter of when, not if. A single break-in at a bricks-and-mortar warehouse carries a finite amount of loss. A single break-in that successfully compromises a key e-commerce server, however, can leave an e-business out of business for hours, embarrass the company publicly, and expose the organization to significant stakeholder liability.

But how are you going to protect your company from online attacks and digital destruction? This is especially tough if your firm doesn't have its own team of qualified security specialists. What do you do? One approach is to turn to a security--application services supplier--also known as a managed-security provider (MSP), or managed-security services (MSS) provider--to handle electronic security issues for your company.

A model solution

But isn't it a stretch to fit security into the traditional ASP model? After all, running your applications, services, and processes on the ASP's hardware at the ASP's site just for the sake of security seems a little excessive, doesn't it? There appear to be some good reasons why the basic ASP model and your security needs don't seem to jibe.

First, security software, appliances, hardware, and telecommunications infrastructure are usually an inside-out affair, not outside-in. In other words, you are busy building your company's network fortress by putting security devices, software, and policies into effect inside your network to protect you from the barbarian hacker hordes outside your network.

Second, many ASPs themselves are (for the most part) currently in the same security mode as are other industry sectors. That is, they're reactive, subject to intrusions, denial-of-service attacks, virus infections, information theft, and other destruction brought on by an ever-growing community of cyber ne'er-do-wells. So given these issues, does it make sense to hire a security ASP?

The short answer is yes. When it comes to security, there is a different ASP model in effect that is particularly suited to security services--managed services providers (also called MSPs). In other words, instead of the old model of your services running on the ASP's hardware at the ASP's site, these MSPs offer clients the MSP's hardware and services running at the client's site and managed by the MSP. By installing and maintaining a collection of security software and hardware that's preselected and integrated, MSPs help firms avoid difficult point installation and security-system integration issues. Add to this the MSP's mission to maintain and update this integrated system of protection and the MSP model makes a lot of sense.

After all, securing the electronic enterprise raises lots of issues. Experienced and well-trained security professionals are hard to find and expensive to retain. Security software is expensive and often protects only specific applications. In addition, security systems must be monitored constantly. And as if that's not enough, security techniques and technologies are changing all the time. For example, staying one step ahead of hackers with a Windows 2000 system requires daily updates of patches, which means you must monitor Microsoft's patch site and download the fix before a hacker can exploit the vulnerability. If you outsource your security to an MSP, all those security woes become the MSP's headaches, not yours. Instead of facing constantly escalating personnel and training costs, network security can become a known, manageable cost item in your company's budget. Because your MSP is addressing the task of keeping your company's security safe from the latest threats as they develop, you can benefit from the latest protection technologies without having to retool your operation constantly.

The many service of MSPs

MSPs provide several different security services, including gathering information, auditing, and performing vulnerability analysis on the security infrastructures within an organization. Once that is done, the MSP continues by making recommendations or installations to enhance or upgrade current security capabilities and to close vulnerabilities. And last, the MSP goes about installing monitoring software that returns vital data (such as log files from the various security applications and hardware) to MSP security operations centers. Rather than outsourcing applications, MSPs enable outsourced security monitoring, management, and expertise for applications running on the customer's networks.

If you've decided to outsource your security management, you need to begin assessing MSPs and their specific offerings. Develop a quick list of possible MSP candidates by looking through network industry trade publications and by searching for managed security services on the Web. Since you are trusting the security of your organization to a service provider, due diligence is a must. Be sure to check the MSPs' backgrounds in terms of longevity, security, industry reputation, and track record. See if the MSP will let you contact one or two of its current subscribers to discuss their experience, with their MSPs.

Some of the questions to ask include:

How many security operations centers (SOCs) does the MSP have in operation?

Where are they are located?

Are new SOCs planned?

If an SOC goes down, how will your company's security be affected?

When, why, and how will the MSP's security response team contact your company in the event of an attack?

Will the MSP's security experts support your company's existing applications, or does your company have to conform to the MSP's security infrastructure?

Also check on the hardware, software, and technologies on which the MSP has standardized. Do some research on the your MSP candidates' pros and cons in providing their proposed security services.

Be sure to fully clarify contractual requirements and responsibilities prior to signing on with a service. Make sure you can review the proposed service agreement at different points throughout your relationship with the MSP. Check to see whether you have to meet the MSP's requirements or if you can modify the service agreement to meet your specific needs.

Deploy your solution in stages versus going for a complete end-to-end security solution to start with. This not only allows you to make changes if you need to, but also allows you to assess the relationship with your vendor before betting the whole farm on it.

Last, you need to make sure that your company's executives and IT personnel are involved in the evaluation and contract processes. In-house IT security personnel must understand the how, why, and when of an MSP relationship in order to effectively oversee corporate security.

But wait--there's more

We've only scratched the surface of what is an important and growing market segment in a piece of this length. Additionally, companies' needs vary, so an MSP that works well for one organization might not work so well for another. But the need for security (and the marketplace of providers) is growing. Market researcher International Data Corporation predicts that the market for managed-security services will grow to $2.24 billion by 2003. It also expects the market for content security to grow from $66 million in 1999 to $952 million by 2004.

If you don't have the in-house resources to manage your business's growing security needs, you ought to consider the benefits a contract with a MSP could bring to your organization.