Confusion around managed security

ANALYST FIRMS HAVE BEEN predicting managed security services (MSS) as a growth market, yet few seem to be making huge dollars to date.

For some customers, there is still confusion around what MSS entails. Keith Glennan, managing director of Network Box Australia, says one of the problems with managed security is there’s no real definition of what it means. “For some it just means they’ll ping the box every five minutes to see if something answers. Whereas we look at things like how many web transactions per second are going through the box, how many TCPIP connections are live at any one time, whether the physical memory is being used, whether the fans are still spinning, whether the CPU is heating up, what the air temperature is inside the box.

“We monitor about 70 different elements in real-time,” he says.

Dimension Data’s national security practice manager Neil Campbell says managed security is still “very Wild West”. “You’ve got distributors selling managed services, you’ve got resellers selling managed services, and you’ve got vendors selling managed services. You get some interesting channel conflict when everybody is selling managed services, and that’s pretty confusing for the customer as well,” he says.

Every time something new comes along, like MSS, everyone wants to put some kind of spin on it. Firewall Systems’ Nick Verykios says MSS is just task sourcing. “It augments what a reseller should do. So any vendor or distributor selling direct to an end user should be shot, because it’s the reseller that holds that prime contractor relationship with the end user for everything. Allow the reseller to do what they should be doing,” he says. Another reason MSS has been a tough sell is the paranoia from IT managers that the MSSPs (MSS providers) want their jobs. “You’re often dealing with an IT manager who sees the MSSP as a threat,” says Glennan. “We certainly recognise that, and our pitch to the IT manager is: ‘We’re going to make you look like a hero, we’re not here to take your job’.

“We’ve had some sales where the IT guys have really championed us, and we’ve also had some where they’ve actively worked against us,” he says.

Peter Hodges, chief software architect for security vendor, Marshal, says it is a significant investment and can take time to yield significant results. “In the past, we’ve seen many resellers enter the MSS market once they’ve secured one customer with 50 users. They charge the customer $18 to $20 per user per month, which cannot cover the significant outlay involved in setting up the business. It’s high volume and low revenue. You need numbers coming through your gateway to succeed in this game,” he says.

Firewall's Verykios: MSS augments with a reseller should do

The other challenge for resellers/integrators that want to get into MSS is that you need to have infrastructure here and overseas.

Glennan says Network Box has thousands of devices around the world that report every two minutes as to where attacks are, and what sort of attacks. “We can see threats emerging in real-time. From the moment we get an anti-virus update, every one of our boxes around the world is updated in under 45 seconds,” he says. Smaller MSSPs simply cannot compete with that scale. That said, there is scope for smaller MSSPs to meet the security needs of SMBs. KPMG’s Peter McNally says there’s a definite market for managed security services for smaller organisations in cases where it is simply not practical for SMBs to do it in-house. “[SMBs] can’t develop the skills, they can’t acquire the skills, they can’t retain the skills, and they can’t afford to have people managing security 24x7,” he says.

Security specialist reseller Group Services & Systems has been providing MSS for about two-and-a-half years. “We didn’t have a lot of success with it in the first year, but it’s really starting to take off now,” says Hayden Tanner, business sales manager. He says customers are more open to the idea of MSS now, and there are more benefits today than a few years ago.

“It’s all about teaching your customers that MSS has now evolved and grown. The initial reaction is, ‘No, just send me a CD’. But once you show them how it works, show them their reports, develop a much closer rapport and relationship, they can be confident the purchase is worth the money they pay for,” Tanner says.

Gartner predicts spending on IT security services worldwide will reach $24.6 billion by 2009, and IDC, expects managed security to be the fastest growing segment in the security services market.

Certainly for Dominic Whitehand at distributor WhiteGold, MSS is a big thing. “Setting up an MSSP is a great move for us. It makes perfect sense to be at a wholesale level because since we deal with so many resellers that don’t want to invest in infrastructure, they can actually use our back end but brand their own service to the end-user customer.