Security plays and pitfalls

EDITORIAL: There’s no doubt about it: security is big business. Viruses, worms, spam, malware, spyware -- the list goes on.

Every day, users are bombarded with all sorts of security breaches threatening to ruin their positive computing experience. Damn, there’s another piece of spyware! Thought I’d fixed that yesterday. Here I am writing about security and it looks like I’m having some very real problems of my own at the moment.

No matter how hard we try, security is often just too hard. It often feels like as soon as one door closes, another one opens. Painful isn’t it? Our cover story this week takes a look at one of the shining lights in a sometimes dreary and margin-less IT business.

One theme rings true: Security Means Profits. Every single organisation, from a large enterprise to a small business, needs some sort of security policy in place.

More to the point, these companies need someone to manage their security infrastructure.
According to the Yankee Group, 90 percent of all security work globally will be outsourced to a third party by 2010. Yeah it’s a bit ambitious, but the trend is good news for the channel.

With the right knowledge that only comes from training around the maze of security solutions that are available in the marketplace, recurring revenues await you.

A customer needs a security solution provider to keep a constant eye on their network(s) to prevent network downtime. And usually this type of downtime means lost business. You can’t put a price on that.

However, as most people would point out and I tend to agree, selling security solutions is more about selling a business process and mitigating risk for an organisation than it is about technology itself. Apparently, only a small number of channel players have the necessary credentials to understand how security fits into their business processes.

There’s so much pressure these days for most businesses to comply with new regulatory requirements, many of them that rely on solid security infrastructures. And they need a trusted adviser to help them get there. Most of these companies are not aware of their requirements under these laws and how their security and wider technology infrastructure will play a part in assisting them to be compliant.

If you keep the network humming, you keep the customer, and you can charge them to manage the infrastructure on a regular basis.

The drawbacks to entering this market however are a big bummer. Having a security practice obviously requires a hefty investment, with costs associated with data centres and the like making it difficult.

Then there’s staff training, an investment that can take a long time to return.

Investments of this magnitude make it difficult for some players to enter the security market. A more suitable option may just be to partner with another organisation. It’s not such a bad idea if you find the right partner and you have something useful to offer to the partnership. You could partner with a telecommunications company offering managed services and you may just be able to bring something to the table.

But for solution providers with the right knowledge and a desire to chase the security market, doors to solid, recurring business will open. What are your thoughts on this market? Money-spinner or money down the drain?