How Amazon powers M86’s cloud security

M86 has revealed that it was using Amazon's EC2 cloud computing platform to roll out hosted security services to its customers in Australia.

M86 created a virtual instance of its web application on Amazon's EC2 platform for each customer, said Werner Thalmeier, M86's vice president of product management.

"We started the prototype 18 months ago. From our point of view it was faster and most reliable way to market and the most scalable," said Thalmeier.

The image is built and tested by M86, which optimises for EC2 and performs quality assurance.

"The customer can only pick a ready image [which] can connect to internal policy filters or use the system browser interface through an encrypted connection" and can't be spoofed, claimed Thalmeier.

Amazon was optimised for Linux environments, which made it "relatively straightforward" to run its virtualised security applications.

However, the platform was very limited in its ability to customise. "On Amazon what you see is what you get. They don't change anything," said Thalmeier.

The vendor uses EC2 competitor Rackspace to host instances of its mail security appliance partly because Rackspace was more flexible.

"You can define it as you need. That's why it's a prototype for mail," said Thalmeier.

M86 said working around the service level agreements of the hosters was a critical part to providing security as a service. "That's one of the challenges with the likes of Amazon," said M86 COO Bruce Green. "It's hard to influence their SLAs. Whereas with Rackspace it's easier."

Uptime and resilience were vital to the hosted security service, and the vendor was looking at ways to improve those metrics within the limitations of the hoster's SLAs, said Green. "You have to work the technology around that."

Green said the vendor was testing the two environments but would ultimately settle on one.

"They will come together as they evolve," he said. The ultimate goal was to consolidate reporting for web and mail security services, he said.

Last year, M86 signed an agreement with Perth-based hosting company YOURasp to offer MailMarshal as a Service.

Why build a data centre?

"We're focusing on developing our technology and not building data centres," said Green. If you build your own data centres then you have to expand the physical infrastructure as your customer base increases, he added.

The strategy stands in contrast to competitors Symantec and Websense which have built or bought data centres around the world. Symantec has claimed it runs 16 data centres and Websense 10, respectively.  

Microsoft and Google also use their own data centres to provide their security services Forefront and Postini, respectively.

Green said building data centres was a distraction for security companies and an unwise investment.

"I think there's a risk in companies owning their own data centres because they will commoditise," said Green. He pointed to competition from Amazon, Google, Rackspace and telcos in the data centre market.