Mature, scalable
David McNamara, managing director with CommSec said that where SMEs “have been effective” for a long time in subscribing to MSS providers, large enterprise have up until now relied on investment in “security expertise in terms of people” alongside the most “up to date solutions to mitigate the risks to their business”.
However, he added, with more mature and scalable offerings now out there those enterprise-level clients can now “consider out-tasking aspects such as endpoint security to managed service providers”.
Datapac’s O’Connor also claimed that while the outsourcing model has more traditionally been the reserve of SMEs, “there has been however, a notable shift recently to outsourcing in the larger enterprise sector too” of late. Added O’Connor, “Driving the outsourcing of IT security in the enterprise market has been increasing obligations and risks and this has been compounded by the many high profile breaches that have come to light recently”.
“In the case of MSS, being able to actively manage that solution for the customer through a team of highly certified and experienced security specialists regardless of the platform” is swaying many towards the idea,” Karen O’Conner Datapac
Free up time
Gerry Harvey, general manager at Commtech said that moves toward MSS are happening “across all verticals and all organisation sizes”. As organisations build out cloud offerings, he said, security can now be seen “as a seamless part of the service”.
“Large private clouds may outsource the security aspect, especially where they have a hybrid model,” he said. “SMEs can use MSS to free up time from dealing with operational security issues. Using a pay as you go model SMEs can benefit from ‘large enterprise’ security protection without the big ticket price.”
IBM’s Bryan Hickson, client solutions executive, meanwhile said that “regardless of their size”, Irish businesses are becoming more aware of the potential investment in MSS offers. “Businesses today are using more social, mobile e-commerce solutions to conduct transactions and connect with the clients and end users,” he said.
“As a result they are a target for any attacks across a wider spectrum of devices or points of entry into the company. IT security teams have more issues than time to address and it is not the breadth of issues it also the depth and the diversity of the security risks. Using MSS for their IT security solution companies can either complement their existing security operations centre or completely outsource it.”
BUSINESS CASE
The business case for opting to go with a security service managed from outside a company’s four walls will have to be “very convincing” for most companies to change though as it’s such a traditionally in-house element of IT infrastructure noted Renaissance’s Conway.
Commtech’s Harvey added, “It’s a matter of bang for buck. Any organisation will compare internal costs associated with ensuring the correct protection is in place against the cost of buying in the shrink-wrapped service. This is especially true where the external service level agreement (SLA) is clearly stated whereas internal SLAs are often not so measured.”
Technical director with Qualcom, Mark Carragher agreed the main deciding factors of whether to go with an MSS provider over handling this issue on-site include “the limitations of in-house resources as well as the cost implications of handling in-house”. In many cases, said Carragher, SMEs don’t “fully explore all of their IT security needs or their threat landscape until after an event has occurred and corporate data has been exposed”.
At this stage, he added, they are on the back foot and “trying to fire fight to reduce the impact” of a breach. “With IT security breaches a reality for businesses of all sizes, they need to take a more active approach in order to quickly shut down any IT security attacks,” said Carragher.
“Customers are asking us not only to provide a point solution but are asking us to be their trusted security advisor, so we advise on the most cost effective ways of mitigating the cyber security risks to their business and in many cases to be their security incident response team,” Tadgh Cashman, Logicalis Ireland
THREE REASONS
Elsewhere, Smith pinpointed three “key reasons” that companies are now choosing MSS solutions over handling security in-house. The Dell SecureWorks director of technology, said the first reason is staff retention, the second is based around the “complexity and constant evolution of the threat”, while the final influencer will be the “difficulty in establishing efficient operational security standards and practises”.
Smith explained further, “Retaining skilled security staff is difficult even for large organisations so employing an MSS provider will help to alleviate some of this pressure. On top of that, an efficient [MSS] provider will be capable of tracking threats in a way that individual businesses may be incapable of without external support.”
Threatscape’s Williams meanwhile simply said it’s “both impractical and uneconomic” for most organisations to “replicate using their own resources the sort of 24×7 expert cover a true MSS” provider can deliver. “If outside experts can do it better and cheaper – the decision becomes an easy one,” said Williams. CommSec MD, McNamara would also appeal to companies “not just pay lip service” when it comes to security by “putting in antivirus and believing they are covered”.
For those weighing up security investment, whether in-house or a managed solution, McNamara said the reality is they need to consider elements such as “personnel, up to date protection, education, seamless delivery of business services, fraud protection and user experience – in terms of encryption and network protection”.
Ltd
