To Serve and Protect: Let Someone Else Run Your Security Software

For how many of you out there is running a firewall—or running IT in general—central to your business? I bet the percentage is a small one. Nevertheless, you have to do these things in order to protect and facilitate the things you really do for a living.

This is why I believe in services for most IT functions. By "services," I mean that a function should be outsourced to some outside firm. Web hosting is a good and obvious example of a service. You could run your Web site on your own systems, but wheres the sense in that? Hosting firms have great economies of scale when it comes to running large numbers of customer sites on a single box as well as managing farms of Web and other application servers. As a result, its cheaper and better to outsource it.

In the case of security, I think there are also economies of scale, at least in many cases. Years ago (I think it was 1999), I wrote a story predicting that ISP-managed services were the future of antivirus and some firewall functions, at least for consumers. If spam had been so big a problem back then, I would have included it, too. For the most part my predictions have been flops, but I still think I had good arguments:

• Economies of scale: An outsourcing firm can throw a few large servers at a problem and support large numbers of users.
• Timeliness: One of the key characteristics of good antivirus, firewall and spam-protection support is having and implementing the latest attack information. Its a lot easier for a service to update its server network than for a company like Symantec to push out updates to millions of users.
• Performance: In some cases, especially spam filtering, outsourcing means youll cut the amount of traffic entering your network, leaving only the parts you want. At the very least, this move will improve bandwidth. I wonder how much hardware and bandwidth money could be saved by using managed security services.
• Backup: Service providers make guarantees of backup, archive and disaster recovery.

I think those factors are all the biggies, and they are even more true now. So why was I wrong? I think the major reason why the service model never caught on, especially when it comes to ISP-provided services, is that people are cheap. Yes, you heard it here: ISPs assumed that customers wouldnt be willing to spend another $5 per month or whatever it would take, so they never rolled out the services.

Ive also always been suspicious of the motivations of antivirus companies on this front. If ISPs generally adopted antivirus scanning, it would certainly hurt the retail antivirus market. That money would be somewhat offset by the subscription fees, and the service model is also far cheaper for the antivirus vendor than shipping millions of boxes to consumers, but it has to be a scary move for a McAfee or Symantec. On the other hand, for a company like Sophos, which is respected in the corporate market but has no meaningful consumer business, this would be a pure win. Any antivirus vendor would point out that a service that scans mail, maybe even HTTP, still doesnt stop all possible avenues of infection; therefore, you still need to run a local scanner. But lets face it: E-mail is where real people get their viruses these days, so plenty of people would conclude that they didnt need to buy or update a local scanner anymore.

Continued on Next Page