Computing 2/10/2008
Cloud - Evaluating Security
IT Professionals
Developers
Solutions
eBook Library
Webopedia
S earch...
New s
Blogs
February 10, 2011
CIO Update
Forum s
Careers/Staffing
Hot topics :
CIO Insights
Login
Register
CIOUpdate.com
Technology Trends
Budgets
Special Reports
IT Budgets Infrastructure Cloud IT Architecture Wireless Sa
Research
Newsletters: Netw orking Daily
Read More in Technology Trends
Technology Trends
See Great Software Built for Microsoft Windows 7. Learn how Windows 7 software helps them capture
revenue quickly and take advantage of new devices.
Cloud Computing - Evaluating Security-as-a-Service
July 16, 2010
By Matt Sarrel
Subm it Feedback
More by Author
Over the past few years, more and more businesses have turned to software as a
service (SaaS) to bring down costs. One category of offerings, which we'll call
"security as a service" deserves special consideration. More and more traditional
software security vendors are developing and enhancing their service based
offerings. These offerings typically include protection against Web and email
threats, monitoring of inbound and outbound network traffic, and assessing an
externally facing website for potential vulnerabilities.
While all vendors argue the appeal of reduced costs, only a few vendors argue that
their solutions are better offered as a service. This is a market in transition. I've
been testing security solutions for years so I've been lucky enough to have a good vantage point for this
transition. Most of these solutions were software only. Then many added centralized management and
some shipped on appliances.
The earliest security as a service offerings merely moved this centralized management console into the
cloud. This was a good start, but fell short of leveraging all of the advantages of the cloud. Offerings have
gradually matured to utilize the strengths of the cloud. For example, Panda Security saves local
processing power by analyzing malware in the cloud, not on the desktop. Many other vendors also
make use of a cloud based infrastructure to conduct deeper and faster malware analysis. They can have
more horsepower than at a single client site plus integrate threat information from many clients to create
an accurate understanding of the threat landscape.
Pros & cons
Although more and more security functionality is being built into these offerings, security as a service
still has its pros and cons. Firstly, many solutions still require a software agent to be loaded onto each
end point. This is almost a necessary evil so look for solutions which automate deployment and updates
of software agents.
Remote workers are a natural choice for security as a service but they
aren't on your network so why do they need to use your internal
security services? They can access the solution provider's data center
just as well (or better than) yours so let them. Look for security as a
service solutions that try to improve the security process, not those
that merely claim lowered TCO and fast ROI.
It makes sense to have email and Web threat protection in the cloud
primarily because that traffic flows across the Internet and can be
cleaned before even entering a corporate network. It also makes sense
to apply some basic traffic rules, such as those that drop denial-ofservice (DOS) attacks for the same reason.
Em ail Article
Print Article
Com m ent on this article
Share Articles
Carrying it a step further, however, it does not make much sense to deploy a firewall in the cloud. Such
devices require immediate access to all network traffic and relaying such traffic back and forth between
a security as a service provider would make network services mind-numbingly slow for users. Likewise,
solutions that are heavily tied to internal resources, such as authentication and access-control software
also work better on-site.
Always negotiate an SLA when contracting for security services. What happens if you are routing all
Internet traffic through a security service provider and somehow service is compromised? It's unlikely
that an SaaS provider will fail completely. What's more likely that there might be a performance glitch so
an SLA is imperative if you are going to get your money's worth.
Related Articles
Here's the rundown on a few recently updated security as a service
offerings:
cioupdate.com//Cloud-Computing---
On the Forums
Visit the Forums
1/4
2/10/2008
Cloud Computing - Evaluating Security
The Mobile Web: What to
do with WAP in 2010
A Few Words About
'NoSQL' and Other
Unstructured Databases
IT Strategy - Six Endpoint
Security Vendors You
Need to Know About
How to Choose the Best
Tools for Your Virtual
Infrastructure
Three DLP Offerings that
Should be on Your Short
List
IBM Adds Firewall to IPS
Product
When Win-Win is a Bad
Idea
Is Your Organization Ready
for the Cloud?
Does the Cloud Render
CIOs Irrelevant?
Trend Micro Warns IT on
Social Networking
14 BSM Service Providers
to Watch
McAfee Security SaaS - McAfee offers a number of outsourced
services such as endpoint, email, web, and network protection in an
outsourced model. McAfee SaaS Total Protection offers much more
than a snappy name. This basically replaces McAfee's traditional suite
of onsite security software to protect endpoints from email and web
threats.
Panda Security Cloud Protection - This service protects endpoints
against email and Web based threats. This is the third major
enhancement to Panda's platform which means that mature. it's Early
on, Panda realized that the way to go is to have an extremely
lightweight client agent that merely communicates with a big time
cloud infrastructure that does all the heavy lifting. This minimizes the
burden placed on user systems. Panda's collective intelligence
network analyzes hundreds of millions of suspected malware files
every day.
Symantec Hosted Services - Symantec offers Hosted Endpoint
Protection (anti-malware, software firewall, HIPS for Windows desktops
laptops and servers) as well as email, Web, and instant messaging
security via MessageLabs. It gets interesting when a company
subscribes to multiple services and can then begin to assess threats
across multiple vectors in order to mount a unified defense.
Zscaler Cloud Services - Unlike the others mentioned above, Zscaler
was built from the ground up as a cloud security service. The solution
requires neither hardware nor software to be installed at a client site
and provides integrated Web and email security. Keeping an eye on
performance, the company has over 40 data centers around the world
and it's offering is built around a multi-tenant architecture. The Web
based management GUI has a very Web 2.0 look and feel with flexible
dashboards.
IPS Evolving as Security
Risks Multiply
Matt Sarrel is executive director of Sarrel Group, a technology product
test lab, editorial services and consulting practice specializing in
competitive intelligence. He has over 20 years of experience in IT and
focuses on high-speed large scale networking, network security, information security, and enterprise
storage. He can be reached at [e-mail], Twitter: @msarrel.
Latest
Most Views
Most Replies
ERP research questionnaire
2-6-2011 06:31 PM by mali813
ITIL case study!
1-31-2011 09:36 AM by iranian_manager
What people aspects of your job are important?
1-24-2011 10:30 AM by projectmgmt
Partners
More IT Management
Partner With Us
CIO Update
Datamation
Host your Site
eSecurity Planet
Promote Your Website
VPS Hosting
ITSMWatch
Intranet Journal
Liability Insurance
Televisions
IT Career Planet
Project Manager Planet
Site Hosting
Semantic Web
PDA Phones & Cases
Phone Cards
Datamation Definitions
IT Product Watch
Virtual Server
Calling Cards
Web Hosting
Prepaid Phone Card
Cell Phones
Desktop Computers
MARKETPLACE
Tags: Symantec, McAfee, IPS, Sarrel Group, Panda Labs,
Working Smarter Through Intelligent, Responsive Decision Automation
Sponsored by IBM
In this white paper, we'll explore two software technologies supporting better automated
decisions--business rule management systems (BRMS) and business event processing
(BEP)--and illustrate how these two solutions can work in tandem to help a variety of
industries work smarter.
Free Network Computer Security Scan
Find Uncontrolled Applica tions a nd De vice s &
Get A C om pre hensive R e port!
www.sophos.com
Business On Main: Online Community
Fre e O nline Tools a nd R e source s To He lp
Sta rt O r Grow Your Business. Join Today!
www.Busine ssO nMa in.com
IT HelpDesk & Customer Support
Software
Internal IT HelpDe sk Softwa re with Asse t
Mgm t. Custom er Support Softwa re with
Account & C onta ct Mgm t
DO W NLO AD YO UR FR EE TR IAL TO DAY! www
0 Comments ( click to add your com m ent)
Comment and Contribute
Key IT Solutions
Your name/nickname
Free Trial: Microsoft Office 2010
Your email
XHTML: Y ou can use these tags: <b> <u> <i>
Best Practices Resources: Transform Insight Into Action
with Business Process Management
Webcast: Information & Analytics - The Secret Weapon of
Top-Performing Companies
Free eBook: Getting Started with Adobe Flex by IBM
Microsoft TechNet Spotlight
(Maximum characters: 1200). You have 1200
c haracters left.
cioupdate.com//Cloud-Computing---
2/4
2/10/2008
Cloud Computing - Evaluating Security
Please type the alphanumeric characters above and click "Submit" to continue.What's this?
I cannot read this. Please generate a
New Image
See our comment policy.
Submit Your Comment
IT Offers
Servers, LAN, SAN, and Storage in a Single View. Try Hitachi IT
Operations Analyzer.
Learn how Microsoft Windows 7 software helps them capture
revenue quickly and take advantage of new devices.
How much will an IT security breach cost you? IBM and industry
leaders share their insights.
Virtual Event: The Future of IT Continuity. Register now to see what
will happen to IT continuity.
Is Your Current AV a Speed Bump? Try VIPRE Antivirus Business
for fast and efficient protection.
The Netw ork for Technology Professionals
Search:
A bout Internet.com
Copyright 2008 QuinStreet Inc. All Rights Reserved.
Legal Notices , Licensing, Permissions , Privacy Policy .
Advertise | New sletters | E-mail Offers
Solutions
Whitepapers and eBooks
PHP for Windows Showcase
Resource: PHP for Windows Showcase
MORE WHITEPAPERS, EBOOKS, AND ARTICLES
Webcasts
cioupdate.com//Cloud-Computing---
3/4
2/10/2008
Cloud Computing - Evaluating Security
On Demand Webcast: Essentials for Managing Your SAP Applications
Software License Operations - Cleaning Up the Backoffice
MORE WEBCASTS, PODCASTS, AND VIDEOS
Downloads and eKits
Microsoft Download: Native Extensions 1.0 for Microsoft Silverlight
MORE DOWNLOADS, EKITS, AND FREE TRIALS
Tutorials and Demos
Exceptional Web Experiences
MORE TUTORIALS, DEMOS AND STEP-BY-STEP GUIDES
Internet.com Hot List: Get the Inside Scoop on IT and Developer Products
cioupdate.com//Cloud-Computing---
4/4