Outsourcing Security Doesn't Mean You're Desperate

Self Protection Before handing your security over to an outsourcer: >> Inventory your databases, networks, and systems >> Check the background and financial stability of the provider >> Outline regulatory compliance needs and how they'll be met >> Define all interfaces the provider will use to access data on your network

VeriSign bought Guardent in 2003 for $140 million, and BT Group earlier this year acquired Counterpane Internet Security, founded by IT security luminary Bruce Schneier. Other security vendors have merged, including SecureWorks with Lurqh in September (keeping the name SecureWorks), and TruSecure with Betrusted in 2004 to form Cybertrust.

SecureWorks' customer Digital Federal Credit Union isn't likely to outsource the maintenance and management of its core IT infrastructure for loans and deposits anytime soon, but the not-for-profit financial cooperative formed in 1979 as part of Digital Equipment Corp. knows its limitations when it comes to security. "We're a financial services company, we're not security experts," says VP of IS Kris VanBeek. Digital Federal serves more than 300,000 members at 1,000 companies.

Digital Federal has SecureWorks perform security assessments on the products and services it develops for the Web. "SecureWorks is able to keep up with the latest; we don't have anyone on staff who can do that," says David DeWitt, the credit union's IS risk manager.

"We're looking at SecureWorks in place of hiring a whole department to do this full time," says VanBeek, who estimates it costs about half as much to outsource as it would to hire a security staff and buy the necessary technology.

25% The portion of U.S. companies outsourcing security functions Data: InformationWeek/Accenture Global Information Security survey of 966 U.S. business technology and security pros

ICI Group has relied on Qualys for the past four years to scan every IP address ICI owns or has data on for signs of trouble. Before hiring Qualys, ICI didn't have a regular or repeatable process for detecting viruses or other problems with its IT systems. When Simmonds joined in 2001, "we ran a penetration test and actually defaced the ICI Web site in under a half hour," he says.

Qualys manages all of the devices used to protect ICI's systems and provides the company's security staff with a Web-based interface for checking the information collected. This approach lets ICI avoid investing in security hardware and software. If Qualys went bust, "the only thing we'd have committed to was their services. This is difficult work," Simmonds says, so the decision to outsource was easy.