Managed security services (MSS) is a fairly new concept in the Indian security industry, but during the past year the number of players in this space has been steadily increasing. SMEs have become a little less hesitant and have slowly started outsourcing security to infrastructure management companies. Akhtar Pasha examines vendor strategies and offerings in this space

According to Thandava Murthy implementing and managing security is the biggest challenge facing enterprises

In a nutshell, managed security services (MSS) are nothing but the outsourcing of security. By far, the most commonly outsourced security service is firewall management. However, many components of security are eligible candidates for outsourcing such as intrusion detection system (IDS), firewall, anti-virus, policy creation and vulnerability assessments.

IDC believes the biggest opportunities for MSS providers are within the SME space, where customers have strong security needs, but limited skills and resources. SMEs—mostly in manufacturing and retail, and some banks—have realised that they do not possess the requisite skills to evaluate security products, or to deploy, integrate and manage the whole set-up. Swapan Johri, general manager of the E-Secure division at HCL Comnet says, “Security is not a core competency for SMEs. Therefore, they are looking for a third-party security solution provider who can monitor the network in real-time (24x7) for virus attacks and unauthorised network intrusions.”

Market drivers
The shortage of qualified personnel is compounded by the fact that security is dynamic—knowledge and software that currently seems adequate, soon becomes obsolete, due to fresh vulnerabilities that keep cropping up. The MSS market is being driven primarily by resource constraints (capital and security expertise). Industry pundits say hiring a skilled security staffer would cost anything from Rs 6-8 lakh per annum.

“It becomes impossible for an organisation to monitor networks because that is not their core area of business. By outsourcing to third-party security solution providers, companies can cut their costs by 75 percent,” says Johri.
The growing complexity of networks and rogue access points, is a yet another market driver for MSS. Organisations need to continuously implement, manage and update security programmes, which requires a huge investment. Thandava Murthy, chief executive (Professional Services) at Wipro Infotech says, “A company can reduce 40 percent of its total security cost by outsourcing to a third-party service provider.”

Mushrooming Market
The MSS market in India has seen the emergence of providers like Bangalore Labs, Wipro Infotech, HCL Comnet and NAI. As per a Nasscom-IDC report, the total market for security in 2001 was pegged at Rs 125 crore. Johri expects the market to grow by 35 percent in 2002.

Murthy of Wipro Infotech says, “Security product implementation is a one-time investment in the range of 15-20 percent of the total cost of security. Managing and maintaining security solutions is twice as big a market because it involves continuous monitoring.”

Organisations have invested in complex, expensive and diverse security technologies to protect their IT assets. However, technology alone cannot assure security. Products like anti-virus, firewalls, intrusion detection systems and other security solutions need to be updated constantly. That’s where the expertise of the MSS providers comes handy.

Each security service provider has a niche segment and different business strategy for MSS.

Vishwajeet Deshmukh expects 20 percent of NAI’s revenue to come from MSS in the current fiscal

HCL Comnet: Traditionally a leading player in VSAT connectivity solutions, the company has set up a Security Operations Centre (SOC), from which it offers MSS, such as delivering remote security monitoring and management. Johri says, “Working remotely, our security consultants can proactively avert possible security intrusions, ensuring a quick response to new kinds of attacks.”

HCL Comnet offers 24x7 monitoring of IDS and a managed firewall service. It also offers periodic scans of security systems to discover new vulnerabilities and provide metrics and analysis highlighting through its external security assessment service (ESAS). Information Risk Management (IRM) offers an on-going service that tracks threat signatures, adjusts firewalls and correlates information from different devices, to provide trend analysis of the security environment.

“We are focusing on the high-end enterprise market and our approach will be to offer integrated end-to-end security solutions starting from consultancy, vulnerability assessment, security audits, to implementing security solutions and managing them,” says Johri. HCL Comnet’s customers are mostly global players operating in the finance and manufacturing segment. In India, it has Internet banking customers for whom it manages firewalls, IDS, gateways, anti-virus and checks authentication from its SOC. Johri says, “MSS currently contributes 10 percent of our total revenues. In 2002, this market will generate 25 percent of our revenues.”

Wipro Infotech: Murthy says, “MSS is a key portfolio for Wipro Infotech.” Wipro has strategic alliances with Watchguard Technologies for managed firewall and security services. In addition, it also has alliances with CheckPoint, Symantec, CA and RSA. The company follows three steps to offer MSS—consulting, system integration and security management remotely from its NOC in Bangalore as well as onsite. Murthy expects MSS to contribute about 15 percent towards Wipro Infotech’s revenues this year.

Bangalore Labs: The company offers security solutions on an ongoing basis from its IMaRC (International Management and Research Centre) located in Bangalore. It offers remote security management through its advisory, scanning, intrusion detection and remote firewall management services. Hathway, Pidilite, IIM-Lucknow and Shoppers’ Stop are some of its customers.

Network Associates: NAI is offering MSS through its ASP model. Says Vishwajeet Deshmukh, country manager of the SAARC region at Network Associates (SEA), “We have recently launched our MSS offering in India, and our target audience will be SMEs. Our services are based on an ASP model where customers can pick and choose the service they want us to manage for an annual or monthly fee.”

For instance, NAI can manage a customer’s desktop anti-virus through its VirusScan ASaP services for a fee of
Rs 2,000 per node for a two-year licence.

Similarly NAI also offers Web-based vulnerability assessment and intrusion detection services through its CyberCop ASaP. Other services of NAI include VirusScreen—protecting mailboxes for ISPs and software development companies. VirusScreen stops viruses before they enter the corporate network. Desktop firewall ASaP is a managed firewall offering.

Says Deshmukh, “We expect 20 percent of our revenues to come from MSS during the current fiscal. This service is aimed at manufacturing, construction, banks and telcos.”

MSS provides a win-win situation for both customers and providers. SME companies will now be able to focus on their core competencies, leaving the security aspect to the experts.