New Services Could Signal Shift In SaaS Security Offerings

Two major announcements this week indicate software-as-a-service (SaaS) security offerings are heating up, becoming both more comprehensive and easier to manage, experts say.

Symantec today announced its Hosted Endpoint Solution (HEP), a service that will allow small and midsize businesses to manage all of their desktop security clients from a single portal.

The announcement came a day after Verizon Business launched a comprehensive cloud security service, rolling antispam, firewall, intrusion detection, and denial-of-service attack protection into a single service that doesn't require on-premise equipment.

"We aim to have our [cloud] services 30 percent cheaper than our equivalent on-premise services," says Cindy Bellefeuille, director of security product management for Verizon Business.

Many businesses are now looking to SaaS and cloud services to help them cut costs, improve security, and simplify their security, she says.

"A lot of times it is about [business IT] environments that have become very complex," Bellefeuille says. "When you are looking at cloud-based services, you are looking at deploying really quickly and having consistency across the platform."

The two services show two sides of the cloud. Broad cloud security services had to wait on the maturation of security technologies and for demand in the marketplace to grow, observers say. Meanwhile, more focused security services are springing up to help small and midsize businesses cope with complexity.

"Security has gotten much more complicated," says John Pescatore, vice president of business intelligence firm Gartner. "With the more mature security protections, the services take the complexity out of those technologies."

Another sign of maturity: In the past, the fuzzy status of managed and cloud security services' compliance to various regulations kept some companies away. Today, however, the services can actually improve the auditing of certain aspects of security, Pescatore says.

"A lot of people are attracted to these security-as-a-service offerings because, as part of it, they get the reporting needed by regulations," he observes.

Verizon is rolling out its service in three phases. Starting in June, the company will offer antivirus, anti-spam, anti-malware, and URL filtering services for no charge to existing Secure Gateway customers. In the fall, the company will expand the offering to add network firewall and intrusion detection and prevention systems, and will allow non-Verizon customers to sign up for the services. In the first half of 2011, the company will add denial-of-service attack mitigation to its services, as well.

Where Verizon aims to sell services to enterprises, the goal of Symantec's HEP is to ease management of the company's endpoint security products for small and midsize businesses. Priced on a per-user, per-month basis, the service allows companies to deploy their agents to remote systems, enforce new policies on those systems, and generate reports from event logs.

Large enterprises are not as interested in SaaS offerings because they lose some control and flexibility, says George Tomic, distinguished engineer for Symantec Hosted Services.

"There is a lot more that enterprises are asking for, and they are more likely to want to tweak things," Tomic says.

Not all security technologies are ripe for moving to the cloud, Gartner's Pescatore says. Many companies like the flexibility of having a firewall appliance on-site, and so they resist moving to the cloud, he says.

"To get that efficiency, you have to give up some control," Pescatore says. "Almost invariably, when [our] clients tried outsourcing security [to the cloud], some pull it back inside because they need the control."

Will customers stay with more flexible on-premise equipment or be swayed by the promise of the simpler security of cloud services? Verizon's Bellefeuille is waiting to see.

"There will be lots of technologies that will move to the cloud, but there will also be a lot of situations where having an on-premise solution makes more sense," she says. "We are certainly looking forward to seeing what the eventual mix will be."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.