Working With Security Service Providers: What Every Small Business Manager Should Know

It's also a mistake to enter into a security services relationship where cost is the primary driver, Kark says. "We see a lot of SMBs looking into outsourcing because they think it will save them money, but that's a myth," he says. "About 70 percent of the companies that outsource security end up spending as much or more on their outsourced services as they would have spent doing it themselves. It's true that they usually get more for their money -- in terms of skills and support -- but if you go into outsourcing with cost as your primary filter, you're not going to get the protection you need."

Support, not cost, is what separates one service provider from another, AppRiver's Smith says. "You need to understand their support philosophy even before you get into the contract," he advises. "Are they going to give you a trusted adviser who will work with your business to understand what you need and what your priorities are? If they give you a trusted adviser, will that person be responsive, or be overwhelmed with too many clients?"

Many SMBs end up purchasing their security services from a value-added reseller (VAR) that chooses its own provider and then delivers advice and support on top of the service, Smith observes. "The good VARs have looked at all the services out there and found the ones that really work," he says. "The shakeout in the services market is always faster in the SMB space because the VARs try them out and choose their favorites. VARs don't stick with bad providers the way big companies sometimes do."

But SMBs should be careful to vet potential VARs, just as they would vet potential service providers, experts say. "A lot of traditional VARs and hardware resellers have been moving into the managed security space because they like the recurring revenue," Prince notes. "Not all of them know security, and not all of them offer 24x7 support. All too often, they don't take the time to really get to know the client's business."

Prince says Perimeter doesn't extensively vet VARs before allowing them to resell its services, but it does require them to go through extensive training and certification to maintain their status as resellers. "We expect a lot of them," he says.

Whether they use VARs or work directly with the service providers, SMBs should set up methods to regularly test and monitor their security services to be sure they're getting what they're paying for, experts say. "A lot of SMBs want to turn on the service and then forget about it, but it doesn't work that way," Smith says. "We tell customers to go by the rule of ABT -- always be testing. You need to find out what the threats are, then find out whether your provider is handling them.

"If [the provider] giving you Web filtering, there are lists of bad URLs out on the Web that are updated all the time -- test out a few bad URLs and make sure your provider is blocking them," Smith adds. "If they're giving you spam filtering, go through your quarantines and see how they're doing on false positives or false negatives. You should test all the time, even after you get comfortable that the service is working."

Most SMBs find a security service provider they like and stick with it for the long term, experts say. "A good service provider relationship is an investment -- you get to know them, and they get to know you," Kark says. "You don't want to give up that investment and switch providers just because you're getting 95 percent spam filtering and some other provider gets 97 percent. But you should build your expectations about service levels into the contract -- if it's not written down, you can't be sure you'll get that level of service over the long term."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.