SECURITY SOLUTIONS: Tap The Spending

They have
to educate users on the decreasing time between vulnerability disclosure and
widespread exploitation by virus and worm attacks.

Digitized data has become the the most valuable asset for every company that
uses IT infrastructure. And protecting this valuable data has become a priority.
Enterprises across the globe have realized the importance of spending on
security.

"There is a definite growth in terms of awareness about security and its
attached importance," says Ambarish Despande, Head, Channel and Consumer
Sales, Symantec (India). But, the percentage spent on security is still very
small.

Experts say that worldwide it is around 6% of the total IT budget, and in
India it is around 2%. It also depends on how big the IT budget is and the kind
of business enterprises are into.

HARDEST HIT

Until last year, financial services, telcos and manufacturing sectors were
the hardest hit by security breaches and they were the top spenders in deploying
security solutions. But this year newer segments like healthcare and
power/energy along with financial services were the hardest hit. This gives a
clear indication that the more critical the infrastructure and business with
signification financial resources, the more severe the attack rate.

This gives rise to the question as to how much should one spend on security?
While there is no single answer to this question, the best way would be to find
out how important is the data that needs to be protected in any company, and
measure it against the loss that could happen if it is lost.

HOW MUCH TO SPEND

Experts believe a lot of factors need to be taken in to consideration before
getting a fix on the percentage of spending for security. According to Ambarish,
it is very important that companies find out what they are trying to protect.
And then comes the willingness as to how much one is willing to spend on
protecting this. "Companies need to prioritizing the sensitivity of the
data that needs to be protected, before deciding on the percentage of spending
on security," says he.

The importance level of data varies from industry to industry. The most
valuable data for a pharmaceutical company would be its formulas. Similarly, the
most valuable data for a manufacturing company would be its design. Here comes
the role of security solutions provider in helping enterprises decided the right
spend.

If solutions providers are able to help companies measure the losses that it
will have to bear if sensitive data are destroyed or leaked to competitive, then
deciding on how much to spend on security will not be an issue.

IDEAL APPROACH

Before selling a security solutions, solutions provider are required to help
enterprises identify what they are trying to protect against a limited budget. A
step-by-step approach, will help solutions providers to give the right advice.

Together, a calculation should be done to arrive at the value of the
information asset they are trying to protect. Then, analyze the network to find
where the critical informations is lying. If it’s lying all across the
organization, it needs to be consolidated.

A security zone should be created next. Before the security solutions are
deployed, an important aspect of analyzing the infrastructure is to circulate an
exhaustive questionnaire which helps in understanding the functioning of the
company. Getting this questionnaire answered by important users and systems
administrators is crucial to plug loopholes in the network.

This also helps implementors in devising a clean security policy for the
company. The final step just before deploying a security solution would be to
take necessary backup of the valuable data.

SERVICE REVENUE

Most security vendors admit that there is a good demand for a regular
service on the security front. But all customers cannot be catered to by the
vendor directly. And hence, vendors usually encourage partners to upgrade their
infrastructure to be able to provide regular service. "There are many
customers who depend a lot on partners because of our experience in the
field," says Peter Theobald of IT Secure.

Service revenue can be anywhere between 50 to 100% of the product value. And
it is like a continuous income, without a continuous investment. "It is a
pure revenue stream against an investment that you have already done on people
and training," says Ajit Menon, Director, QuantumLink.

Customers look at affordability and the expertise. Considering the ‘continuous
revenue stream factor’, providing affordable solutions would be more sensible
option to retain customers. The pricing structure will also depend on how
seriously the solutions provider has invested in acquiring the required
expertise from vendors who are more than happy to provide the required
certification against a formal training.

DEPLOYMENT ON THE RISE

The scope of deploying security solutions is growing
day-by-day. Banking and financial services institutions were always on the top
of customer list because of the financial nature of the industry. Others
verticles like business services, health care, power and energy, media and
entertainment, non-profit organizations, e-commerce, manufacturing, high-tech
industries, and telcos are also lined as a target by the bad guys in the recent
past.

Even the government sector, which usually lags behind the
private sector when it comes to spending on IT infrastructure,

is more serious about security these days. With increasing e-governance
initiatives, even the government has become increasingly aware about security
risks associated with the IT infrastructure.

NOT JUST ANTI-VIRUS

Today, security is not about protecting desktops with just an antivirus
solution. It is no longer a part of the pre-loaded software that used to come
with the desktops.  Indian enterprises have now gone beyond primitive
firewall protection. Intrusion detection systems are now being developed and
deployed. During 2001, technology related concerns like pace of change of
technology, complexity of technology and lack of trained manpower were the
primary barriers. But, things have changed. Increased number of seminars and
workshops by vendors is creating awareness. After all the recent virus/worm and
hacker attacks that have been causing huge loses in various verticals, Indian
enterprises have begun to realize the importance of security as a crucial part
of their IT infrastructure.

Until last year, the decision to spend on security use to happen at the
systems administrator or CIO levels, but today, the decisions to implement
security solutions are happening at the board level because, the impact of any
security breach is felt across the company.

Security vendors agree to the fact that, there has been a significant
improvement in the way people look at security now-a-days. This is evident from
the fact that most security product vendors are seeing a good movement of their
products for the last one year. This is also supported by the IDC India data
that Internet security, as an industry, has grown at the rate of 83% CAGR.
Market feedback also says that the media has also played a good role in
increasing awareness about security to a level which attracts some serious
spending.

NEW ENTRANTS

As the number of attacks rises, the need to perform security tasks
effectively, grows. In recognition of the growing need to make security
management easier and more effective, several companies have moved into or
increased their presence in the security solutions market with a combination of
products and services designed to answer this need.

Solution providers are required to understand the ways these needs of
enterprises can be addressed. (See box)

According to the recent Threat Report released by Symantec, the time between
vulnerability disclosure and widespread exploitation is decreasing. These trends
ultimately suggest eminent "zero-day" threats, which means such
threats target vulnerabilities before they are announced and patches are made
available. What more can be a greater reason for all those who have not invested
in security, to start spending on security!

NELSON JOHNY In Mumbai