MANAGED SECURITY SERVICES: Trust Seal for Security

The whole concept
of managed security services (MSS) is on the evolution path. There
was a lot of buzz 3-4 years back but today it has matured where
people do understand what managed security is and what it takes to
deliver it. Earlier, a remote antivirus management was considered to
be managing security. But today, customers are very clear as to what
they want from MSS, what they mean by 24x7 operations, and what does
it really entail to. The Indian market is definitely witnessing a
spurt in demand and this traction is expected to further increase in
next couple of years. More and more organizations are moving towards
MSS, as they are really concerned about protecting their assets.
Apparently, the compliance rules are forcing some of the
organizations to adopt and earmark a certain budget for MSS.

There are 2 major
growth drivers in any organizations. First and foremost is
'compliance'. This plays a major role. These days RBI has made it
mandatory for organizations in BFSI sector to implement security
management initiatives. Similarly, global organizations are governed
by SOX compliance which forces them to implement MSS. Then, there is
retail sector that has to implement PCI compliance. Last but not the
least, HIPPA compliance for healthcare sector has become mandatory.
These compliance are forcing organizations to move towards MSS.
Second major agent that forces organizations to implement MSS is that
the CIOs/CSOs want to protect their infrastructure from all possible
threats. These are evolved and progressive organizations for whom
security considerations are very important, they understand the
damage to an organization if there is no planned security
implementation.

According to a
global strategic business report titled, 'Managed Security
Services', the global network security market is expected to reach
$8.4 bn by 2015. Another research study expects the MSS market to
grow about 13% in 2011 and to reach $16.8 bn by 2015, with the
strongest growth coming from the segment. Besides, MSS is
most likely to grow both in the SMB and enterprise space. As the
economy is undergoing inflationary pressures and rupee at a very high
against the dollar, opex and MSS models will definitely be the way to
go for corporates looking at reducing risk and exposure to capital
expenses in the near future.

SPs IN BUSINESS

Today, MSS
offerings exist in various forms, from pure system management to more
sophisticated log analysis using a number of delivery mechanisms,
from SaaS and cloud services to on-premise device monitoring and
management. This could spell big opportunities for solutions
providers (Sps) catering to the SMB and enterprise segment. Sensing
this, many SPs and their vendors are working toward setting up their
MSS offerings. MSS providers (MSSPs) have evolved in various ways.
Some traditional ISPs, noting the increasing demand for internet
security that has occurred in recent years, have added managed
security to their repertoires. Few security vendors have added
internet access, thus becoming MSSPs. Still other MSSPs have become
as new entities. An MSSP offers cost savings by allowing an
organization to outsource its security functions. But some
organizations are reluctant to give up complete control over the
security of their systems. In addition, there may be considerable
variability in competence among MSSPs.

One of the
country's leading solution provider, Allied Digital has been an
early mover in the field of security. The company setup its security
operations center (SOC) in Mumbai when not many people were even
aware about security threats. In fact, it has got necessary
certifications for its SOC, which includes ISO 27000 certification.
Sanjiv Patki, global VP, managed services, Allied Digital said,
“Naturally, we have an early mover advantage. Today, we have some
major customers both in India and the US. One of the big mutual fund
houses in India is our customer. They were quite aware of security
paradigm and had security policy in place. They wanted to adequately
protect their organization and hence they went in for this service.
In last 3 years, they have been one of our most satisfied customers.”
Patki further added, “Although we have a fairly matured MSS
practice with large customer base, it does not contribute large share
in our overall business. We feel that Indian security industry is at
a inflection point and from here only those players who have strong
security practice will survive. Hence, we see a huge growth potential
in MSS space.” In MSS space, Allied has customers across different
verticals, including BFSI, manufacturing, retail, service providers,
etc. One of the major deployments that the company has done is in the
manufacturing segment, wherein it manages all periphery devices such
as routers, firewalls, IPS and also some internal servers and
applications. Logs from these devices are collected and the company
performs co- elation in its SOC and provides recommendations to
Change Control Board in that organization. Once changes are approved,
they are incorporated by Allied. This is easily one of the largest
security implementations in the manufacturing segment in India.

According to
Patki, “We are now seeing a lot of traction not only in the
perimeter security but also in the end point security space. More and
more CIOs have realized benefits from these services. This opens up a
lot of opportunities in security space. Moreover, other factors like
compliance requirements and cloud computing are also driving the
growth. MSS enables service providers like us to offer managed
security services to their customers without any upfront investment,
or the need to develop specialized inhouse security expertise.” He
also added, “For MSSP there needs to be a good SOC available with
right toolsets. The toolset would include vulnerability assessment,
penetration testing, log monitoring tool, website monitoring tool,
etc. We need right processes in place to deliver services to
customers. Last but not the least, people with security background
and who follow process, need to be available.

“Amongst the
market we operate in, we have seen that India has been a slow starter
in uptaking these services, as companies perspective. Hence, it is
difficult for IT managers to see the full value of security services.
However, we are quite bullish about the Indian market now and we feel
that by the year 2012, the necessity of security services will be
understood by Indian CIOs,” added Patki. Another leading solution
provider of the country, EssenVision started as an MSSP about 3 years
ago and today, it has about 150 customers. The company has an
in-built SOC and ETAC team with about 7 members working 24x7 for
remote access services to be provided to customers. Besides, weekly
reporting and security audits are being conducted remotely on
customers' servers and devices.

“We have also
tied up with some of the leading names for the MSSP model like
Symantec Message Labs, PCVisor, McAfee, and Websense which now offer
managed security and infrastructure management solutions from their
end. Currently, the share of MSS is about 15% of the business but we
foresee it to grow to about 30% till next fiscal,” said Ronny
Ferrao, COO, Essen Vision. A leading pharmaceutical company in India
is one of the highlights of a complete MSS service that has been
deployed by Essen Vision. It is doing MSS for the client's 5,000
users who are their marketing representatives spread out in every
remote corner of the country, having access to the internet through
data cards. No connection to the internal client network has deployed
an agent on each of these laptops remotely, whereby it is doing patch
management of these systems, providing system hardening through
application and device control, controlling internet usage of these
laptops, and manage the entire antivirus setup for all these laptops.
A central console and weekly reports are provided to the client team
for the same.

Moreover, a
leading financial company has also opted for Essen Vision's MSS
model for getting its emails content filtered and emails archived
over the cloud using its cloud based email filtering and archiving
service for over 3,000 users. This is one of the first in India where
email is being archived over the cloud instead of the client opting
to choose the expensive on-site model. “We have already setup a SOC
within our current setup and are lookout for a bigger space to build
a complete SOC as per SAS 70 guidelines for which we have provisioned
investments this year. The idea is to build a team running a
completeSaaS and MSS business for customers. We look forward to move
ahead in this direction very seriously in the next fiscal,” said
Ferrao.

Delhi based ACPL
Systems had made cautious growth in this space. Currently, it is
working with its existing customers and looking at how the company
can make them shift to MSS. “We start with non critical portions
and give confidence to customers and then slowly try to take over the
critical devices too. Currently, we have an agreement with a large
service provider where we are giving an endpoint security to them.
Besides, we are also managing email and web security for few large
corporates in the country. Our state of the art SOC is coming up soon
in Gurgaon. As of now, the share of MSS in the company's overall
business is about 12%. Our SOC, which should be operational in Q1 of
2012, will definitely help us to drive this offering for our
customers,” pointed out Vishal Bindra, CEO, ACPL Systems.

Another SP that
has forayed into this space is Green Vision. “We have our own
solutions for small businesses in the country, whereby we protect
their local area networks from all kinds of internet related threats
through our own Firewall. In the beginning, we actually tried to be
slightly independent of OEM influence and promoted our own brand and
solutions where we can showcase our own creativity rather than piggy
bank on the success of any brand. We have done a number of
deployments in the small offices with 15- 20 PCs. These customers use
our solutions and drive value out of it. Currently, as far as overall
business is concerned, this is contributing about 20%,” said Saket
Kapur, CEO, Green Vision. “The biggest challenge for a company like
us is that we cannot spend money on brand creation, as it is a very
expensive exercise. And that's where convincing the customers takes
a longer time, unless and until it comes through word-of-mouth. The
real challenge today is to increase the market share. Going forward,
we don't see major installations happening but yes, we are
definitely going to renew the contracts with the existing customers
and try to give solutions that could increase operational efficiency
of these businesses,” added Kapur.

And not to be left
behind, Mumbai based MIEL e-Security is striving to make big in this
space as well. Anuj Gupta, CEO, MIEL e-Security said, “Though we
have a team in place and provide 24x7 support to our customers, we
are still struggling because we are not getting the right price from
the customers. Our investments does not justify the cause, customers
do not understand the true value of MSS. There is a lot of demand for
MSS in the market and in fact, most of the customers have gone ahead
and adopted it as well. But in terms of margin and making
profitability, it is still a huge challenge for SPs. We have won 4-5
big customers in this space from different vertical industries like
IT/ ITeS, manufacturing, and financial sectors. The share of MSS is
definitely growing in our overall business model.”

THE SOLUTION CHAMP

Now, if we analyze
the presence and success stories of these solution providers in the
managed security space, one name that clearly stands out is Allied
Digital, which is well positioned to be strong player in this
emerging business opportunity.