Managed Security Services

ISP-Planet Survey:
Managed Security Service Providers

ISP-Planet's biennial survey of MSSPs finds that as industry consolidation continues apace, service providers are offering more as administrators face new demands. But admins must understand that their job doesn't end when they start working with an MSSP.

by Lisa Phifer VP Core Competence, Inc. [December 20, 2006]

Today's security administrators are challenged to keep pace with evolving threats and compliance mandates, while simultaneously absorbing workforce cuts. Between increasingly targeted attacks and a tidal wave of privacy regulations, the consequences of security breach have never been greater. Many new countermeasures have emerged to manage this business risk, but who has the time to learn, deploy, and maintain them?

Managed Security Service Providers (MSSPs) are filling the growing gap between need and capability. From small offices with no IT staff to over-burdened enterprises, many companies now implement their security policy by partnering with an MSSP. This approach might save your business time and money while yielding more effective security—IF you choose the right partner to defend your networked assets.

Purchasing a managed security service means establishing a trust relationship with subject matter experts. It means asking that third party to assess your security requirements and vulnerabilities, then install and configure appropriate countermeasures. It means hiring an outsider to monitor and analyze traffic that threatens your networked assets—in some cases, taking action on your behalf to block intrusions or neutralize attacks. These and other security-related tasks can be shared to varied degrees, depending on the provider and service(s) you choose.

Available managed security services range from managed firewall and virtual private network (VPN) devices to intrusion prevention (IPS) and anti-virus/anti-spyware (AV/AS) solutions, and content filtering solutions. MSSPs leverage economies of scale to deliver these services with higher quality, at lower cost.

When an MSSP issues an RFP, conducts a field trial, and selects a "best of breed" platform, those efforts support hundreds of future installations. When an MSSP outfits a security operations center (SOC) with certified specialists and sophisticated Security Event Management (SEM) tools, those costs are amortized over thousands of devices. Customers get to benefit from the latest and greatest in security, while providers reap return on investment through monthly service fees.

This concept may be simple, but choosing the right MSSP is complex. When selecting a security partner, is it vital to consider history and reputation. You should evaluate the processes used by the MSSP to provision services, respond to incidents, support in-house investigations, and report on events. You must clearly understand the division of labor between you and your provider and how you will interact, not just during activation, but for the years to follow.

To assist our readers with this endeavor, ISP-Planet has conducted MSSP surveys since 1999. What follows is our fifth MSSP survey, conducted during Q4 2006. With this survey, we hope to provide you with insight into seven of today's most popular managed security services.

To create a representative sample, we invited over sixty providers—small to large, national to global—to complete an in-depth questionnaire. Invitees included past survey participants, companies that contacted us after our last survey, and many other players in the MSSP landscape.

This article reflects the responses submitted by fifteen providers—including two that merged during survey preparation. Participating providers and the surveyed services offered by each are summarized in the following table:

MSSP		Region	Firewall	IDS IPS	S2S VPN	RA VPN	AV AS	Anti- Spam	Content Filter
Altoria Solutions		Global							—
AT&T		Global						—
Fiberlink Communications		Global	—					—	—
Getronics		Global
Globix		Regional NY & CA		—			—	—	—
IBM Internet Security Systems		Global
Megapath Networks		National, USA
Perimeter Internetworking		National, USA
Secure Designs, Inc.		Global
SecureWorks		Global						—	—
Solutionary		Global
Symantec		Global							—
Unisys Corporation		Global
Verizon Business		Global					—		—
Virtela		Global					—

NOTE: This table is a snapshot of surveyed providers and services taken in December 2006. Offerings do change frequently, so please consult providers' websites for updates and additional services beyond the scope of our survey.

This year's survey turnout continues the consolidation trend demonstrated in past surveys that we conducted in 2004, 2003, 2001, and 1999.

Several current participants have merged or been acquired since our December 2004 survey. Aventail sold its managed service business to Netifice, which then merged with MegaPath. AT&T merged with SBC, while LURHQ merged with SecureWorks. MCI acquired NetSec, but was then itself acquired by Verizon. Getronics acquired RedSiren, BT acquired Counterpane, and IBM acquired ISS.

This flurry of MSSP merger and acquisition activity may seem familiar, but times have changed. Back in 2001-2003, many MSSPs were start-ups struggling to achieve profitability. Mergers were common among small providers who banded together to stay afloat, while others sold off their assets or left the market.

Today, the fish left in the MSSP pond are big—and they keep getting bigger. Recent acquisitions reflect a market that has matured. This year's LURHQ/SecureWorks merger was widely viewed as a symbiotic partnership between strong companies with complementary skills. BT and IBM acquisitions demonstrate that the big guns now consider the ability to offer managed security services important. Even the providers participating in our survey for the first time in this year—Solutionary, Virtela, and Perimeter—are established companies with six-year track records.

MSSP consolidation may have peaked, but the market itself has plenty of room for growth. According to Yankee Group analyst Andy Efstathiou, "Continuing needs for cost control and the growing demand for security will drive rapid growth. We anticipate this market will continue its [26 percent annual] growth trajectory for at least the next five years."

Among the key drivers cited by Efstathiou: growing sophistication and proliferation of security threats and inability of corporations to tackle those threats internally. Another factor driving companies to outsource security: the need to demonstrate compliance with industry regulations like Sarbanes Oxley and consumer privacy laws like California's SB 1386 ("SB" stands for "State Bill").

The providers participating in this year's survey demonstrate that MSSPs are a diverse lot. This year's turnout includes members from each of the MSSP market categories identified by the Yankee Group:

• Pure-play MSSPs (e.g., SecureWorks, Symantec, Solutionary) that frequently target SMBs;
• IT outsourcer MSSPs (e.g., IBM, Getronics, Unisys) that focus on Global 500 companies; and
• Carrier MSSPs (e.g., AT&T, Verizon, BT) that deliver a broad range of business network services.

Despite differences in company and customer focus, we see more consistency this year among the services offered by survey participants. Most participants do offer unique services that lie beyond the scope of this survey, from managed authentication to managed vulnerability assessment. But, this year, every participating MSSP offers both site to site and remote access VPN services. Nearly all deliver not only managed firewall, but bundled or complementary IPS services. Services that focus on high-growth threats like spyware and spam are still less ubiquitous, but clearly on the rise.

Over the next week, this series will describe the managed firewall, intrusion detection/prevention, virtual private network, antivirus/anti-spyware, anti-spam, and content filtering services offered by this year's participants. Each day, a new installment will focus on one of these services, using tables to enable side-by-side comparison, accompanied by our analysis of similarities, differences, and emerging trends. By the end of this series, we hope to have illustrated the questions to ask and attributes to look for when shopping for managed security. :

In Part 2, we will delve into the details of managed firewall and VPN offerings from the providers in our survey.

—End