On-premise security doesn’t make sense
May 2014, Cyber Security

IT Security has become a complex challenge for companies of all shapes and sizes. With the range of threats to corporate data coming from the Web, social media, via e-mail, and internally, most companies typically address each channel with multiple best-of-breed solutions to ensure optimal effectiveness.

Richard Broeke, Securicom

“This prioritisation of product effectiveness over simplicity and ease-of-management comes with a high cost for businesses because buying and managing various point security solutions is expensive business. What makes this approach so expensive are the initial acquisition costs, the cost of IT labour to manage the systems on an ongoing basis, software licensing and maintenance costs, and the cost of any hardware that is needed to run the software,” says Richard Broeke, an IT security expert at Securicom.

Though using separate best-of-breed, on-premise solutions for different security problems remains the dominant approach for deploying IT security, recent research by Osterman Research shows that companies would prefer a single or cloud-based approach.

For example, Osterman Research found that 35% of the organisations it surveyed have on-premises, best-of-breed solutions in place, but only 16% cited this as their preferred security delivery approach. The study also found that while only 14% use a cloud-based and centrally managed security solution with a single interface, 24% actually prefer this model.

Broeke agrees: “There is a noticeable shift towards cloud-based security solutions in South Africa. Over time, we can expect to see more companies moving to cloud-based anti-malware, anti-spam and Web security solutions.

“We are definitely seeing a faster move to cloud-based services for email security and anti-spam than for other cloud-based services such as Web security. Our hosted email security and content filtering solution, ePurifier, grew more than 20% in 2013. Local companies are really starting to see the value in catching and stopping spam and malicious email content before it hits their networks.”

The fact is that IT security is rarely a core function. If the internal management of e-mail, Web and social media security as well as other parts of the IT infrastructure is not a core competency that is central to the success of a business, Broeke says it doesn’t make business sense to keep it in-house.

“Without a doubt, a cloud-based approach has potential to significantly reduce the administration, complexity, and overhead of IT security. The more predictable nature of cloud services costs makes them far more cost-effective than deploying and maintaining countless point solutions. If using internal resources to manage expensive, best-of-breed security solutions doesn’t add to the bottom line, why do it?” he questions.

To determine whether or not to use cloud-based security solutions, he says decision-makers need to understand the true cost of ownership of managing their current, on-premise infrastructure. They also need to understand the risks facing the business from an IT perspective.

“Very often, they come to the conclusion that their security is no better because it is on-premise. I have yet to see a case of a small to mid-sized company where hosting e-mail in-house is worth it from either a cost, security or uptime perspective.

He concludes: “Cloud based security is coming into its own as companies begin to see that outsourcing IT security functions such as e-mail and Web security gives them access to best-of-breed technologies and access to security experts without costly technology acquisitions or employing skilled resources. While there will always be business cases for on-premise or hybrid solutions, cloud-based services are set to become the norm.”