"Using a consultant can be beneficial in security more than in other areas because it gives you that outside perspective and checks and balances," he says.
Third-party verification of security can assure senior managers and others, says Michael Gabriel, CISO at Career Education Corporation, a provider of postsecondary career-oriented education: "There's value to having a certain amount of independence in your security assessments."
Consultants and integrators say their experience gives them a broad view of security their clients appreciate.
"There are a lot of things that are often skipped because people are thinking just inside their world," says Aric Perminter, partner at New York-based Secure Technology Integration Group. "A consultant coming in from the outside who's dealt with multiple clients will bring a much broader perspective and think outside the box."
For John Penrod, CISO of The Weather Channel, security VARs can provide valuable technical expertise with newer technologies. He's relied on Atlanta-based Vigilar for help in recommending wireless intrusion prevention products, Web traffic monitoring and other tools.
"One of the things I'm looking for with them is the ability to run interference when I need it, between me and vendors--to work with four or five vendors, help me determine which is the best product and help me to implement it, if I need," he says.
Emerging technology is an area where Paul Klahn, information security officer at an insurance firm, says he'll turn to a VAR for help. However, he'll only work with a reseller if it can provide value beyond what a vendor can, such as support, implementation or consulting.
As for what not to outsource to a security services firm, there aren't hard and fast rules.
"To me, it's not as much a decision on whether to outsource something or not," says Gabriel. "Outsourcing is more of a business decision. It's about what type of controls you set up when do you it. ...[They've] got to be in measure to the value of the information or the level of risk that you're taking when you do outsourcing."
