| COLUMN |
Cisco offers more email security choices, but lacks vision |
 |
|
|
Cisco Systems Inc is claiming to break new ground in email security by offering hosted IronPort-based service offerings.
But there does not appear to be any new security capability introduced in the announcement.
|
| SearchSecurity.com: |
| To get security news and tips delivered to your inbox, click here to sign up for our free newsletter. |
|
|
|
|
Cisco allows enterprise customers the choice of IronPort
antispam services in the cloud as either a managed or co-managed service, along with the added capability of outbound
data leakage prevention and encryption that can optionally be deployed as customer premise equipment. The
Security-as-a-Service offerings are targeted at enterprise markets.
It is disappointing that there is no new, additional security protection provided to customers today. Cisco's email security
now looks more like that of Symantec with its Vontu and Brightmail security lines, or even email security services with
Google-Postini or Webroot.
The Cisco announcement is a reminder of the three main questions IT should answer when evaluating new
security-as-a-service models:
- Are there any savings based on shared equipment? One theme of SaaS approaches is that infrastructure costs
are shared among subscribers, and that sharing more efficiently utilizes resources leading to direct operational costs
savings. Cisco's email security service is a dedicated solution for each customer. Operational expenses such as hardware,
rack space real estate, power and cooling are simply transferred from the customer data center to Cisco's data center.
The consumptive elements of email security have not been reduced and it is hard to see significant cost savings in equipment
utilization.
- Are there any savings in labor? Similarly, customers expect SaaS offerings to pass on operational cost savings
achieved either from shared labor for routine tasks or from highly skilled labor for difficult tasks. The work of managing
email security does not go away, and customers will have to pay Cisco a profit margin on top of labor expenses that the
company would pay for anyway. Customers investigating Cisco's email security services should compare ongoing labor costs
to ensure they are saving money.
- Are there any functional improvements in security coverage? Security in the cloud can leverage intelligence of
Internet traffic to deliver security that cannot be reasonably achieved in the customer network. Cisco IronPort's
reputation services are a perfect example of a security approach that can only be reasonably implemented in the cloud.
Customers may already have DLP features in their Check Point firewalls or Code Green DLP devices, and email security in
McAfee Inc.'s email appliances or Mi5 gateways. Ask Security-as-a-Service vendors how their approach delivers stronger
security or coverage that the organization can't with traditional products.
|
|
 |
Cisco's email security announcement will give customers more choices about securing their messaging infrastructure. It
would have been nice to see more vision in Cisco's first offering. The ability to orchestrate security responsibilities between
the cloud and customer premise equipment is intriguing, as is the ability to integrate full Web protection with email security
as a service, for example. Cisco has an impressive security business and this announcement must be a springboard for
future innovations. Let's hope so, as the customers will be waiting.
Eric Ogren is founder and principal analyst of the Ogren Group, which provides industry analyst services for vendors
focusing on virtualization and security. Prior to founding the Ogren Group, Eric served as a security industry analyst for the
Yankee Group and ESG. Ogren has also served as vice president of marketing at security startups Okena, Sequation and
Tizor. He can be reached by sending an email to eric@ogrengroup.com.
|
|
|
|
