How Security as a Service is changing cybersecurity

By Amit Nath Security has burgeoned to be a ‘must have’ in today’s world of complex network environments, huge IT infrastructures and innovative and sophisticated forms of cyber threats. With technological advancements, cyber-attacks are witnessing advancements too, with every turn of the internet. The numbers speak for itself. The security market in the country is expected to grow 8.3 per cent to reach $1.11 billion this year, from $1.02 billion in 2014 and will further grow to $1.69 billion by 2019, Gartner said in a statement. Further, Security services (including consulting, implementation, support and managed security services) revenue accounted for 57 percent of this total revenue in 2014, and this proportion will increase to 60 percent by 2019. The robust growth in the security services market will be primarily because customers need external services to transform their security posture in the digital business era. CIOs the world over are today facing high levels of security threats and attacks on digital applications such as e-commerce, email, multi-channel apps etc., hence, putting security protocols at the center-stage is more of a clarion call now. It has become indispensable to safeguard information from unauthorized access, use, disclosure, disruption, modification, perusal, inspection, recording or destruction. As businesses evolve and become more competitive, they will be looking for ways to reduce expenses, improve productivity, and create new, sustainable business models that not only protect their existing customer base from being encroached upon by competitors but also drive net-new customer enrolment. These market dynamics are forcing businesses to consider cloud based solutions as the answer because they are cost efficient. Further, organisations are rapidly moving toward cloud-based applications for many of their business processes, from sales and marketing management to customer relationship management, to accounting and billing, to training, and more. According to SiliconAngle, more than 60% of businesses use the cloud for IT applications, and the global market for cloud computing is expected to reach more than $79 billion by 2018. Understanding Security-as-a-Service Let us examine what Security-as-a-service (SECaaS) actually is. Internet-based security or cloud security products are a segment of the Software-as-a-Service (SaaS) market. Simply put, SECaaS is an outsourcing model for security management where a third party vendor is involved. Generically, SECaaS involves applications such as anti-virus software delivered over the Internet but the term can also refer to security management software provided in-house by an external organisation. The outsourcing of security according to SaaS principles is referred to as Security as a Service. Such systems are considered to be the next step in the evolution of Managed Security Services (MSS) and differ clearly from traditional outsourcing models or on-premises deployments. According to Gartner, the demand for SECaaS will grow significantly and might substantially change existing IT security infrastructure environments. Businesses are fast adopting cloud computing technology and new forms of threats are also emerging along with it, hand in hand. Some of the benefits that SECaaS offers, include; constant virus definition updates that are not reliant on user compliance, greater security expertise, outsourcing of administrative work and user provisioning. The industry will be forced to adopt cloud-based security services to take care of the basics so they can focus on more complex threats. With the ‘work from home’ and ‘work from anywhere, anytime’ culture making its inroads, partially spruced by the startup boom and also, due to the increasing talks about flexibility and work-life balance, the security industry too is getting incredibly dynamic by the day. With the widespread adoption of BYOD, employees are convincing companies to adopt mobile-friendly platforms that provide access to business relevant and sensitive data from anywhere, at any time. Some companies are opting for cloud based security services exclusively to reduce costs but are leaving out other information security technologies and services. That is a wrong move. IDC’s recent Cyber Threat Survey of more than 300 security practitioners found that despite the adoption of SaaS-based services that have embedded security capabilities, 53 percent of those surveyed said their budget for security increased by 25 percent if not more. Additional security technologies and services are of prime importance in the wake of increasing instances of ransomware, hijacking, phishing, and other kinds of cyber-attacks. The threat ecosystem is comprised of criminals with global networks successfully preying on companies with unsophisticated security solutions. However, because of its obvious benefits, cloud or SECaaS is one of several security-related trends that will surface and grow manifold in the coming year and beyond, analyst Earl Perkins told the Gartner IAM Summit 2015 in London. “Businesses need to watch the development of security services from the cloud as we expect these to grow and evolve,” he said. Moreover, it should be kept in mind that though cloud based security services is essential to the success of internet of things (IoT), cloud is nevertheless still only in its nascent stages, especially in a country like India. Cloud access and other broking services that would negotiate the relationship between cloud service providers and consumers will be key to enabling wider use of public cloud. How SECaaS is changing cybersecurity SECaaS solutions are fully operated and maintained by the external service provider with no client-sided hardware or software necessary. Complete virtualisation of the security service ensures the highest degree of capacity and resource utilisation. This makes the service highly cost-effective to the customer and enables pay-per-use models. This not only facilitates the instant commencement of service use but also leverages inherent data aggregation benefits for service providers. Overall, operational and organisational flexibility witnesses improvement via this way. SECaaS models while offering a baseline security to the provider to protect its own cloud infrastructure also provides flexibility to tenants to have additional security functionalities that suit their specific security requirements. The author is Head of Asia Pacific - Corporate Business at F-Secure.