By Khali Henderson

The continuing challenge businesses face in network security risk management has been identified as an opportunity for carriers; its one they have addressed in the last four or five years with IP VPNs primarily. But, say analysts and vendors, there is a larger opportunity for telcos in offering managed firewalls, intrusion detection, intrusion prevention, vulnerability scanning, antivirus, DoS protection, content filtering and antispam services.

The carrier-based managed security services market is expected to grow to $570 million by 2008, according to projections Yankee Group Research Inc. published last year.

Furthermore, private-labeled managed network security services available from specialized providers now offer telcos and other resellers like ISPs and even VARs an easier path to protecting customer networks and their own profit margins, which have been squeezed with the commoditization of telephony and bandwidth services.

One managed security services provider targeting ISPs and telcos is F-Secure Corp. Five years ago, the company established FSecure Online Solutions to deliver its managed security portfolio through telcos and ISPs.

F-Secure doesnt offer managed firewall services a fairly crowded space. The firewall is the first step where they [service providers] touch the water with their toes, says F-Secure Vice President Travis Witteveen. Once they have done that, they want to go further into the network of the business or home. Thats where F-Secures products and services come into play.

Among its partners is Charter Communications Inc. Charter Communications markets our service either as a value-added product or a bundle for their high-speed Internet. The customer is downloading a Charter PC security solution, however; the whole backend management of updating the product, making sure the policies are in place and the infrastructure is in place is all done by FSecure, explains Witteveen.

The companys consumer security solutions have been delivered as a service for five years. Last fall, the company ventured into the enterprise market. Deutsche Telekom AG is offering both services, he says.

The consumer, as well as the SMB, doesnt have the expertise to keep up with todays security needs, says Witteveen. Their Internet provider, whoever that may be a broadband provider or cable company or telco they look to them for a lot of their services. Very often they are calling them when they have something wrong with their PC. The service providers are playing more of a role in delivering security to business users and consumers.

Witteveen says most consumers are interested primarily in antivirus solutions. There are lots of [antivirus] services you can buy; the consumer has no idea what to do. When the service provider is recommending a package that has the latest services and can be delivered on a monthly basis, its a relief, he says.

Privacy protection, parental controls (content filtering) and antispyware options also are popular, he adds. With the latter, he says F-Secure not only identifies the spyware and alerts the user, it deletes it or disables it and helps the user delete it manually.

While similar options are available to enterprises, Witteveen says they are more interested in a straightforward solution that ensures their systems are safe from malware.

F-Secures targeted resellers traditionally have been major telcos, which resell its PEX service. In April, the company launched a new program called PEX Lite targeted to smaller ISPs and telcos and even interconnects and VARs. In contrast to PEX, which requires integration between F-Secure and the telcos systems, PEXlite is a turnkey solution.

All they need to do is put a URL link on their Web site. It still looks like them, but its completely autonomous from their network and billing system, Witteveen says. He adds that the service is co-branded instead of private-labeled and the reseller earns royalties. Interestingly, the royalties can be determined by the reseller so long as F-Secures costs are met. In contrast, PEX resellers are invoiced on a per-user basis and can charge or not for the services. Some charge per module; some charge one price for the bundle or nothing [as part of their Internet subscription], he says.

For PEX resellers that charge their end users, margins can be as high as a 100 percent, he says, noting there are other benefits as well. Being able to offer a security service to their users and the users not getting as many viruses and malware onto their systems has dramatically reduced their support calls and costs, and increased their bandwidth availability, he says.

Perimeter Internetworking Inc. recently began offering its managed security services to broadband service providers for resale. The company now offers both its managed appliance service and a new security-in-a-cloud service, Gateway 4.0, for private labeling.

Onvoy Inc., a Minneapolis-based provider of advanced telecom solutions, and NuVox Communications, an integrated communications provider serving business customers across Florida, are among the companys resellers.

ISPs or VARs offering a managed security service is not a new thing. But, what is new is the ability to be successful with it, says Perimeter Internetworking CEO Brad Miller. The problem, he says, is that most offers are scaled back versions of services designed for very large companies. It was just way too expensive a service for the typical middle-market company, he says.

So, a lot of ISPs have a security offering, but if you ask them how much success they have with it, its pretty limited.

Perimeter has taken a different approach, Miller says. We start with what the client is willing to pay, which is typically a fraction of the cost of a T1 to the Internet instead of a multiple of the cost of a T1 to the Internet, he explains of the $199-per-month service the company launched in January that includes firewall, intrusion prevention, VPN, intrusion detection, antivirus and content filtering. What is novel here is we have created an automated security service that will be very easily resold by ISPs at a price point that is saleable.

Traditional managed security services run upward of $1,000 per month, per device while the cost of a T1 is $750 or less per month. Large enterprises have no problem paying to secure their T1, Miller says. Small companies have a big problem with that.

Perimeter Internetworking, instead, installs a client-side device that it monitors automatically with no human intervention. End users are automatically alerted to problems and advised on recommended actions.

This is what I call a baby step into security, Miller says, adding it helps companies realize the extent of their vulnerability. By feeding them information in a real-time format, they have a firsthand awareness of how big a problem they have or dont have. If it becomes obvious to them they have a much bigger problem, they have the ability to upgrade to more of a managed service.

The managed appliance offer is designed for companies with 10 to 250 desktops; but the sweet spot is between 25 and 100, Miller says. The offer comes none too late; the integrated security appliance market is poised for explosive growth, reaching $3.3 billion by 2009, primarily from adoption by SMBs, according to In-Stat. The research house reports the addition of robust management and reporting capabilities have stimulated the use of integrated security appliances by ISPs and managed security service providers.

The simplicity of Perimeter Internetworkings offer and the price enables ISPs to be successful selling security, Miller says. In addition to incremental revenue, the ability to talk about something new at the point of sale is a differentiator for Perimeter Internetworkings resellers. And, Miller claims the offer can help ISPs reduce churn from 10 percent to 1 percent.

In May, Perimeter Internetworking rolled out to resellers its network-based managed security solution the same service it supplies to more than 700 banks. It is more expensive than the appliance-based solution but not much with a starting suggested retail price of $500 per month for companies with 50 desktops or fewer and $650 for 51 to 250 desktops. Clients with more than 250 desktops are priced individually.

Reseller margins for the network- and CPE-based programs range from 20 percent to 50 percent and depend on the level of support the reseller takes on. The higher percentages are available when Perimeter Internetworking is invisible to the client and the reseller provides the billing and support. Co-branding arrangements wherein Perimeter Internetworking provides the billing and support would be on the other end of the continuum.