Also visit our blog pages to read and respond to: iPHONE APPS – TAKING CARE OF BUSINESS?
Outsourcing e-mail security, perhaps through a new managed service offered by Telus, makes ample sense for the enterprise customer who may not want to dole out the money for in-house specialized skills, an analyst said.
Burnaby, B.C.-based Telus on Monday announced Secure Mail, an e-mail encryption solution for businesses. The application security framework, by Echoworx, encrypts documents in transit and at rest using PKI and S/MIME encryption and digital signature technologies.
In the partnership, Telus provides the facilities to operate and manage the technology for enterprise customers by the Toronto, Ont.-based software security technology developer.
Maintaining messaging security requires personnel with appropriate skills, and is the sort of cost that makes justifying in-house staff difficult, said James Quin, senior research analyst with London, Ont.-based Infotech Research Group. “Invariably what you find with security staff is large periods of inactivity punctuated with brief periods of hectic action. It’s the nature of the beast,” he said.
“Your general Exchange administrators aren’t necessarily going to have the skills coming in the door to manage the encryption portfolio. It’s going to be a learning process to get them up to speed,” said Quin.
Lack of internal security skills to handle encryption was the main driver behind using the managed service, agreed Nick Szirth, chief information officer with Surrey, B.C.-based physician-owned laboratory BC Biomedical. “We looked at in-house solutions and they were not our core competence, and this was an area we didn’t want to go to.”
In addition, he said, the cost of deployment of such technology in-house was high compared to a service-based solution.
Quin acknowledged security concerns that organizations might have around having a third party manage messaging security, however, the encryption layer that’s applied blocks access to Telus as well, “effectively protecting it from them just as much as from anybody else.”
Richard Reiner, chief security and technology officer for Telus Security Solutions, allayed customer concerns around outsourcing security by echoing the same sentiment. “It goes to some of the details of the architecture of the solution. The fact is that this solution doesn’t give entities, including ourselves outside the customer organization, access to the e-mail content.”
Reiner said he believes businesses are quite comfortable with the idea of outsourcing messaging security, as opposed to tackling it in-house.
The managed service also eliminates the complexity for the customer, said Reiner. “They’re have been a couple of significant challenges that have impeded business adoption of secure e-mail technologies today and they all pertain to the difficulty in managing those systems,” said Reiner.
In particular, PKI-based solutions, he said, “tend to be expensive, big integration projects, very unwieldly,” which have since dwindled in the enterprise due to the difficulties involved. Others may not have the cumbersome infrastructure, but tend to push security management to the unskilled end user.
Quin hypothesized that if Telus had a master decryption password that could decrypt everything, then customers would have legitimate reason to fear the risks of such a managed service – however, he added, it’s highly unlikely that such a master key exists given the problems that could arise.
Given it’s an outsourced service, he surmised Telus would probably include a provision typically found in such contracts deflecting liability in the event of a security breach. “Telus will hold service level agreements with Echoworx, so if there is any breach, ultimately, you may go after Telus, but then Telus will then go after Echoworx.”
Also visit our blog pages to read and respond to: iPHONE APPS – TAKING CARE OF BUSINESS?
