Build Sales With Managed Security Services

Network security is nothing new — nor are managed services. It’s the combination of the two that is emerging as one of the hottest new trends in IT. Gartner tells us that security will be the fastest growing segment of the managed services market, expanding at a compound annual growth rate of nearly 20% during the next three years. There’s little doubt that managed security services provide fertile sales opportunities for VARs. But VARs also need to look at this emerging market from a defensive posture. If you’re selling security solutions without a managed services component, you may be left behind when your competition introduces managed security services to your customers.

Managed security services can take many forms. On a small scale, the service can be as simple as remotely managing a customer’s firewall. For larger customers, a VAR may provide management of all IT security services across multiple locations. A managed security provider is someone who proactively monitors the activity of firewalls and intrusion detection/prevention systems and responds to threats. The goal is to provide customers with proactive hands-off security management solutions for their networks, while reducing the amount of staff training and in-house maintenance required to keep data secure. The results are that VARs generate recurring monthly service revenue and gain trusted advisor status.

Use Managed Services To Complement Existing Business

There’s no need to close your existing business to get into managed security services. This isn’t an either/or proposition. For example, Fortress Network Security, LLC is a company that was founded in 2001 as a spin-off of InterSpace Computers. InterSpace was founded in 1996 to build and sell white box (custom-made) computers. In 1999, InterSpace switched gears to focus on selling security products. InterSpace founder Joe Sykora recognized the emerging importance of offering security as a managed service and decided to start Fortress, a company that is achieving 25% sales growth this year by providing security hardware appliances, software products, and managed services.

Why create a new company? Why not sell security through InterSpace? At the top of the list of reasons was Sykora’s desire to offer security services to competitive white box VARs. He was worried that companies would not buy security services from a competitor. In addition, he wanted InterSpace to focus on its strengths, without the major distraction of security. From a marketing standpoint, Sykora planned to market the companies to different audiences, so the separation made good sense.

“InterSpace has become a custom fulfillment company and works very well with Fortress,” says Sykora. “Our InterSpace Distribution Division customizes products such as computers to be used as POS [point of sale] terminals. Our Government Division holds contracts with Lockheed Martin, as well as direct contracts with U.S. Naval Warfare and the Coast Guard. InterSpace focuses on providing custom IT solutions and hot-spare services to regional customers. We are marketing Fortress as an international security service provider.”

Overcome Managed Service Objections

Fortress faced customer objections when entering the emerging managed security services market. “The biggest objection really wasn’t an objection, but a lack of understanding of what is required to properly protect their data,” says Sykora. To address that lack of understanding, Sykora realized that Fortress needed to educate customers on the benefits of managed security services. “We’ve taken our show on the road,” explains Sykora. “Seventy-five percent of our security sales leads are generated by activities such as educational road shows and face-to-face meetings.”

Fortress faced other customer objections, but most of those objections also were caused by customers not understanding potential security threats. In one instance, a company didn’t care if an outsider got to its data, because it felt that the data was not private enough to worry about. The customer wasn’t aware of the chaos that can be caused by a DOS (denial of service) attack, which virtually shuts down a company’s network connection — particularly e-mail in this case. “Once we helped the company understand the potential problems, it saw the value of our service and signed up for our managed services offering,” adds Sykora. The solution consisted of a SonicWALL PRO 1260, which is an all-in-one security and switching appliance, configured for secure remote access by Fortress.

Sell Security As An Ongoing Process, Not A Product

Sykora says one of the keys to being successful selling security solutions is knowing how to position security services. “VARs must convince the customer that good security is not a singular event or a series of individual steps,” he says. “Security is a process that should be executed every single day. Yet, if you asked most IT professionals what steps they take to ensure the security of the systems they manage, they will usually mention measures such as installing firewalls or antivirus software.”

A good example of this problem comes from my personal experience with SMB customers. In many instances, small businesses that paid to have antivirus software installed were shocked to learn that their antivirus definition files were often out of date just months after the installation, leaving them vulnerable to viruses and intrusion. They simply did not understand that network security is an ongoing process. Those customers were prime candidates for managed security services.

Vertical Markets Provide Managed Security Services Opportunities

Regulated industries such as healthcare and finance provide VARs with many managed security services opportunities. “The fact that those companies are mandated to protect their data only helps our business grow,” says Sykora.

Retail businesses that are PCI (payment card industry)-compliant are also worthy of VAR attention when it comes to selling managed security services. For example, Fortress won a managed services contract with an international jewelry retailer. The VAR provided a managed security solution for locations in South America, Mexico, and the United States. The installation protected the synchronization of POS information and Lotus Notes data between international store locations. Fortress installed a SonicWALL VPN solution to provide secure communications across the Internet. The costs savings for the customer were estimated to be approximately $9,000 per month. Fortress continues to provide the retailer with managed security services for all of the SonicWall devices, generating ongoing monthly revenue.

The managed security service that Fortress provides this customer is proactive examination of the SonicWALL devices. “We’re looking for problems the retailer has before it knows it has them,” says Sykora. As part of the management service, Fortress also provides intrusion prevention, content monitoring, and real-time reporting capabilities. As a nonsecurity-related benefit of the reports, the retailer has been able to review how employees are using their time and refine business processes to make better use of employee’s time.

In instances where companies are not willing to pay for fully managed security services, Fortress offers what Sykora refers to as an “up-down” monitoring service. This differs from fully managed services by limiting the services available to the retailer. An example of up-down service is a retail customer that only wanted to know if the security devices were active. Fortress provided simple device monitoring, firmware upgrades, and a base level of support. No proactive monitoring or reporting was available to the customer.

Consider The Business Requirements To Add Managed Services

Is this the right time for you to get into managed security services? My advice is to contact your VAD (value-added distributor) and talk about the best way to get started (see sidebar on page 32). Be sure to discuss all aspects of adding security to your practice, including what is required from a business infrastructure standpoint (e.g. firewalls and antivirus software). In addition to security expertise, a managed services business requires a capable CRM (customer relationship management) package to stay on top of customer activities. Take advantage of VAD seminars and security conferences. Sykora says that the seminars provided by his VAD, Alternative Technologies, are a great way for him to learn about new security opportunities and to interface with his peers.

I’m not proposing that every VAR create a new security company or jump into managed security services. This opportunity is not a good fit for every VAR. As a matter of fact, Sykora recommends that VARs new to the security market partner with an existing security company to learn the business — then make a decision about adding managed security services. Sykora concludes, “Why reinvent the wheel when there are many companies out there that already made the big mistakes?” The only real mistake that Sykora made was getting too involved in custom programming for customers — it wasn’t profitable for the company. Fortress has learned from its mistakes and provides other VARs with an excellent example of how to succeed in an emerging technology such as managed security services.