In the boardroom, capital expenditure traditionally falls somewhere behind liability, damages and turnover. Reducing it is considered desirable, but not a necessity. Keeping operational outlay down however is fundamental to any company´s success.
Organisations have conventionally adopted an embryonic method when implementing security solutions, beginning with a firewall at the perimeter and progressing with an Intrusion Detection System (IDS) and some form of internal content protection, such as URL filtering.
This ´multi-box´ approach of adding new hardware only when they are needed can cause operational costs to spiral out of control.
As the security market matures, businesses are starting to recognise that they have more options when it comes to security and they are demanding ROI. This has led company directors to scrutinise their operational expenditure, which in turn means that the capital outlay will be under review. Consolidating multiple security applications on to a single, central managed appliance not only reduces the amount of hardware and licences required in the initial purchase, but also allows for greater control of operational costs as there is only one point of management and responsibility.
Examining the costs
In terms of an organisation´s IT security infrastructure, the operational costs can often be hard to predict and therefore it is difficult to see a correlation between the two. Taking IDS as an example, the capital expenditure (CAPEX) associated with an IDS deployment would be somewhere in the region of Ј7,000. In addition to the initial costs, the ongoing operational expenditure (OPEX) associated with supporting, managing and manipulating the data produced by the IDS can easily escalate to 10 times the capital outlay. Taking into account that most enterprises have several IDS systems deployed at once, not to mention their firewalls, AV and URL filtering systems, it is easy to see how operational expenditure can become difficult to manage.
To ease the cost and management burdens, IT directors need flexible and scalable security solutions which can be managed centrally. There are numerous benefits in taking this approach to security implementation, all of which reduce costs and increase the ROI. In addition to cutting the personnel costs associated with administering a disintegrated security infrastructure, consolidation will eliminate many of the problems commonly associated with the ´multi-box´ approach to security.
Running multiple applications on a single appliance is one of the market´s fastest growth areas as organisations strive to lower TCO. Some vendors dispute the effectiveness of this approach, arguing that single appliances do not provide the specialised security requirements necessary for particular areas of the business. Appliances offer savings through reduced cost of support contracts and management costs, as well as the number of devices being hosted in data centres.
However, some companies are nervous about securing all their applications through one device and leaving the system open to a single point of failure. Managed services present a cost effective alternative and are highly effective provided that SLAs are clearly defined from the start. Although difficult to calculate, ROI can be assessed on the business benefits gained, for example, deploying a secure remote access system will reduce the travelling costs of employees and, in turn, increase productivity. Equating this cost reduction against the increase in productivity over a set period of time will give a quantifiable ROI.
On a practical level, rack and server room space is finite so there will come a time when adding more hardware is not an option. The cost associated with this space also contributes to the operational expenditure and will, therefore, reduce ROI. In terms of efficiency, the use of un-audited hardware can lead to duplication of tasks and redundancy both of which are detrimental to the aim of cost reduction and improved ROI.
When legacy systems are ready for renewal, organisations need to re-evaluate both CAPEX and OPEX in order to identify the opportunities for consolidation. By auditing the tasks performed by various elements of the infrastructure, companies can ascertain where their security redundancies lie and examine how to maintain and improve these functions with a reduced amount of hardware. There are a number of ways to reduce the operational costs of security including the creation of virtual taps for IDS sensors and the use of switching to diminish the number of firewall licences required.
With future costs also high on the agenda for most IT directors, it is vital that solutions are flexible and scalable. A consolidated approach allows the deployment of additional IDS sensors with a simple reconfiguration of the internal rule base. No extra licences, hardware or man-hours are required, so changes can be made quickly and efficiently. In addition, the technology is now available for hot swappable, self-healing architecture which reduces Mean Time To Repair (MTTR) to further cut operational expenditure. Working with a reputable e-security solutions provider will help companies implement the most effective technology and allow consolidation to be realised.
The benefits of consolidation make it easy to see why organisations are looking to integrate their security infrastructure. But while ROI is an important consideration, companies also need to assess the ongoing operational costs. For example, how much will the technical support cost? What is the price of changing the number of users in a licence mid-contract? How much work will have to be done on the existing network to incorporate the new security and what happens if the organisation decides to grow or downsize?
Keeping up-to-date with the changing face of the security market is vital for companies looking to cut both CAPEX and OPEX and the creation of a centrally-managed solution will allow them to achieve this aim. Increasingly complex network environments requiring multiple layers of security against malicious threats and intrusions need complete end-to-end security management and advice. As new technology is introduced, IT managers need to look for ways to integrate their security functions to further enhance the ROI.